Examkin

Question

Difficulty: HardNetwork Security and Private Access

A company named Apex Health is designing a secure architecture in Azure to comply with healthcare data regulations. The architecture includes a virtual network named VNet-Prod containing a subnet named Subnet-Web, where virtual machines process medical records. The application must write these records to an Azure Storage account named storepatientdata.

You need to recommend a network security solution that meets the following requirements:
- Virtual machines in Subnet-Web must access storepatientdata using a private connection that does not traverse the public internet.
- Virtual machines in Subnet-Web must be prevented from exfiltrating data to any other Azure Storage accounts, including those in other subscriptions.
- Public internet access to the storage account must be disabled.
- The solution must minimize administrative overhead and avoid configuring user-defined routes (UDRs) or custom firewall virtual appliances.

Which two actions should you include in the recommendation?

  1. Enable a virtual network service endpoint for Microsoft.Storage on Subnet-Web and associate a service endpoint policy that permits access only to storepatientdata.Answer
  2. Configure the firewalls and virtual networks settings of storepatientdata to restrict access to Subnet-Web in VNet-Prod and deny public access.Answer
  3. C
    Associate a Network Security Group (NSG) with Subnet-Web and configure an outbound security rule that permits traffic only to the Storage service tag.
  4. D
    Configure a User-Defined Route (UDR) on Subnet-Web to route all traffic destined for the storage account to a custom firewall virtual appliance that performs packet inspection.

Answer

The correct recommendations are to enable a virtual network service endpoint for Microsoft.Storage on Subnet-Web with an associated service endpoint policy that restricts access to storepatientdata, and to configure the firewall settings of storepatientdata to restrict access to Subnet-Web in VNet-Prod and deny public access.
To satisfy the requirements securely and with minimal administrative overhead, you must combine virtual network service endpoints, service endpoint policies, and storage firewalls. Enabling the Microsoft.Storage service endpoint on Subnet-Web ensures database traffic is routed internally via the Azure backbone network. Attaching a service endpoint policy to Subnet-Web restricts outbound access exclusively to the storepatientdata storage account, preventing data exfiltration to other storage accounts. Finally, configuring the firewalls and virtual networks settings on the storage account itself restricts incoming traffic to Subnet-Web of VNet-Prod and denies public internet access, securing the data at rest and in transit.

Step-by-Step Solution

1
Secure the transit path from the subnet to Azure Storage.
Enable a service endpoint for Microsoft.Storage on the subnet, routing storage traffic through the Microsoft backbone.
This satisfies the requirement for a private connection that does not traverse the public internet without the need for complex VPNs or ExpressRoute.
2
Prevent data exfiltration to unauthorized storage accounts.
Associate a Service Endpoint Policy with the subnet, specifically listing the resource ID of storepatientdata.
Service endpoint policies filter outbound database/storage traffic over service endpoints, blocking access to other storage accounts while keeping administrative overhead minimal.
3
Restrict storage account access at the target side.
Configure the storage account firewall to restrict access to VNet-Prod and Subnet-Web, and disable public network access.
This blocks public internet access and ensures only the authorized subnet can connect to the storage account.

Key Concept

Azure Virtual Network Service Endpoints and Service Endpoint Policies
Estimated Time:2m 0s
Rate this question

Topics

Network Security and Private Access

More questions from this topic