Examkin

Question

Difficulty: HardNetwork Security and Private Access

A company named Aetheris Manufacturing is designing the network security architecture for a new web application. The application runs on Azure Virtual Machines deployed in a subnet named AppSubnet within a virtual network named VNet1. The application requires access to an Azure SQL Database and must retrieve configuration secrets from an Azure Key Vault. The application must also authenticate users using Microsoft Entra ID. You need to design a security solution that meets the following requirements:
- Restrict all outbound internet access from AppSubnet, except for the traffic required for Microsoft Entra ID authentication and Azure Key Vault access.
- Ensure the virtual machines access the Azure SQL Database using private IP addresses.
- Minimize the administrative and operational effort required to maintain network security rules.
- Avoid manually defining and updating public IP address ranges in network security rules.

Which two actions should you include in the design?

  1. Deploy a Private Endpoint for the Azure SQL Database in a dedicated subnet within VNet1.Answer
  2. Associate a Network Security Group (NSG) with AppSubnet and configure outbound rules that allow traffic to the AzureActiveDirectory and AzureKeyVault service tags, followed by a lower-priority rule that denies outbound traffic to the Internet service tag.Answer
  3. C
    Configure Virtual Network service endpoints for Microsoft Entra ID on AppSubnet.
  4. D
    Create custom outbound security rules in the Network Security Group (NSG) using the specific public IP address ranges for the Microsoft Entra ID and Azure Key Vault regional endpoints.
  5. E
    Deploy an Azure NAT Gateway on AppSubnet and configure it with custom filtering policies targeting Microsoft Entra ID and Azure Key Vault endpoints.

Answer

Deploy a Private Endpoint for the Azure SQL Database in a dedicated subnet within VNet1, and associate a Network Security Group (NSG) with AppSubnet and configure outbound rules that allow traffic to the AzureActiveDirectory and AzureKeyVault service tags, followed by a lower-priority rule that denies outbound traffic to the Internet service tag.
Deploying a Private Endpoint for the Azure SQL Database ensures that database traffic is kept entirely within the private network, satisfying the requirement to access it via private IP addresses. For the security rules, using the built-in AzureActiveDirectory and AzureKeyVault service tags within the Network Security Group (NSG) allows authentication and Key Vault traffic while blocking all other outbound internet traffic. This avoids manual IP list maintenance and fulfills the requirement to minimize administrative and operational effort.

Step-by-Step Solution

1
Analyze database connectivity requirements
Identify that a Private Endpoint is needed to assign a private IP address to the Azure SQL Database.
This satisfies the requirement to avoid exposing the database publicly and allows secure access via internal IPs.
2
Determine service access security parameters
Identify that Microsoft Entra ID and Azure Key Vault require outbound connectivity, which should be secured using built-in service tags rather than individual IP rules.
Service tags minimize administrative overhead by dynamically maintaining IP address ranges for Azure services.
3
Apply Network Security Group configurations
Associate the NSG to the application subnet, adding rules to allow AzureActiveDirectory and AzureKeyVault outbound traffic, followed by a lower-priority rule to deny outbound traffic to the Internet.
This configuration enforces the restriction of general internet access while maintaining operational access to key services.

Key Concept

Azure Private Endpoints and Network Security Group Service Tags
Rate this question

Topics

Network Security and Private Access

More questions from this topic