Examkin

Question

Difficulty: Very hardNetwork Security and Private Access

Your company, Aetheris Manufacturing, is designing a secure network architecture in Azure. The architecture consists of a Hub virtual network (VNet) and a Spoke VNet peered together. Subnet-App (10.20.1.0/2410.20.1.0/24) in the Spoke VNet hosts virtual machines running a production application. Subnet-PrivateLink (10.20.2.0/2410.20.2.0/24) in the Spoke VNet contains Private Endpoints for an Azure SQL Database (sqldb-prod.database.windows.net) and an Azure Key Vault (kv-prod.vault.azure.net). Public network access is disabled on both the SQL Database and the Key Vault. You must block all outbound traffic from Subnet-App to the public internet and ensure that the virtual machines can only communicate with the specific SQL Database and Key Vault instances. The solution must minimize administrative overhead. Which network security configuration should you recommend for Subnet-App?

  1. Configure outbound Network Security Group (NSG) rules on Subnet-App that allow destination traffic to the specific private IP addresses of the SQL Database and Key Vault private endpoints, followed by a rule that denies outbound traffic to the Internet service tag.Answer
  2. B
    Configure outbound Network Security Group (NSG) rules on Subnet-App that allow destination traffic to the Sql and AzureKeyVault service tags, followed by a rule that denies outbound traffic to the Internet service tag.
  3. C
    Configure a User Defined Route (UDR) on Subnet-App for 0.0.0.0/0 pointing to an Azure Firewall in the Hub VNet, and configure application rules in the Azure Firewall to allow traffic to the FQDNs of the SQL Database and Key Vault.
  4. D
    Configure a custom route table associated with Subnet-App that routes the Sql and AzureKeyVault service tags to an Azure Firewall in the Hub VNet, and configure NSG rules on Subnet-App to allow all outbound traffic.

Answer

Configure outbound Network Security Group (NSG) rules on Subnet-App that allow destination traffic to the specific private IP addresses of the SQL Database and Key Vault private endpoints, followed by a rule that denies outbound traffic to the Internet service tag.
The correct configuration uses outbound NSG rules targeting the specific private IP addresses of the SQL Database and Key Vault private endpoints, and then blocks all other outbound internet traffic using the Internet service tag. Because Private Endpoints utilize private IP addresses from the local VNet address space, NSG rules must target these private IPs rather than Service Tags, which only cover the public IP addresses of the services. Additionally, because the client subnet and the Private Endpoint subnet are in the same VNet, traffic is routed locally and bypasses default route table configurations pointing to a hub firewall.

Step-by-Step Solution

1
Analyze how traffic to Private Endpoints is addressed and routed.
Private Endpoints receive private IP addresses from the subnet in which they are deployed (Subnet-PrivateLink, 10.20.2.0/24). Traffic destined for these endpoints is addressed to these private IPs, not to public IPs.
This determines how firewall rules, route tables, and NSGs will evaluate the destination addresses.
2
Evaluate the behavior of Service Tags in NSG rules and User Defined Routes (UDRs) for Private Endpoints.
Service tags (such as Sql or AzureKeyVault) represent public IP address ranges of Azure services. They do not match private IP addresses allocated to Private Endpoints.
This rules out solutions that attempt to filter or route Private Endpoint traffic using service tags.
3
Evaluate routing precedence for traffic within the same virtual network.
Traffic from Subnet-App (10.20.1.0/24) to Subnet-PrivateLink (10.20.2.0/24) is handled by the default local system route (10.20.0.0/16). A UDR for 0.0.0.0/0 is less specific and will not intercept this traffic.
This explains why routing through a central Azure Firewall using a default route fails to inspect or filter intra-VNet traffic to Private Endpoints.
4
Combine the findings to determine the correct and minimal security configuration.
Configure outbound NSG rules on Subnet-App to allow traffic to the specific private IPs of the Private Endpoints, and then deny outbound traffic to the Internet service tag to block all other outbound traffic.
This satisfies the requirement to allow only specific SQL Database and Key Vault traffic while blocking all other outbound internet traffic with minimal overhead.

Key Concept

Private Endpoint IP addressing bypasses public Service Tags and standard 0.0.0.0/0 UDRs for intra-VNet traffic, requiring NSG rules targeting specific private IPs to enforce network-level security boundaries.
Estimated Time:3m 0s
Rate this question

Topics

Network Security and Private Access

More questions from this topic