Examkin

Question

Difficulty: MediumNetwork Security and Private Access

A company named CloudFlux is designing a secure network environment for a hybrid application. You have an Azure virtual network named VNet1 containing a subnet named Subnet1. Subnet1 hosts several virtual machines that run a business-critical application. The application needs to retrieve connection strings and credentials from an Azure Key Vault named KV1.

You need to design a network security solution that meets the following requirements:
- Access to KV1 from the virtual machines must not traverse the public internet.
- The virtual machines must not have public IP addresses.
- Azure administrators must be able to securely manage the virtual machines using the Azure portal over SSL without exposing RDP or SSH ports directly to the public internet.

Which two components should you include in the design? (Select two.)

  1. A Private Endpoint for KV1 associated with Subnet1Answer
  2. An Azure Bastion host deployed to a dedicated subnet in VNet1Answer
  3. C
    A Network Security Group (NSG) rule for Subnet1 configured to allow outbound traffic to a custom list of manually resolved IP addresses for KV1
  4. D
    A route table containing a User-Defined Route (UDR) that overrides the default VNet system route to force all Key Vault traffic to the public internet

Answer

The correct components are a Private Endpoint for the Key Vault to establish private connectivity within the virtual network, and an Azure Bastion host to allow secure, agentless administrative management over SSL without public IP exposure.
Deploying a Private Endpoint assigns a private IP address from the virtual network subnet to the Key Vault, satisfying the requirement to keep traffic off the public internet. Azure Bastion provides secure RDP and SSH access over SSL directly from the Azure portal to the virtual machines without requiring public IP addresses on the target VMs.

Step-by-Step Solution

1
Analyze the requirement for secure, private access to Azure Key Vault (KV1) without traversing the public internet.
Determine that a Private Endpoint integrates the service into the virtual network with a private IP address, satisfying this constraint.
Private Endpoints ensure traffic to PaaS resources stays within the Microsoft backbone network.
2
Analyze the requirement to securely manage virtual machines without public IPs or public-facing management ports.
Identify that Azure Bastion provides secure SSL-based RDP/SSH access directly from the Azure portal over a private IP.
Azure Bastion eliminates the need to expose VMs to the public internet for administrative access.
3
Evaluate the distractors against the requirements and Azure best practices.
Determine that manual IP configurations in NSGs and overriding system routes via UDRs to force public routing are administrative anti-patterns and violate security constraints.
Azure service IPs change frequently, making manual NSG rules brittle, and UDR public routing violates the private access requirement.

Key Concept

Designing secure, private access to Azure PaaS resources using Private Endpoints and secure management access using Azure Bastion.
Estimated Time:2m 0s
Rate this question

Topics

Network Security and Private Access

More questions from this topic