Examkin

Question

Difficulty: MediumNetwork Security and Private Access

Solaris Energy operates a distributed workload on Azure Virtual Machines within a subnet named BackendSubnet. The application running on these virtual machines must securely connect to Azure Key Vault to retrieve database credentials and certificate keys. The network team must implement a security design that restricts outbound traffic from the virtual machines to ONLY Azure Key Vault, blocking all other internet-bound traffic. Which network security configuration should you recommend to meet these requirements with the least administrative effort?

  1. Configure an outbound security rule in a Network Security Group (NSG) associated with the subnet, setting the destination to the AzureKeyVault service tag with an Allow action, followed by a lower-priority rule blocking outbound traffic to the Internet.Answer
  2. B
    Configure an outbound security rule in a Network Security Group (NSG) associated with the subnet, setting the destination to a custom list of individual IP address ranges corresponding to the regional Azure Key Vault endpoints.
  3. C
    Create a custom route table with a user-defined route (UDR) that overrides all default system routes to direct traffic destined for Azure services through a public load balancer.
  4. D
    Deploy an Azure Basic Load Balancer within the subnet and configure inbound NAT rules to forward outbound requests specifically to Azure Key Vault endpoints.

Answer

Configure an outbound security rule in a Network Security Group (NSG) associated with the subnet, setting the destination to the AzureKeyVault service tag with an Allow action, followed by a lower-priority rule blocking outbound traffic to the Internet.
Using the AzureKeyVault service tag as the destination in an NSG outbound rule allows the network security group to dynamically manage the underlying IP addresses for the service. This, combined with a rule to deny outbound traffic to the Internet, satisfies the security constraint with minimal administrative overhead.

Step-by-Step Solution

1
Identify the destination service that needs to be reached securely (Azure Key Vault).
Confirming the destination allows selection of the appropriate Service Tag.
Using Service Tags is the standard recommended method to specify destination categories instead of individual IP addresses.
2
Add an outbound NSG security rule allowing traffic to the service tag.
Created a rule with destination set to AzureKeyVault and action set to Allow.
This permits legitimate outbound traffic to all Azure Key Vault endpoints in the region.
3
Add a lower-priority rule blocking outbound traffic to the Internet destination.
Created a deny rule with destination set to Internet.
This blocks all other outbound internet traffic while allowing the higher-priority Key Vault rule to function.

Key Concept

Using Network Security Group Service Tags to simplify and maintain outbound access control to Azure services without managing individual IP addresses.
Rate this question

Topics

Network Security and Private Access

More questions from this topic