Examkin

Question

Difficulty: Very hardNetwork Security and Private Access

An organization is designing a secure hybrid network environment in Azure. A subnet named Subnet-App in VNet1 hosts virtual machines that must connect to the following resources:
- An Azure Key Vault named vault1 via a Private Endpoint deployed in Subnet-PE (IP range 10.0.2.0/24) in VNet1.
- An Azure Storage account named storage1 via a Private Endpoint deployed in Subnet-PE.
- Microsoft Entra ID for authentication.
- A public partner API (api.partner.com).

The design must satisfy the following requirements:
- Minimize administrative effort when Azure public IP addresses change.
- Route all public internet traffic (including api.partner.com) through an Azure Firewall in a peered hub virtual network.
- Restrict outbound traffic from Subnet-App using a Network Security Group (NSG) to block all outbound traffic by default, except for the minimum necessary traffic required to meet the connectivity requirements.

Which configuration should you recommend for the route table and NSG outbound rules on Subnet-App?

  1. Associate a route table with a route of 0.0.0.0/0 pointing to the Azure Firewall private IP. Configure NSG rules that allow outbound traffic to 10.0.2.0/24 on port 443, allow outbound traffic to the AzureActiveDirectory service tag on port 443, allow outbound traffic to the Internet service tag on port 443, and deny all other outbound traffic.Answer
  2. B
    Associate a route table with a route of 0.0.0.0/0 pointing to the Azure Firewall private IP. Configure NSG rules that allow outbound traffic to the AzureKeyVault and Storage service tags on port 443, allow outbound traffic to the AzureActiveDirectory service tag on port 443, allow outbound traffic to the Internet service tag on port 443, and deny all other outbound traffic.
  3. C
    Associate a route table with a route of 0.0.0.0/0 pointing to the Azure Firewall private IP. Configure NSG rules that allow outbound traffic to 10.0.2.0/24 on port 443, allow outbound traffic to the specific public IP ranges of Microsoft Entra ID on port 443, allow outbound traffic to the Internet service tag on port 443, and deny all other outbound traffic.
  4. D
    Associate a route table with a route of 0.0.0.0/0 pointing to the Azure Firewall private IP. Configure NSG rules that allow outbound traffic to 10.0.2.0/24 on port 443, allow outbound traffic to the AzureActiveDirectory service tag on port 443, and configure a deny rule for the Internet service tag on all ports, with no rule allowing Internet outbound.

Answer

Associate a route table with a route of 0.0.0.0/0 pointing to the Azure Firewall private IP. Configure NSG rules that allow outbound traffic to 10.0.2.0/24 on port 443, allow outbound traffic to the AzureActiveDirectory service tag on port 443, allow outbound traffic to the Internet service tag on port 443, and deny all other outbound traffic.
The correct configuration routes all outbound internet-bound traffic (0.0.0.0/0) to the Azure Firewall. To allow the traffic to leave the subnet and reach the firewall, the NSG must allow outbound traffic to the Internet service tag, as the packet's destination IP is the public IP of the partner API. The NSG must also explicitly allow traffic to the private IP range of the Private Endpoint subnet (10.0.2.0/24) to permit secure access to Key Vault and Storage, while using the AzureActiveDirectory service tag to allow token acquisition with minimal administrative effort.

Step-by-Step Solution

1
Determine how to route public internet traffic through the Azure Firewall.
Create a route table associated with Subnet-App with a user-defined route (UDR) of 0.0.0.0/0 pointing to the private IP of the Azure Firewall as the next hop.
This forces all traffic destined for the public internet to go through the firewall for inspection and filtering.
2
Determine the destination addresses for Private Endpoint traffic in the NSG rules.
Use the private subnet range (10.0.2.0/24) where the Private Endpoints are deployed as the destination in the NSG rule.
Private Endpoints use private IP addresses from the virtual network. Service tags like AzureKeyVault and Storage represent public IP ranges and do not match private VNet IPs.
3
Determine how to permit traffic to Microsoft Entra ID while minimizing administrative effort.
Use the built-in AzureActiveDirectory service tag in the NSG rule.
Service tags automatically manage and update the IP ranges associated with Azure services, removing the need for manual IP maintenance.
4
Determine the NSG rule required for the public partner API traffic when routed through Azure Firewall.
Configure an NSG rule allowing outbound traffic to the Internet service tag (or the specific API endpoint IP if static).
Because NSGs evaluate the packet's final destination IP (the public IP of api.partner.com) rather than the next hop IP (the private IP of the firewall), an outbound deny rule for the Internet service tag would drop the packets before they reach the Azure Firewall.

Key Concept

NSG rules evaluate final destination IPs, not next hop IPs, meaning internet-bound traffic routed through a firewall must still be allowed to the 'Internet' destination in the NSG. Additionally, Private Endpoints use private IPs, so public service tags do not apply to them.
Estimated Time:3m 0s
Rate this question

Topics

Network Security and Private Access

More questions from this topic