Examkin

Question

Difficulty: HardNetwork Security and Private Access

An organization named Novis Analytics is designing a secure three-tier application architecture in Azure. The application will be deployed within a single virtual network subnet named WorkloadSubnet and consists of three groups of Azure Virtual Machines (VMs) running the following workloads:

* Web front-ends
* Application back-ends
* Database administrators

The design must satisfy the following security and operational requirements:

* Web front-ends must only be allowed to communicate outbound to the application back-ends.
* Application back-ends must be allowed to make outbound HTTPS requests to an Azure Key Vault and an Azure SQL Database.
* Database administrators must be allowed to access the Azure SQL Database, but must be blocked from accessing the Azure Key Vault.
* All other outbound internet traffic from the subnet must be blocked.
* Administrative effort must be minimized, and security policies must automatically apply to new VM instances added to any tier without updating network security rule definitions.

Which network security design should you recommend?

  1. Create three Application Security Groups (ASGs) to represent the VM workloads, associate each VM's network interface with its corresponding ASG, and associate a single Network Security Group (NSG) with WorkloadSubnet. In the NSG, define rules using the ASGs as sources or destinations, and use the AzureKeyVault and Sql Service Tags as destinations for outbound rules.Answer
  2. B
    Create three Application Security Groups (ASGs) to represent the VM workloads, associate each VM's network interface with its corresponding ASG, and associate a single Network Security Group (NSG) with WorkloadSubnet. In the NSG, define rules using the ASGs as sources or destinations, and manually define destination IP address ranges extracted from the Azure public IP range list for Azure Key Vault and Azure SQL Database.
  3. C
    Create two custom Service Tags to represent the web and application VM workloads, use them as sources in a single Network Security Group (NSG) associated with WorkloadSubnet, and configure the outbound rules to target the default AzureKeyVault and Sql Service Tags.
  4. D
    Configure a separate Network Security Group (NSG) for each VM network interface. In each NSG, define outbound rules using the individual private IP addresses of the VMs as sources, and use the AzureKeyVault and Sql Service Tags as destinations.

Answer

Create three Application Security Groups (ASGs) to represent the VM workloads, associate each VM's network interface with its corresponding ASG, and associate a single Network Security Group (NSG) with WorkloadSubnet. In the NSG, define rules using the ASGs as sources or destinations, and use the AzureKeyVault and Sql Service Tags as destinations for outbound rules.
Using Application Security Groups (ASGs) allows the organization to group virtual machines based on their workload roles (Web, Application, Database Administrators) and apply security rules to those groups, ensuring that any new VM associated with an ASG automatically inherits the correct security rules. Associating a single Network Security Group (NSG) at the subnet level minimizes administrative effort compared to managing NSGs per network interface. Using built-in Service Tags (AzureKeyVault and Sql) as destinations simplifies rule management by using Azure-managed IP address ranges instead of manually maintaining public IP lists, which change over time.

Step-by-Step Solution

1
Group virtual machines by workload using Application Security Groups (ASGs).
Three ASGs are created, allowing VM network interfaces to be dynamically associated with their respective workloads.
This allows security policies to automatically apply to new VM instances as they are provisioned without modifying the security rule definitions.
2
Associate a single Network Security Group (NSG) at the subnet level (WorkloadSubnet).
Outbound and inbound network traffic for all VMs in the subnet is controlled centrally.
Associating the NSG with the subnet minimizes administrative overhead compared to managing individual NSGs on every VM network interface.
3
Configure NSG rules using the ASGs as sources and destinations, and the built-in Service Tags as destinations.
Rules are created allowing application back-ends to access AzureKeyVault and Sql tags, and database administrators to access the Sql tag, while blocking other traffic.
Using system-defined Service Tags avoids the need to manually maintain public IP addresses of Azure services, reducing administrative overhead.

Key Concept

Azure Application Security Groups (ASGs) allow you to configure network security as an extension of an application's structure, grouping VMs and defining network security policies based on those groups. Network Security Groups (NSGs) combined with Service Tags allow you to secure traffic to Azure PaaS services without manually maintaining IP address ranges.
Rate this question

Topics

Network Security and Private Access

More questions from this topic