Examkin

Question

Difficulty: MediumNetwork Security and Private Access

An organization is designing a secure architecture for a cloud application. The application database layer runs on an Azure SQL Database. The application logic runs on Azure Virtual Machines (VMs) deployed in a subnet named AppSubnet within an Azure Virtual Network.

The network security requirements are:
1. Prevent all public internet access to the Azure SQL Database.
2. Allow VMs in AppSubnet to connect securely to the Azure SQL Database.
3. Restrict outbound database traffic from AppSubnet to only the required SQL database.
4. Minimize administrative effort for managing changes to IP addresses.

Which two configurations should you recommend in the design?

  1. Disable public network access on the Azure SQL logical server.Answer
  2. Create a private endpoint for the Azure SQL Database in the virtual network.Answer
  3. C
    Create outbound Network Security Group (NSG) rules on AppSubnet using the specific public IP addresses of the Azure SQL Database instances in the region.
  4. D
    Configure the AppSubnet Network Security Group (NSG) to allow outbound traffic to the AzureSQL service tag and configure the Azure SQL logical server firewall to allow the public IP of the NAT Gateway associated with AppSubnet.

Answer

The correct configurations are to disable public network access on the Azure SQL logical server and to create a private endpoint for the Azure SQL Database in the virtual network.
Disabling public network access on the Azure SQL logical server satisfies the absolute restriction of public internet exposure. Creating a private endpoint projects the database onto a private IP address inside the virtual network. This allows the VMs in the subnet to access the database securely and lets administrators write precise NSG outbound rules targeting only that private IP.

Step-by-Step Solution

1
Address the requirement to prevent all public internet access to the database.
Identify that public network access must be explicitly disabled on the Azure SQL logical server settings.
This blocks all external traffic attempting to connect through the public endpoint of the database.
2
Address the requirement to allow secure access from VMs within the virtual network.
Deploy a Private Endpoint for the Azure SQL Database in the virtual network.
Private Link maps a private IP address from the virtual network to the database, allowing internal VMs to route traffic securely over the Microsoft backbone instead of the public internet.
3
Evaluate NSG and service tag options against administrative and restriction constraints.
Reject individual IP rules due to administrative overhead and reject the service tag due to over-permissiveness.
Using specific public IP rules requires frequent manual updates. The AzureSQL service tag allows traffic to all regional databases, violating the rule of least privilege.

Key Concept

Azure Private Link and Private Endpoints enable secure private access to PaaS services from within a virtual network, allowing public endpoints to be disabled and providing deterministic private IPs for granular security rules.
Rate this question

Topics

Network Security and Private Access

More questions from this topic