Examkin

Question

Difficulty: MediumNetwork Security and Private Access

AeroSpace Dynamics is designing the network security for a subnet named ProcessingSubnet that hosts Azure Virtual Machines. The virtual machines require outbound access to Azure Storage and Azure Key Vault to process data. All other outbound internet access from the subnet must be blocked. The design must minimize administrative maintenance.

Which two outbound configurations should you recommend for the Network Security Group (NSG) associated with ProcessingSubnet?

  1. An outbound security rule that allows traffic to the Storage service tagAnswer
  2. An outbound security rule that allows traffic to the AzureKeyVault service tagAnswer
  3. C
    Individual outbound security rules that allow traffic to the specific public IP address ranges of the Azure Storage and Azure Key Vault endpoints
  4. D
    A custom route table with user-defined routes (UDRs) that direct Storage and Key Vault traffic to the Internet gateway, overriding the default Azure system routes

Answer

Configure outbound NSG security rules that allow traffic to the Storage and AzureKeyVault service tags.
Using service tags like Storage and AzureKeyVault in outbound NSG rules allows the virtual machines to reach the respective Azure services. Azure manages the IP address prefixes under these service tags automatically, minimizing administrative maintenance while enforcing the required outbound security boundary.

Step-by-Step Solution

1
Identify the destination services.
Azure Storage and Azure Key Vault are identified as the target destinations.
Outbound connectivity needs to be restricted to only these two services.
2
Evaluate the mechanism to allow access while minimizing administrative effort.
Service tags represent a group of IP address prefixes from a given Azure service, managed automatically by Azure.
Using service tags avoids the need to manually update and maintain individual IP address rules as Azure changes public IP ranges.
3
Determine the required NSG rules.
Add outbound security rules with destination set to the Storage service tag and the AzureKeyVault service tag, followed by a rule to block all other outbound internet traffic.
This configuration satisfies the security and administrative requirements.

Key Concept

Azure Network Security Group (NSG) Service Tags simplify outbound security rule management by grouping IP address prefixes for Azure services.
Rate this question

Topics

Network Security and Private Access

More questions from this topic