Examkin

Soru

Zorluk: ZorConfigure Azure Firewall

Your company has an Azure environment with a hub-and-spoke virtual network topology. The hub virtual network (VNet-Hub) contains an Azure Firewall deployed in the AzureFirewallSubnet with a private IP address of 10.0.1.4. A spoke virtual network (VNet-Spoke1) is peered with VNet-Hub and contains a subnet named Subnet-Web (10.1.1.0/24) housing web servers.

You need to meet the following requirements:
1. Route all outbound internet traffic from Subnet-Web through the Azure Firewall.
2. Allow the web servers in Subnet-Web to access the FQDN *.github.com over HTTPS.

Which two configurations should you perform? (Select two.)

  1. In a route table associated with Subnet-Web, add a route for destination 0.0.0.0/0 with the next hop type set to Virtual appliance and the next hop address set to 10.0.1.4.Cevap
  2. In the Azure Firewall policy, create an application rule with the protocol set to HTTPS, the target FQDN set to *.github.com, and the source set to 10.1.1.0/24.Cevap
  3. C
    In a route table associated with Subnet-Web, add a route for destination 0.0.0.0/0 with the next hop type set to Virtual network gateway and the next hop address set to 10.0.1.4.
  4. D
    In a Network Security Group (NSG) associated with Subnet-Web, create an outbound security rule with a priority of 100 that denies all outbound traffic, and an outbound rule with a priority of 1000 that allows HTTPS traffic to *.github.com.

Cevap

In a route table associated with Subnet-Web, add a route for destination 0.0.0.0/0 with the next hop type set to Virtual appliance and the next hop address set to 10.0.1.4; and in the Azure Firewall policy, create an application rule with the protocol set to HTTPS, the target FQDN set to *.github.com, and the source set to 10.1.1.0/24.
To route outbound traffic from a spoke subnet through a hub Azure Firewall, you must configure a user-defined route (UDR) for 0.0.0.0/0 pointing to the firewall's private IP address. The next hop type must be set to Virtual appliance. To allow the web servers to access wildcard domain names such as *.github.com over HTTPS, you must configure an application rule in the firewall policy. This rule specifies the source IP range, the protocol and port (HTTPS:443), and the target FQDN.

Adım Adım Çözüm

1
Configure the routing for Subnet-Web by creating a route table.
A route table is created and associated with Subnet-Web.
This allows custom routing rules to override the default system routes for the web servers.
2
Add a user-defined route to the route table directing all internet-bound traffic to the firewall.
A route for 0.0.0.0/0 is created with a next hop type of Virtual appliance and next hop address of 10.0.1.4.
Azure Firewall acts as a virtual appliance. Directing 0.0.0.0/0 traffic to its private IP ensures all outbound internet traffic from the spoke is forwarded to the firewall for inspection.
3
Configure the Azure Firewall policy to permit HTTPS traffic to *.github.com.
An application rule is added with target FQDN *.github.com, protocol HTTPS, and source 10.1.1.0/24.
Azure Firewall blocks all traffic by default. An application rule is required to inspect and allow HTTPS traffic to specific wildcard domains.

Anahtar Kavram

Routing spoke traffic through a hub firewall and performing outbound FQDN filtering using application rules.
Bu soruyu puanla

Konular

Configure Azure Firewall

Bu konudan daha fazla soru