Examkin

Soru

Zorluk: Çok zorConfigure Azure Bastion

An administrator needs to deploy Azure Bastion (Standard SKU) to secure access to virtual machines in an existing virtual network named VNet1. The organization's security policy requires that a Network Security Group (NSG) be associated with the Bastion subnet, and that the subnet is secured from the very beginning of the Bastion host deployment.

Which sequence of steps must you perform to successfully configure and deploy Azure Bastion while adhering to the security policy and avoiding validation errors?

  1. 1Create a subnet named AzureBastionSubnet in VNet1 with an address space prefix of /26.
  2. 2Create a Network Security Group (NSG) and configure the mandatory inbound (HTTPS/443 from Internet, GatewayManager/443, AzureLoadBalancer/443) and outbound (VirtualNetwork/22/3389, AzureCloud/443, Internet/80/443) security rules.
  3. 3Associate the configured Network Security Group (NSG) with the AzureBastionSubnet.
  4. 4Create a Public IP address using the Standard SKU and Static allocation.
  5. 5Provision the Azure Bastion host resource, referencing the AzureBastionSubnet and the Standard Public IP address.

Cevap

Create the AzureBastionSubnet subnet first, then create and configure the Network Security Group with mandatory rules, associate the NSG with the AzureBastionSubnet, create a Standard SKU Public IP address, and finally provision the Azure Bastion host resource referencing the subnet and Public IP.
The correct sequence ensures that all prerequisites are created and configured in an order that satisfies Azure's validation checks. The subnet AzureBastionSubnet must be created with a prefix of /26 or larger. Next, the NSG must be created and populated with all required inbound (Internet, GatewayManager, AzureLoadBalancer) and outbound (VirtualNetwork, AzureCloud, Internet) rules. Once the NSG is fully configured, it is associated with the AzureBastionSubnet. If the NSG is associated before rules are configured, Azure resource validation will block the association. Next, a Standard SKU Public IP must be created because Azure Bastion does not support Basic SKU Public IPs. Finally, the Azure Bastion host resource is provisioned, referencing the configured subnet and Public IP.

Adım Adım Çözüm

1
Create the AzureBastionSubnet
A subnet named exactly 'AzureBastionSubnet' is created in VNet1 with a /26 prefix.
Azure Bastion requires a dedicated subnet with this exact name and a prefix of /26 or larger (/25, /24, etc.) to accommodate scaling and host instances.
2
Create the NSG and add mandatory rules
An NSG is created with rules allowing inbound traffic from the Internet (port 443), GatewayManager (port 443), and AzureLoadBalancer (port 443), and allowing outbound traffic to the VirtualNetwork (ports 22 and 3389), AzureCloud (port 443), and Internet (ports 80 and 443).
Azure validates the NSG rules upon association to the AzureBastionSubnet. If the rules are missing or incorrect, the association or deployment fails.
3
Associate the NSG with the AzureBastionSubnet
The NSG is associated with the AzureBastionSubnet.
This satisfies the security requirement that the subnet must be secured from the moment of deployment.
4
Create a Standard SKU Public IP address
A Standard SKU, Static Public IP is created.
Azure Bastion requires a Standard SKU Public IP address, and it must be created before deploying the Bastion resource.
5
Provision the Azure Bastion host
The Azure Bastion host is deployed.
The Bastion host creation requires selecting the AzureBastionSubnet (which now has the correct NSG associated) and the Standard Public IP.

Anahtar Kavram

Azure Bastion deployment requires strict prerequisite configuration including a dedicated subnet named AzureBastionSubnet of at least /26 size, a Standard SKU Public IP, and a fully configured NSG with specific inbound and outbound rules that must be defined before subnet association.
Bu soruyu puanla

Konular

Configure Azure Bastion

Bu konudan daha fazla soru