Examkin

Soru

Zorluk: Çok zorConfigure Azure App Services

You have two Azure App Service web apps named webapp1 and api1. Both web apps run on the Standard S1 App Service plan. You configure regional virtual network integration for webapp1 to Subnet1 in a virtual network named VNet1. You need to ensure that api1 only accepts incoming traffic from webapp1. The solution must ensure that all communication from webapp1 to api1 traverses VNet1. You must minimize administrative effort and avoid using private endpoints. Which set of actions should you perform?

  1. Enable the Microsoft.Web service endpoint on Subnet1, enable the Route All setting on the virtual network integration of webapp1, and add an access restriction rule on api1 that allows traffic from Subnet1.Cevap
  2. B
    Enable the Microsoft.Web service endpoint on Subnet1, and add an access restriction rule on api1 that allows traffic from Subnet1.
  3. C
    Scale down the App Service plan of api1 to the Free (F1) tier, enable the Microsoft.Web service endpoint on Subnet1, and add an access restriction rule on api1 that allows traffic from Subnet1.
  4. D
    Configure an outbound Network Security Group (NSG) rule on Subnet1 that allows traffic to api1, and configure an inbound NSG rule on Subnet1 to block all other traffic.

Cevap

Enable the Microsoft.Web service endpoint on Subnet1, enable the Route All setting on the virtual network integration of webapp1, and add an access restriction rule on api1 that allows traffic from Subnet1.
The correct action is to enable the Microsoft.Web service endpoint on Subnet1, enable the Route All setting on webapp1's virtual network integration, and add an access restriction rule on api1 allowing Subnet1. By default, regional virtual network integration only routes traffic destined for private IP addresses (RFC1918). Because api1 has a public IP address, traffic from webapp1 to api1 will bypass VNet1 unless the Route All setting is enabled. Enabling Route All forces all outbound traffic from webapp1 through VNet1, applying the Microsoft.Web service endpoint identity from Subnet1, which is then permitted by api1's access restrictions.

Adım Adım Çözüm

1
Enable the Microsoft.Web service endpoint on Subnet1.
Allows Subnet1 to securely identify its traffic when connecting to Azure App Services (Microsoft.Web).
This is a prerequisite for adding virtual network-based access restrictions on Azure App Services.
2
Enable the Route All setting on webapp1's virtual network integration.
Forces all outbound traffic from webapp1, including public IP traffic destined for api1, to be routed through VNet1.
By default, regional virtual network integration only routes RFC1918 private IP traffic. Since api1 has a public IP address, Route All is required to force webapp1's traffic to api1 into VNet1 so it can use the service endpoint.
3
Configure an access restriction rule on api1 to allow traffic from Subnet1.
Secures api1 so that only traffic originating from Subnet1 (which now includes webapp1's routed traffic) is permitted, while other public traffic is blocked.
This achieves the security requirement of restricting inbound traffic to api1 to only come from webapp1 via VNet1.

Anahtar Kavram

Azure App Service Regional VNet Integration and Access Restrictions using Service Endpoints
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Configure Azure App Services

Bu konudan daha fazla soru