Examkin

Soru

Zorluk: KolayNetwork Security and Private Access

Your company has virtual machines deployed in an Azure Virtual Network subnet. The virtual machines must be allowed to retrieve secrets from Azure Key Vault and access files stored in Azure storage accounts. You need to configure a Network Security Group (NSG) to permit this outbound traffic. The design must minimize administrative overhead and avoid the configuration of individual IP addresses. Which two service tags should you include in the outbound security rules of the NSG?

  1. AzureKeyVaultCevap
  2. StorageCevap
  3. C
    AzureStorage
  4. D
    A list of individual public IP addresses for the Azure Key Vault and Azure Storage endpoints

Cevap

The correct service tags are AzureKeyVault and Storage.
The service tags AzureKeyVault and Storage are the official, built-in tags provided by Microsoft to represent all IP address prefixes for Azure Key Vault and Azure Storage, respectively. Implementing these tags in the NSG rules allows outbound access to these services without requiring manual configuration or maintenance of individual IP ranges.

Adım Adım Çözüm

1
Identify the target Azure services requiring outbound network access from the subnet.
The services are Azure Key Vault and Azure Storage.
Outbound security rules must allow access to these specific services.
2
Evaluate the requirement to minimize administrative overhead and avoid individual IP addresses.
Determine that built-in Azure service tags must be used instead of manually maintaining IP lists.
Service tags automatically manage the IP address prefixes for Azure services, reducing administrative work.
3
Identify the exact names of the service tags for Azure Key Vault and Azure Storage.
The service tag for Azure Key Vault is AzureKeyVault, and the service tag for Azure Storage is Storage.
Using the exact service tag names ensures the NSG rules are valid and function correctly.

Anahtar Kavram

Azure Virtual Network service tags simplify network security group (NSG) configuration by representing a group of IP address prefixes from a specific Azure service.
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru