Examkin

Soru

Zorluk: Çok zorNetwork Security and Private Access

An enterprise architecture team is implementing a hub-and-spoke virtual network topology in Azure for a secure payment application. The hub virtual network hosts an Azure Firewall with the private IP address 10.0.0.410.0.0.4. A spoke virtual network named `VNet1` contains two subnets:

* `Subnet1` (10.1.1.0/2410.1.1.0/24): Contains Azure Virtual Machines hosting the payment application.
* `Subnet2` (10.1.2.0/2410.1.2.0/24): Contains a Private Endpoint (IP address 10.1.2.410.1.2.4) for a secure Azure SQL Database.

You must ensure that all traffic from the Virtual Machines in `Subnet1` to the SQL Database Private Endpoint in `Subnet2` is inspected by the Azure Firewall. The design must also enforce network security group (NSG) rules on both subnets.

Which two actions should you perform? (Select two.)

  1. Enable private endpoint network policies for route tables and network security groups on Subnet2.Cevap
  2. Associate a route table to Subnet1 containing a route to the private endpoint IP address, and associate a route table to Subnet2 containing a route to Subnet1, with both route tables pointing to the Azure Firewall as the next hop.Cevap
  3. C
    Manually configure individual outbound security rules in the Network Security Group (NSG) associated with Subnet1 for each database server IP address to allow traffic.
  4. D
    Associate an Azure SQL service endpoint policy to Subnet1 to restrict outbound traffic to only the permitted SQL Database.
  5. E
    Configure a user-defined route (UDR) in Subnet1 that routes traffic destined for the SQL database to the Azure Firewall, but keep the private endpoint network policies disabled on Subnet2 to prevent routing loops.
  6. F
    Configure a route table associated with Subnet2 with a default route (0.0.0.0/00.0.0.0/0) pointing to the Azure Firewall, without enabling private endpoint network policies on Subnet2.

Cevap

Enable private endpoint network policies on the subnet hosting the private endpoint (Subnet2), and configure route tables on both Subnet1 (destination private endpoint IP via the firewall) and Subnet2 (destination Subnet1 IP via the firewall) to ensure symmetric traffic inspection.
To force traffic destined for the private endpoint through Azure Firewall, we must configure a user-defined route (UDR) on the source subnet (Subnet1) pointing to the firewall. However, because Azure Firewall is stateful, the return traffic from the private endpoint back to the VMs must also go through the firewall. This requires a corresponding UDR on the destination subnet (Subnet2) pointing to the firewall. For this UDR and any NSG rules to be active and applied to the private endpoint network interface, we must enable private endpoint network policies on the subnet hosting the private endpoint (Subnet2).

Adım Adım Çözüm

1
Enable network policies for private endpoints on Subnet2.
Allows User-Defined Routes (UDRs) and Network Security Groups (NSGs) to be evaluated and applied to traffic going to or coming from the private endpoint.
By default, system routes override custom routes for private endpoints, and network policies are disabled on subnets containing private endpoints, which bypasses custom routing and NSG rules.
2
Configure routing from the application VMs to the private endpoint.
Associate a route table with Subnet1 containing a route for the private endpoint IP address (10.1.2.4/3210.1.2.4/32) with the next hop set to the Azure Firewall (10.0.0.410.0.0.4).
This configuration overrides the default virtual network routing for traffic bound for the private endpoint, sending it to the firewall for security inspection.
3
Configure routing for return traffic from the private endpoint.
Associate a route table with Subnet2 containing a route for Subnet1 (10.1.1.0/2410.1.1.0/24) with the next hop set to the Azure Firewall (10.0.0.410.0.0.4).
Since the firewall is a stateful device, the return traffic must pass back through the same firewall instance. Without this route, return traffic would take the default direct local virtual network route back to Subnet1, resulting in asymmetric routing and connection drop.

Anahtar Kavram

Enforcing security inspection and NSG rules on Private Endpoints in Azure requires enabling private endpoint network policies on the hosting subnet, and configuring symmetric user-defined routes on both the source and destination subnets.

Alternatif Yöntem

Instead of using Azure Firewall for inspection, you could use a third-party Network Virtual Appliance (NVA) deployed in the hub virtual network, which would require the same UDR and private endpoint network policy configurations on the subnets.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru