Examkin

Soru

Zorluk: KolayNetwork Security and Private Access

An organization hosts a multi-tier application on Azure Virtual Machines. The application VMs must upload diagnostic metrics to Azure Monitor. To comply with security policies, all outbound internet traffic from the virtual machine subnet must be blocked except for traffic destined for Azure Monitor. The design must minimize administrative overhead. Which network configuration should you recommend?

  1. An outbound Network Security Group (NSG) rule that specifies the AzureMonitor Service Tag as the destinationCevap
  2. B
    An outbound Network Security Group (NSG) rule that specifies the individual IP address ranges of the Azure Monitor endpoints as the destination
  3. C
    A User Defined Route (UDR) that redirects all outbound traffic to a default route of 0.0.0.0/0, overriding local virtual network routes
  4. D
    An outbound Network Security Group (NSG) rule that specifies the Internet Service Tag as the destination, combined with a custom script to regularly block non-Monitor IP ranges

Cevap

An outbound Network Security Group (NSG) rule that specifies the AzureMonitor Service Tag as the destination
Using the AzureMonitor Service Tag in an outbound Network Security Group (NSG) rule is the correct approach because it specifically permits traffic to Azure Monitor endpoints while blocking other outbound internet traffic. Azure automatically updates the IP addresses associated with the Service Tag, which satisfies the requirement to minimize administrative overhead.

Adım Adım Çözüm

1
Identify the destination service that the application needs to communicate with.
The target service is Azure Monitor.
The VMs must upload diagnostic metrics specifically to Azure Monitor.
2
Evaluate the requirement of minimizing administrative overhead and avoiding tracking of IP changes.
IP tracking should be managed by Azure rather than configured manually.
Azure Service Tags automatically represent IP address prefixes for specific Azure services.
3
Select the appropriate Network Security Group (NSG) rule destination.
The destination should be configured with the AzureMonitor Service Tag.
Using the service tag limits outbound access to only Azure Monitor without needing manual IP lists or routes.

Anahtar Kavram

Azure Service Tags simplify NSG rule management by representing a group of IP address prefixes from a specific Azure service.
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru