Examkin

Soru

Zorluk: ZorNetwork Security and Private Access

A company named Vortex Retail is designing a secure network environment for a payment processing system. The system runs on Azure Virtual Machines deployed in a subnet named PaymentSubnet within a virtual network named VNet-Prod. The virtual machines must meet the following requirements:
- Access an Azure Storage Account named paystorage securely without routing traffic over the public internet.
- Connect to Azure Key Vault to retrieve cryptographic keys.
- Communicate with Microsoft Entra ID for identity verification and Azure Monitor for telemetry ingestion.
- Block all other outbound traffic to the public internet.
- Minimize administrative effort and avoid manually maintaining IP address lists.

You need to recommend the network security and private access architecture for the virtual machines.

Which configuration should you recommend?

  1. Deploy Private Endpoints for paystorage and the Azure Key Vault. In the Network Security Group (NSG) associated with PaymentSubnet, configure outbound rules to allow the AzureActiveDirectory and AzureMonitor service tags, followed by a rule to deny the Internet service tag.Cevap
  2. B
    Deploy Private Endpoints for paystorage and the Azure Key Vault. In the Network Security Group (NSG) associated with PaymentSubnet, configure outbound rules to allow the specific public IP address ranges currently used by Microsoft Entra ID and Azure Monitor, followed by a rule to deny the Internet service tag.
  3. C
    Deploy Private Endpoints for paystorage and the Azure Key Vault. Configure User-Defined Routes (UDRs) to route all outbound traffic from the subnet to the public IP addresses of Microsoft Entra ID and Azure Monitor, and associate a Network Security Group (NSG) that denies all outbound traffic to the Internet service tag.
  4. D
    Configure Service Endpoints for paystorage and the Azure Key Vault. In the Network Security Group (NSG) associated with PaymentSubnet, configure a rule to deny the Internet service tag, and rely on default rules to permit all Microsoft Entra ID and Azure Monitor traffic.

Cevap

Deploy Private Endpoints for paystorage and the Azure Key Vault. In the Network Security Group (NSG) associated with PaymentSubnet, configure outbound rules to allow the AzureActiveDirectory and AzureMonitor service tags, followed by a rule to deny the Internet service tag.
Deploying Private Endpoints assigns private IP addresses from the virtual network to the storage account and key vault. Traffic to these resources is routed internally and is permitted by default. Outbound access to public endpoints (Microsoft Entra ID and Azure Monitor) is allowed using the AzureActiveDirectory and AzureMonitor service tags, which dynamically update, eliminating the need to maintain IP ranges. The catch-all deny rule for the Internet service tag blocks all other public outbound traffic.

Adım Adım Çözüm

1
Select the appropriate private access method for Azure Storage and Azure Key Vault.
Private Endpoints are chosen because they map the resources to private IP addresses within the virtual network, ensuring traffic stays off the public internet.
This meets the requirement of securing storage and key vault access without public internet exposure.
2
Determine the rule strategy for outbound traffic to Microsoft Entra ID and Azure Monitor.
Configure outbound NSG rules allowing the AzureActiveDirectory and AzureMonitor service tags.
Service tags abstract the management of IP ranges, satisfying the requirement to minimize administrative effort.
3
Configure the rule to restrict all other outbound internet traffic.
Add an outbound NSG rule denying the Internet service tag at a lower priority than the allow rules.
This blocks all unauthorized outbound internet traffic while preserving access to the allowed service tags and private endpoints.

Anahtar Kavram

Azure Private Endpoints allow secure, private access to Azure resources using private IP addresses from the virtual network. Service Tags simplify outbound NSG configurations for public Azure services by abstracting IP address management.
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru