Examkin

Soru

Zorluk: KolayNetwork Security and Private Access

You are designing the network security for an Azure solution. A group of virtual machines in an Azure virtual network subnet must be permitted to make outbound connections to Azure Key Vault. You need to define a rule in a Network Security Group (NSG) to allow this traffic. The solution must minimize administrative overhead and avoid the need to manually maintain changing IP address ranges. What should you specify as the destination in the NSG outbound rule?

  1. The AzureKeyVault Service TagCevap
  2. B
    The individual public IP address ranges of the Azure Key Vault service in the local region
  3. C
    An Application Security Group (ASG) configured for Azure Key Vault
  4. D
    A custom route table with a User Defined Route (UDR) pointing to Azure Key Vault

Cevap

The AzureKeyVault Service Tag
The AzureKeyVault Service Tag is a system-defined identifier that represents the public IP address prefixes for the Azure Key Vault service. Using a Service Tag in the Network Security Group (NSG) outbound rule allows the virtual machines to connect to Key Vault securely while delegating the updates and maintenance of the IP address ranges entirely to Azure, fulfilling the requirement to minimize administrative overhead.

Adım Adım Çözüm

1
Identify the destination resource and communication requirements.
The destination is Azure Key Vault, an Azure PaaS service, and the traffic is outbound from Azure virtual machines.
This establishes the scope of the network rule needed within the Network Security Group (NSG).
2
Evaluate configuration methods against the constraint of minimizing administrative overhead and avoiding manual IP management.
Using individual IP ranges or routing changes introduces manual maintenance overhead and potential service disruption when IPs change. Service Tags are managed by Microsoft and dynamically update.
This determines that a Service Tag is the optimal mechanism to satisfy the security requirements with low administrative effort.
3
Select the correct Service Tag for the destination service.
The AzureKeyVault Service Tag represents the IP address prefixes for the Azure Key Vault service.
Specifying this Service Tag as the destination in the outbound NSG rule allows the required traffic securely and dynamically.

Anahtar Kavram

Azure Network Security Group Service Tags simplify NSG rule creation by representing groups of IP address prefixes from helper Azure services, managed automatically by Microsoft.
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru