Examkin

Soru

Zorluk: OrtaNetwork Security and Private Access

An enterprise is designing a multi-tier application in an Azure virtual network named VNet1. The application consists of web servers, application servers, and database servers.

You need to design a network security strategy using Network Security Groups (NSGs) to isolate the traffic between these tiers. The strategy must meet the following requirements:
- Allow web servers to communicate only with the application servers.
- Allow application servers to communicate only with the database servers.
- Minimize administrative effort as virtual machines (VMs) are added or removed from each tier.
- Avoid the use of individual IP addresses in the security rules.

Which two actions should you include in the design?

  1. Create Application Security Groups (ASGs) and associate the network interfaces of the virtual machines with their respective ASG.Cevap
  2. Configure NSG rules that reference the Application Security Groups as the source and destination.Cevap
  3. C
    Configure NSG rules that reference the individual IP addresses of the virtual machines in each tier.
  4. D
    Create a unique Network Security Group for each virtual machine and define specific subnet-level route filters.

Cevap

Create Application Security Groups (ASGs), associate the network interfaces of the virtual machines with their respective ASG, and configure NSG rules that reference the ASGs as the source and destination.
Defining Application Security Groups (ASGs) and referencing them in Network Security Group (NSG) rules allows you to secure traffic between application tiers logically. As virtual machines are added or removed, associating their network interfaces with the correct ASG automatically applies the defined rules, satisfying all technical constraints and minimizing administrative overhead.

Adım Adım Çözüm

1
Define logical groupings for the multi-tier application.
Three Application Security Groups (ASGs) are planned: one for web servers, one for application servers, and one for database servers.
This establishes a logical boundary for each tier without relying on static IP addresses.
2
Associate VM network interfaces (NICs) with the appropriate ASGs.
NICs of the web, application, and database VMs are associated with their corresponding ASG.
This ensures that any security rule applied to the ASG automatically applies to the member network interfaces.
3
Create NSG rules referencing the ASGs as sources and destinations.
Outbound and inbound rules are configured to permit traffic only between the designated ASGs (Web to App, App to Database), while denying other inter-tier traffic.
This dynamically secures the traffic flow while minimizing administrative effort as VMs are added or removed.

Anahtar Kavram

Application Security Groups (ASGs) allow you to configure network security as a natural extension of an application's structure, grouping virtual machines and defining security policies based on those groups rather than individual IP addresses.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru