Examkin

Soru

Zorluk: OrtaNetwork Security and Private Access

Apex Manufacturing is designing the network security for a three-tier application deployed in Azure. The application's virtual machines are located in a subnet named AppSubnet within a virtual network named VNet1. The virtual machines must access an Azure Key Vault and an Azure SQL Database. You need to design the outbound security rules in the Network Security Group (NSG) associated with AppSubnet. The solution must meet the following requirements:
- Allow outbound traffic to Azure Key Vault and Azure SQL Database.
- Block all other outbound traffic to the public internet.
- Minimize administrative effort by avoiding the maintenance of explicit IP address ranges in the security rules.

Which two security rules should you configure in the NSG to allow the required outbound traffic?

  1. An outbound security rule that allows traffic with the destination set to the AzureKeyVault service tag.Cevap
  2. An outbound security rule that allows traffic with the destination set to the Sql service tag.Cevap
  3. C
    An outbound security rule that allows traffic with the destination set to the specific public IP addresses of the Azure Key Vault and Azure SQL Database instances.
  4. D
    An outbound security rule that allows traffic with the destination set to the AzureCloud service tag.

Cevap

To allow the required outbound traffic while minimizing administrative effort, you must configure two outbound rules in the NSG: one allowing traffic to the AzureKeyVault service tag and another allowing traffic to the Sql service tag.
The correct solution uses the AzureKeyVault and Sql service tags as destinations in the outbound NSG rules. Service tags represent a group of IP address prefixes managed by Microsoft, satisfying the requirement to minimize administrative effort and avoid manual IP tracking. They allow traffic only to those specific Azure services, satisfying the security requirements.

Adım Adım Çözüm

1
Identify the target Azure services requiring outbound connectivity.
The target services are Azure Key Vault and Azure SQL Database.
This determines which service tags or destination endpoints are needed.
2
Select the configuration method that minimizes administrative effort.
Service tags (AzureKeyVault and Sql) are selected instead of explicit public IP address ranges.
Service tags represent a group of IP address prefixes from a given Azure service and are managed automatically by Microsoft, reducing overhead.
3
Create the NSG rules for the AppSubnet.
Two allow rules are created: one with the AzureKeyVault service tag as the destination, and another with the Sql service tag as the destination.
This permits the required traffic while enabling a final deny rule for the Internet service tag to block all other public outbound traffic.

Anahtar Kavram

Using Network Security Group (NSG) Service Tags to secure outbound connectivity to Azure services.
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru