Examkin

Soru

Zorluk: ZorNetwork Security and Private Access

An organization is designing a secure network architecture in Azure. The design includes:
- A subnet named Subnet-App hosting virtual machines that run an application.
- An Azure Key Vault that stores cryptographic keys.
- A Private Endpoint for the Key Vault deployed in a subnet named Subnet-Private with a private IP address of 10.10.2.4.

A Network Security Group (NSG) associated with Subnet-App must allow the virtual machines to access the Key Vault via the Private Endpoint. To meet security compliance, you must block all other outbound traffic from Subnet-App to both the internet and other resources within the virtual network.

Which configuration should you specify for the destination in the NSG outbound security rule on Subnet-App to meet the requirements with the least administrative effort?

  1. A
    The AzureKeyVault service tag
  2. The private IP address of the Private Endpoint (10.10.2.4)Cevap
  3. C
    The public IP address of the Azure Key Vault
  4. D
    The VirtualNetwork service tag

Cevap

The private IP address of the Private Endpoint (10.10.2.4)
When accessing Azure services via Private Endpoints, all network traffic is directed to the private IP address of the endpoint. Therefore, any outbound Network Security Group (NSG) rule intended to permit this traffic must specify the Private Endpoint's private IP address as the destination. This allows the application subnet to communicate with the specific Private Endpoint while enabling other rules to block all other outbound traffic to the virtual network and the internet.

Adım Adım Çözüm

1
Analyze how client virtual machines communicate with an Azure service when a Private Endpoint is implemented.
Clients communicate with the service using the private IP address assigned to the Private Endpoint (10.10.2.4) within the virtual network.
Private Endpoints project the Azure service into the virtual network as a local resource with a private IP address.
2
Evaluate the behavior of Azure Service Tags in Network Security Groups (NSGs) for outbound rules.
Service tags such as AzureKeyVault represent the public IP ranges of Azure services and do not encompass private IP addresses.
This determines that service tags cannot be used to permit traffic destined for private endpoints.
3
Determine the rule destination that satisfies the security constraint of blocking all other outbound virtual network and internet traffic.
The destination must be restricted to the specific private IP address of the Private Endpoint (10.10.2.4). Using broader tags like VirtualNetwork would allow access to unintended internal resources.
This ensures the rule adheres to the principle of least privilege and satisfies all technical constraints.

Anahtar Kavram

Configuring NSGs for Private Endpoint Access
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru