Examkin

Soru

Zorluk: OrtaNetwork Security and Private Access

A financial firm is designing a secure network environment for a pool of virtual machines in a virtual network subnet named Subnet1. The design must meet the following requirements:
- The virtual machines must retrieve cryptographic keys from an Azure Key Vault.
- The virtual machines must be isolated behind a load balancer that distributes incoming traffic.
- All outbound traffic to the internet must be blocked except for connections to Azure Key Vault.
- The configuration must minimize administrative maintenance.

Which security and load balancing configuration should you recommend?

  1. A
    Configure an outbound security rule in the Network Security Group (NSG) that allows traffic to a manually maintained list of public IP addresses for the Azure Key Vault service, and associate a Standard Load Balancer with Standard SKU public IP addresses.
  2. Configure an outbound security rule in the Network Security Group (NSG) that allows traffic to the AzureKeyVault Service Tag, and associate a Standard Load Balancer with Standard SKU public IP addresses.Cevap
  3. C
    Configure an outbound security rule in the Network Security Group (NSG) that allows traffic to the AzureKeyVault Service Tag, and implement a User Defined Route (UDR) for local VNet ranges that overrides default system routes to direct all internal traffic to the internet gateway.
  4. D
    Configure an outbound security rule in the Network Security Group (NSG) that allows traffic to the AzureKeyVault Service Tag, and associate a Standard Load Balancer with Basic SKU public IP addresses.

Cevap

Configure an outbound security rule in the Network Security Group (NSG) that allows traffic to the AzureKeyVault Service Tag, and associate a Standard Load Balancer with Standard SKU public IP addresses.
The correct choice is to configure an outbound security rule allowing traffic to the AzureKeyVault Service Tag combined with a Standard Load Balancer utilizing Standard SKU public IP addresses. This minimizes administrative overhead because Azure manages the IP address updates for the Service Tag, and matches the SKUs required for the load balancer.

Adım Adım Çözüm

1
Identify the service tag requirement.
Azure Key Vault public endpoints are represented by the AzureKeyVault service tag, which updates automatically and eliminates the need for manual IP list maintenance.
This satisfies the requirement to minimize administrative maintenance.
2
Select the correct Load Balancer SKU combination.
Standard Load Balancer requires Standard SKU public IP addresses; mixing them with Basic SKU public IP addresses is not supported.
This ensures compatibility and successful resource deployment.
3
Verify routing requirements.
Avoid configuring custom routes that override system-defined local routes to ensure internal virtual network communications remain operational.
This prevents network connectivity loss within the VNet.

Anahtar Kavram

Configuring secure service access using Service Tags in NSGs while maintaining Standard SKU compatibility across network resources.
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru