Examkin

Soru

Zorluk: ZorNetwork Security and Private Access

Ember Healthcare is designing the network security architecture for a new application in Azure. The application architecture includes an Azure SQL Database logical server and an Azure Storage account. The local corporate network is connected to Azure using an ExpressRoute circuit with private peering.

You must design a network solution that meets the following requirements:
- The Azure SQL Database and Azure Storage account must not accept any connections from the public internet.
- On-premises users must be able to securely connect to the SQL Database and Storage account using their respective Fully Qualified Domain Names (FQDNs) over the private connection.
- The solution must minimize the administrative overhead of deploying and maintaining virtual machine-based DNS forwarders.
- Inbound and outbound access to the Azure subnets must be secured using Network Security Groups (NSGs) while minimizing the need to manually update rule IP addresses when Microsoft updates their service ranges.

Which two actions should you include in the recommended design?

  1. Deploy Azure Private Endpoints for the Azure SQL Database and the Azure Storage account, and deploy an Azure Private DNS Resolver with an inbound endpoint to resolve the private DNS zones from the on-premises network.Cevap
  2. Configure Network Security Groups (NSGs) on the subnets that utilize built-in Azure Service Tags instead of individual IP address ranges to control network traffic to Azure services.Cevap
  3. C
    Configure inbound Network Security Group (NSG) rules on the database subnet that list individual IP address ranges for the Microsoft SQL service endpoints.
  4. D
    Configure a User Defined Route (UDR) on the GatewaySubnet that overrides BGP routes by mapping individual service IP ranges to the Virtual Network Gateway, and disable BGP route propagation on the database subnet.

Cevap

The recommended design must include deploying Azure Private Endpoints combined with an Azure Private DNS Resolver inbound endpoint, and configuring Network Security Groups utilizing built-in Azure Service Tags.
Deploying Private Endpoints ensures that PaaS resources are assigned private IP addresses within the virtual network. The Azure Private DNS Resolver provides a managed inbound endpoint that on-premises DNS servers can target via conditional forwarders, resolving the private DNS zones without the need to manage custom DNS forwarder virtual machines. In addition, using Azure Service Tags in NSGs allows the platform to automatically manage the underlying IP addresses for specific Azure services, eliminating the administrative burden of manually updating rules when Microsoft modifies service IP ranges.

Adım Adım Çözüm

1
Address private access and DNS requirements.
Recommend Azure Private Endpoints for the SQL Database and Storage account, and deploy an Azure Private DNS Resolver with an inbound endpoint.
Private Endpoints satisfy the requirement to block public internet access. The Private DNS Resolver enables on-premises DNS resolution for these private endpoints without requiring VM-based forwarders.
2
Address the subnet access control and administrative overhead requirements.
Configure Network Security Groups on the subnets using built-in Azure Service Tags.
Service Tags automatically track Microsoft's service IP address ranges, securing access to Azure services while eliminating the need for manual rule updates.

Anahtar Kavram

Azure Private Access and Managed Name Resolution over Hybrid Connections
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru