Examkin

Soru

Zorluk: OrtaNetwork Security and Private Access

Your company is designing a secure network architecture for an Azure-hosted application. The application runs on Azure Virtual Machines deployed in a virtual network named VNet1. The application requires outbound access to an Azure Storage account and an Azure Key Vault. You need to recommend a network security solution that meets the following requirements:
- Prevent all access to the storage account and key vault from the public internet.
- Ensure the virtual machines can resolve and connect to the services using their default fully qualified domain names (FQDNs).
- Minimize the administrative effort required to configure and maintain network access controls.

Which of the following designs should you recommend?

  1. A
    Restrict access at the subnet level by deploying a Network Security Group (NSG) with individual outbound rules containing the current public IP address ranges of the Azure Storage and Azure Key Vault regional endpoints.
  2. Configure Private Endpoints for the storage account and key vault in VNet1, disable public access on both services, and link Azure Private DNS zones for the services to VNet1.Cevap
  3. C
    Configure Virtual Network service endpoints for the storage account and key vault, and define a custom route table containing User-Defined Routes (UDRs) that direct all VNet1 subnet traffic to the default internet gateway to reach the endpoints.
  4. D
    Deploy a Standard Load Balancer in VNet1 to manage outbound connections to the storage account, and configure the backend pool using virtual machines that are associated with Basic SKU public IP addresses.

Cevap

Configure Private Endpoints for the storage account and key vault in VNet1, disable public access on both services, and link Azure Private DNS zones for the services to VNet1.
The correct design uses Private Endpoints to assign private IP addresses from VNet1 to the storage account and key vault. Disabling public access ensures that traffic to these resources is blocked from the public internet. Linking the corresponding Azure Private DNS zones to VNet1 ensures that name resolution for the default FQDNs resolves to the private IP addresses automatically, satisfying the requirements with minimal administrative overhead.

Adım Adım Çözüm

1
Select Private Access Method
Identify Private Endpoints as the solution to provide private IP addresses inside VNet1 for Azure Storage and Key Vault.
Private Endpoints satisfy the requirement to block all public internet access by routing traffic privately over the Microsoft backbone network.
2
Configure Name Resolution
Create and link Private DNS zones for the services to VNet1.
This enables virtual machines to resolve the default fully qualified domain names (FQDNs) to the private IP addresses of the Private Endpoints without requiring custom host files or manual DNS management.
3
Minimize Administrative Effort
Disable public endpoint access on the Azure Storage and Key Vault resources.
This centralizes security controls at the resource firewall layer rather than manually maintaining complex NSG rules or user-defined routes.

Anahtar Kavram

Private Link and Private DNS Integration
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru