Examkin

Soru

Zorluk: OrtaNetwork Security and Private Access

A retail corporation is setting up an application environment in Azure. The architecture consists of Azure Virtual Machines deployed in a subnet named AppSubnet inside a virtual network named ProductionVNet. The virtual machines must securely access a single Azure SQL Database instance without exposing the traffic to the public internet. You have provisioned a private endpoint for the database in AppSubnet. You now need to restrict traffic from AppSubnet so that the virtual machines can connect only to the private endpoint of that specific SQL database, and prevent outbound access to any other Azure SQL Databases or public endpoints. Which configuration should you apply to the Network Security Group (NSG) linked to AppSubnet?

  1. Set the private endpoint network policies to Enabled on AppSubnet. Add an outbound rule to the NSG that allows traffic to the private IP address of the private endpoint, followed by a rule with a lower priority that blocks traffic to the Sql service tag.Cevap
  2. B
    Add an outbound rule to the NSG that allows traffic to the Sql service tag, which will automatically route all SQL database requests to the private endpoint.
  3. C
    Create a User Defined Route (UDR) on AppSubnet that redirects all traffic destined for the Sql service tag to the private endpoint's IP address as the next hop.
  4. D
    Add an outbound rule to the NSG that allows traffic to a custom service tag defined specifically for the private endpoint, and create another rule to block the Internet service tag.

Cevap

Set the private endpoint network policies to Enabled on AppSubnet, allow traffic to the private IP address of the private endpoint in the NSG, and block traffic to the Sql service tag with a lower priority rule.
To apply Network Security Group rules to private endpoints, you must first enable private endpoint network policies on the subnet. Once enabled, you can control traffic to the private endpoint using its private IP address. To prevent access to other Azure SQL Databases over their public endpoints, you block the Sql service tag. Because NSG rules are processed in priority order, the specific allow rule for the private endpoint's IP address will be processed first, and any other traffic to Azure SQL public endpoints will be blocked by the Sql service tag rule.

Adım Adım Çözüm

1
Enable private endpoint network policies on the subnet.
This allows the subnet's Network Security Group (NSG) rules to be applied to traffic destined for private endpoints.
By default, NSG rules are not enforced on private endpoints.
2
Create an outbound NSG rule to allow traffic to the private IP address of the private endpoint.
Traffic from the Virtual Machines to the database private endpoint is permitted.
Private endpoint traffic uses the private IP address allocated within the subnet.
3
Create a lower-priority outbound NSG rule to deny traffic to the Sql service tag.
All other traffic targeting Azure SQL Database public endpoints is blocked.
This satisfies the security requirement to prevent outbound access to other Azure SQL Databases or public endpoints.

Anahtar Kavram

Applying Network Security Group (NSG) rules to Private Endpoints using network policies
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru