Examkin

Soru

Zorluk: ZorNetwork Security and Private Access

An organization named Apex Bioscience is designing a secure networking architecture for a high-performance computing workload. The workload runs on Azure Virtual Machines deployed in a subnet named AnalysisSubnet within a virtual network named VNet1. The virtual machines must read and write data to multiple company-owned Azure Storage accounts located in the East US region. The security architecture must satisfy the following technical constraints:
- Outbound network traffic from AnalysisSubnet to the Azure Storage accounts must remain on the Microsoft backbone network and never traverse the public internet.
- Virtual machines must be prevented from exfiltrating data to any unauthorized or external Azure Storage accounts.
- The solution must minimize administrative overhead to implement and maintain as new company-owned storage accounts are provisioned in the East US region.

Which security component should you recommend to meet these requirements?

  1. A
    Network Security Group (NSG) rules applied to AnalysisSubnet that allow outbound traffic using the Storage East US service tag.
  2. B
    Network Security Group (NSG) rules applied to AnalysisSubnet that explicitly allow outbound traffic to the public IP address ranges of the company's storage accounts.
  3. Virtual Network service endpoint policies applied to AnalysisSubnet that permit access to the company's Azure subscriptions.Cevap
  4. D
    A User-Defined Route (UDR) table applied to AnalysisSubnet with specific route rules for each storage account's endpoint redirecting traffic to the default internet gateway.

Cevap

Virtual Network service endpoint policies applied to AnalysisSubnet that permit access to the company's Azure subscriptions.
Virtual Network service endpoint policies allow you to filter egress virtual network traffic to Azure Storage accounts. By configuring a policy that permits access only to the company's Azure subscriptions, you ensure that virtual machines in the subnet can only connect to authorized storage accounts, thereby preventing data exfiltration to external accounts. Traffic to these service endpoints remains on the Microsoft backbone network and does not traverse the public internet. Since the policy applies to the entire subscription level, any newly provisioned storage accounts within those subscriptions are automatically covered without requiring updates to the network configuration, which minimizes administrative overhead.

Adım Adım Çözüm

1
Analyze the requirements for network path isolation.
Traffic must remain on the Microsoft backbone network and must not traverse the public internet, which rules out routing traffic via the default internet gateway.
Ensures compliance with the data transit security policy.
2
Evaluate mechanisms to prevent data exfiltration to unauthorized Azure Storage accounts.
Standard NSG service tags for Storage allow access to all storage accounts in the region, which is insufficient. We must be able to scope access to only specific authorized accounts, subscriptions, or resource groups.
Ensures that data cannot be copied to external or personal storage accounts.
3
Determine the solution with the lowest administrative overhead.
Virtual Network service endpoint policies scoped to the company's subscriptions allow automatic access to newly created company storage accounts without manual updates. Managing individual IP rules in NSGs or individual routes in UDRs requires high administrative effort.
Supports scalability and satisfies the administrative constraint.

Anahtar Kavram

Virtual Network service endpoint policies allow you to filter egress virtual network traffic to Azure Storage accounts, preventing data exfiltration while keeping traffic on the Microsoft backbone network.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru