Examkin

Soru

Zorluk: ZorNetwork Security and Private Access

Zephyr Logistics is designing a secure hybrid networking architecture. The environment consists of an on-premises datacenter with local Active Directory DNS servers, an Azure subscription with a hub virtual network and a peered spoke virtual network, and an ExpressRoute connection linking the on-premises datacenter to the hub virtual network. Virtual machines (VMs) are deployed in a subnet named AppSubnet in the spoke virtual network to host a business-critical application that connects to an Azure SQL Database containing sensitive customer records.

The architecture must meet the following requirements:
- The Azure SQL Database must not be exposed to the public internet.
- The VMs in AppSubnet must connect to the database securely using the private IP address of the database.
- On-premises client machines must be able to resolve and query the database using the same fully qualified domain name (FQDN) as the Azure VMs.
- Administrative overhead for security rules and DNS management must be minimized.

Which two actions should you recommend to meet these requirements?

  1. Configure a Private Endpoint for the Azure SQL Database in the spoke virtual network, and link the Azure Private DNS zone named privatelink.database.windows.net to the hub virtual network.Cevap
  2. Configure an inbound endpoint on the Azure Private DNS Resolver in the hub virtual network, and configure the on-premises DNS servers to forward queries for database.windows.net to the private IP address of the inbound endpoint.Cevap
  3. C
    Configure a Network Security Group (NSG) on the spoke subnet with outbound security rules that target the individual public IP addresses of the Azure SQL Database gateway endpoints.
  4. D
    Create a route table with a User Defined Route (UDR) in the spoke subnet that routes all traffic destined for the SQL Database Private Endpoint IP address to the on-premises VPN gateway, overriding the default system routes.
  5. E
    Deploy a Standard Load Balancer in the spoke virtual network to distribute traffic to the SQL Database Private Endpoint, and associate virtual machines using Basic SKU public IP addresses to the load balancer backend pool.

Cevap

Configure a Private Endpoint for the Azure SQL Database in the spoke virtual network, link the Azure Private DNS zone named privatelink.database.windows.net to the hub virtual network, and deploy an Azure Private DNS Resolver inbound endpoint in the hub virtual network while configuring conditional forwarding on the on-premises DNS servers.
The correct architecture requires establishing a Private Endpoint for the database to remove public internet exposure. Resolving the database FQDN from on-premises requires configuring an Azure Private DNS Resolver in the hub virtual network (where the ExpressRoute terminates) and creating a conditional forwarder on-premises pointing to the resolver's inbound endpoint. In addition, the Azure Private DNS zone must be linked to the hub virtual network so that the Private DNS Resolver can query and return the private IP address of the SQL Database.

Adım Adım Çözüm

1
Isolate database traffic from the public internet by creating a Private Endpoint.
The Azure SQL Database is assigned a private IP address within the spoke virtual network, and its public endpoint is secured or disabled.
This satisfies the security requirement to restrict public internet exposure and ensures connection is made via private IP.
2
Link the Azure Private DNS zone to the hub virtual network.
The hub virtual network has access to the private DNS records configured for the Private Endpoint.
This allows the Azure Private DNS Resolver located in the hub virtual network to resolve the database private IP address.
3
Deploy an Azure Private DNS Resolver with an inbound endpoint in the hub virtual network and configure conditional forwarding on-premises.
On-premises DNS queries for database.windows.net are forwarded to the inbound endpoint, which queries the linked Private DNS Zone.
This enables on-premises clients to resolve the database FQDN to the Private Endpoint IP address without exposing the database publicly.

Anahtar Kavram

Azure Private Endpoint and Azure Private DNS Resolver integration for secure hybrid name resolution and private access.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru