Examkin

Soru

Zorluk: ZorNetwork Security and Private Access

An enterprise is designing a hybrid network architecture to connect an on-premises datacenter to an Azure virtual network named `VNet1` using an ExpressRoute connection. A subnet in `VNet1` named `Subnet1` hosts virtual machines that must access an Azure SQL Database.

The design must meet the following requirements:
- The Azure SQL Database must not expose a public endpoint and must be accessible only via a private IP address within `VNet1`.
- On-premises applications must be able to resolve the database's fully qualified domain name (FQDN) to its private IP address.
- Outbound traffic from `Subnet1` to the database must be restricted at the network layer using Network Security Groups (NSGs).
- Administrative effort for managing DNS routing and network security rules must be minimized.

Which design should you recommend?

  1. A
    Configure a Service Endpoint for Microsoft.Sql on Subnet1. Associate an NSG with Subnet1 and configure outbound security rules containing the individual public IP addresses of the Azure SQL Database regional endpoints. Configure the on-premises DNS servers to forward queries for database.windows.net to the Azure default DNS IP address (168.63.129.16168.63.129.16).
  2. Deploy a Private Endpoint for the Azure SQL Database in a dedicated subnet. Enable private endpoint network policies on the subnet. Configure an Azure DNS Private Resolver with an inbound endpoint in VNet1, and link a private DNS zone named privatelink.database.windows.net to VNet1. Configure the on-premises DNS servers to forward queries for database.windows.net to the inbound endpoint IP.Cevap
  3. C
    Deploy a Private Endpoint for the Azure SQL Database in Subnet1. Link a private DNS zone named privatelink.database.windows.net to VNet1. Create a User-Defined Route (UDR) on Subnet1 that routes all traffic destined for the database FQDN to the ExpressRoute Virtual Network Gateway, overriding the default system routes.
  4. D
    Deploy a Private Endpoint for the Azure SQL Database in a dedicated subnet. Link a private DNS zone named privatelink.database.windows.net to VNet1. Manually configure the on-premises DNS servers with static A records pointing to the database's private IP address, and configure an NSG on Subnet1 with outbound rules targeting the individual public IP addresses of the database.

Cevap

Deploy a Private Endpoint for the Azure SQL Database in a dedicated subnet, enable private endpoint network policies, configure an Azure DNS Private Resolver with an inbound endpoint, link the private DNS zone, and configure on-premises DNS servers to forward queries to the inbound endpoint IP.
The correct option addresses the requirements by using a Private Endpoint to ensure the Azure SQL Database is not publicly exposed. It enables network policies on the subnet so that NSG rules can successfully apply to the Private Endpoint. Finally, it uses an Azure DNS Private Resolver with an inbound endpoint, allowing on-premises clients to resolve the database's private IP address using standard DNS forwarders with minimal administrative effort.

Adım Adım Çözüm

1
Address the private access requirement
Using an Azure Private Endpoint assigns a private IP address from the virtual network to the Azure SQL Database and allows disabling its public endpoint, fulfilling the primary security requirement.
Service Endpoints still use the public IP of the service and do not allow complete removal of the public endpoint.
2
Implement secure filtering on the Private Endpoint
Enable private endpoint network policies on the subnet hosting the Private Endpoint, which allows Network Security Groups (NSGs) to evaluate and filter traffic destined for the Private Endpoint.
By default, network policies are disabled for private endpoints, meaning NSGs do not filter traffic flowing to them.
3
Configure hybrid DNS resolution with minimal administrative overhead
Link the private DNS zone `privatelink.database.windows.net` to `VNet1` and deploy an Azure DNS Private Resolver with an inbound endpoint. Configure on-premises DNS to conditionally forward queries to the inbound endpoint's IP address.
Azure default DNS (168.63.129.16168.63.129.16) is not routable from on-premises, and manually managing static A records increases administrative overhead.

Anahtar Kavram

Azure Private Endpoint Security and Hybrid DNS Integration
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru