Examkin

Soru

Zorluk: OrtaNetwork Security and Private Access

An organization is designing a secure network environment for a batch processing workload running on Azure Virtual Machines inside a dedicated subnet. The virtual machines must connect to an Azure SQL Database and an Azure Key Vault to retrieve data and connection secrets. The security team requires that all outbound internet traffic from the subnet be blocked, except for the traffic destined for these two Azure services. The solution must minimize administrative overhead and ensure that network rules do not require manual updates when Microsoft changes the IP addresses of these services.

Which configuration should you recommend for the Network Security Group (NSG) associated with the subnet?

  1. Create outbound security rules that allow traffic with the destination set to the SQL and AzureKeyVault Service Tags, and a lower-priority rule that denies all outbound traffic to the Internet Service Tag.Cevap
  2. B
    Create outbound security rules that allow traffic to the specific public IP address ranges of the regional Azure SQL Database and Azure Key Vault endpoints, and implement an automated script to verify and update the ranges monthly.
  3. C
    Associate a route table with custom User Defined Routes (UDRs) that override the default system routes to direct Azure SQL and Key Vault traffic through the default internet gateway.
  4. D
    Configure an outbound NAT rule on a Standard Load Balancer that routes the traffic using Basic SKU public IP addresses assigned directly to the virtual machines.

Cevap

Create outbound security rules that allow traffic with the destination set to the SQL and AzureKeyVault Service Tags, and a lower-priority rule that denies all outbound traffic to the Internet Service Tag.
The correct configuration is to use built-in Service Tags (SQL and AzureKeyVault) in the NSG outbound rules, followed by a rule blocking the Internet Service Tag. This allows outbound access only to the specified services and delegates the management of service IP addresses to Azure, satisfying the constraint of minimizing administrative effort.

Adım Adım Çözüm

1
Identify the target services and security requirements.
The target services are Azure SQL Database and Azure Key Vault. Outbound internet traffic must be blocked except for connections to these two services.
This establishes the boundary conditions for the NSG rules.
2
Determine the optimal NSG destination settings to minimize administrative overhead.
Use the SQL and AzureKeyVault Service Tags as destinations rather than specific IP addresses.
Service Tags are managed by Microsoft and automatically update when IP addresses of Azure services change, eliminating manual updates.
3
Define the rule ordering and priorities within the NSG.
Create high-priority Allow rules for SQL and AzureKeyVault Service Tags, and a lower-priority Deny rule for the Internet Service Tag.
NSG rules are processed in priority order. Allowing specific services first before denying all internet traffic ensures the VMs can communicate with the required endpoints while blocking everything else.

Anahtar Kavram

Azure Network Security Group Service Tags allow you to define network access controls for Azure services without maintaining individual IP addresses.
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru