Examkin

Soru

Zorluk: OrtaNetwork Security and Private Access

A company named Veridia Tech deploys a three-tier web application to Azure. The application consists of web servers, application servers, and database servers, all hosted on Azure Virtual Machines within a single subnet named WorkloadSubnet. You need to design a network security solution that meets the following requirements:
- Restricts network traffic so that web servers can only communicate with application servers, and application servers can only communicate with database servers.
- Prevents direct network communication between web servers and database servers.
- Automatically applies the traffic restrictions to new virtual machines as they are provisioned.
- Minimizes administrative overhead by avoiding the management of individual IP addresses or the creation of separate subnets.

Which component should you include in the network security design?

  1. Application Security Groups (ASGs) associated with the network interfaces of the virtual machinesCevap
  2. B
    User-defined routes (UDRs) that direct all intra-subnet traffic to an Azure Firewall
  3. C
    Network Security Group (NSG) rules configured with individual static IP address ranges for each virtual machine
  4. D
    Azure Private Endpoints configured for each virtual machine to establish Private Link connections

Cevap

Application Security Groups (ASGs) associated with the network interfaces of the virtual machines
The correct solution uses Application Security Groups (ASGs) to group virtual machines by role (Web, Application, Database) and defines NSG rules using these ASGs. Because ASGs are associated with the network interfaces of the virtual machines, any newly provisioned virtual machine assigned to an ASG automatically inherits the network security rules without requiring manual updates to the NSGs or IP configurations. This achieves the required traffic isolation within a single subnet while minimizing administrative effort.

Adım Adım Çözüm

1
Define Application Security Groups (ASGs) for the different application roles: Web, Application, and Database.
Three logical groups are created in Azure that can be referenced in Network Security Group (NSG) rules.
This allows referencing these groups as sources or destinations instead of using specific IP addresses or subnets.
2
Associate the respective ASGs with the network interfaces of the virtual machines belonging to each tier.
The virtual machines are dynamically grouped according to their application functions.
This ensures that any new virtual machine assigned to an ASG automatically inherits the security policies associated with that group.
3
Configure NSG rules on the WorkloadSubnet that allow traffic between the Web and Application ASGs, and between the Application and Database ASGs, while blocking other traffic.
Traffic flow is secured such that Web cannot talk directly to Database, while App can communicate with both Web and Database.
This implements the required network isolation policies dynamically and with minimal administrative overhead.

Anahtar Kavram

Using Application Security Groups (ASGs) to define context-aware network security policies within a single subnet, reducing administrative complexity and enabling dynamic scaling.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru