Examkin

Soru

Zorluk: OrtaNetwork Security and Private Access

Astraeus Telemetry is designing a secure Azure architecture for an IoT processing workload. The architecture includes a virtual network named VNet1 that contains a subnet hosting virtual machines. The virtual machines must make outbound connections to specific external fully qualified domain names (FQDNs) on the internet, such as *.api.weather.com and registry.npmjs.org, to fetch environmental data and software updates. The design must filter outbound traffic based on these FQDNs and support wildcard routing while minimizing administrative effort. Which component should you recommend including in the design?

  1. A
    Network Security Groups associated with the subnet, containing rules that target the specific IP addresses of the external services.
  2. B
    A User Defined Route associated with the subnet that redirects all outbound internet traffic to an Azure Standard Load Balancer.
  3. Azure Firewall deployed in VNet1, with application rules configured to allow outbound traffic to the required fully qualified domain names.Cevap
  4. D
    A User Defined Route associated with the subnet containing routing rules configured with the fully qualified domain names as the next hop destination.

Cevap

Azure Firewall deployed in VNet1, with application rules configured to allow outbound traffic to the required fully qualified domain names.
The correct answer is the option recommending Azure Firewall with application rules. Azure Firewall operates as a fully managed cloud-based network security service that protects your Azure Virtual Network resources. Its application rules allow you to configure fully qualified domain names (FQDNs) that can be accessed from a subnet, which naturally supports wildcard configurations like '*.api.weather.com'. This satisfies both the security filtering requirement and the administrative overhead constraint.

Adım Adım Çözüm

1
Analyze the technical requirements: outbound traffic must be filtered by specific fully qualified domain names (FQDNs) and support wildcards (e.g., *.api.weather.com) with minimal administrative effort.
Identify that Network Security Groups (NSGs) and User Defined Routes (UDRs) cannot inspect or filter application-layer FQDNs directly.
NSGs and UDRs operate at the network and transport layers (Layers 3 and 4) and do not support dynamic wildcard FQDN filtering.
2
Evaluate the capabilities of Azure Firewall.
Confirm that Azure Firewall application rules are designed to filter outbound HTTP, HTTPS, and MSSQL traffic using FQDNs, including wildcard prefixes.
Azure Firewall provides built-in application-layer filtering to meet the requirement.
3
Evaluate administrative overhead of the options.
Azure Firewall is a managed service that automatically updates backend infrastructure and requires no manual maintenance of IP address changes for the external services.
This satisfies the requirement to minimize administrative effort.

Anahtar Kavram

Azure Firewall Application Rules for Outbound FQDN Filtering
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru