Examkin

Soru

Zorluk: ZorNetwork Security and Private Access

An enterprise is designing the network security for a two-tier application in Azure. The design includes:

* A virtual network named VNet1 containing two subnets: WebSubnet and DataSubnet.
* WebSubnet hosts web server virtual machines (VMs) that do not have public IP addresses.
* DataSubnet hosts a Private Endpoint for an Azure SQL Database named sql-db1.
* WebSubnet is associated with a Network Security Group (NSG) named NSG-Web.
* DataSubnet is associated with an NSG named NSG-Data.

The design must meet the following requirements:
* The web servers must connect to sql-db1 securely over its private IP address.
* All outbound traffic from WebSubnet to the internet must be blocked.
* Outbound traffic from WebSubnet must be restricted so that the web servers can only communicate with the Private Endpoint of sql-db1 and no other resources in VNet1.
* The design must minimize administrative effort by avoiding the use of individual, hardcoded IP addresses in NSG rules.

Which two configurations should you include in the design? (Choose two.)

  1. Associate the network interface of the Private Endpoint for sql-db1 with an Application Security Group (ASG), and reference this ASG as the destination in an outbound security rule for NSG-Web.Cevap
  2. Enable network policies for private endpoints on DataSubnet.Cevap
  3. C
    Create an outbound security rule in NSG-Web with the destination set to the Sql service tag.
  4. D
    Enable service endpoints for Microsoft.Sql on WebSubnet.
  5. E
    Create an outbound security rule in NSG-Web with the destination set to the VirtualNetwork service tag.

Cevap

The correct configurations are to associate the Private Endpoint's network interface with an Application Security Group (ASG) and reference it in the outbound NSG rule, and to enable network policies for private endpoints on the subnet hosting the Private Endpoint.
To secure traffic to a Private Endpoint using Network Security Groups (NSGs) or Application Security Groups (ASGs), you must first enable network policies for private endpoints on the subnet where the Private Endpoint is deployed (DataSubnet). Once enabled, you can associate the Private Endpoint's network interface with an ASG and reference that ASG in the outbound security rules of the source subnet's NSG (NSG-Web). This dynamically permits traffic to the Private Endpoint without needing to hardcode private IP addresses, minimizing administrative overhead.

Adım Adım Çözüm

1
Enable network policies for private endpoints on DataSubnet.
Network security rules (including NSG and ASG policies) are now enforced on traffic flowing to the Private Endpoint in DataSubnet.
By default, Azure does not enforce NSG or ASG policies on Private Endpoints. Enabling this setting on the subnet is required to apply security rules to the Private Endpoint.
2
Associate the Private Endpoint's network interface with an ASG and reference it in the NSG-Web outbound rule.
Outbound traffic from WebSubnet is successfully restricted to only the Private Endpoint without using hardcoded IP addresses.
This minimizes administrative effort compared to manually configuring individual IP addresses, while still providing the required isolation.
3
Analyze and eliminate incorrect options.
The service tag and service endpoint options are ruled out because they do not apply to the private IP path of the Private Endpoint.
The Sql service tag only represents public IP ranges, and Service Endpoints route traffic to public endpoints. The VirtualNetwork service tag is too broad as it allows traffic to all VNet resources.

Anahtar Kavram

Enforcing network security policies on Private Endpoints using subnet settings and Application Security Groups.
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru