Examkin

Soru

Zorluk: OrtaNetwork Security and Private Access

Aventis Pharmaceuticals is designing a secure network architecture in Azure. The architecture includes a virtual network named VNet1 with a subnet named ProcessingSubnet. Virtual machines (VMs) in ProcessingSubnet must write processed data to an Azure Storage account in the same region. You need to recommend the outbound traffic security configuration for ProcessingSubnet that permits communication with the Azure Storage account while minimizing administrative effort when Azure Storage IP addresses change. Which configuration should you recommend?

  1. Configure an outbound security rule in the Network Security Group (NSG) associated with ProcessingSubnet, setting the destination to the Storage Service Tag.Cevap
  2. B
    Configure an outbound security rule in the Network Security Group (NSG) associated with ProcessingSubnet, setting the destination to a list of the individual IP address ranges of the Azure Storage service.
  3. C
    Create a User Defined Route (UDR) in the route table of ProcessingSubnet that redirects all local subnet traffic to the Azure Firewall to reach Azure Storage.
  4. D
    Deploy a Basic SKU Load Balancer and configure outbound rules pointing to the Azure Storage public IP addresses for the VMs in ProcessingSubnet.

Cevap

Configure an outbound security rule in the Network Security Group (NSG) associated with ProcessingSubnet, setting the destination to the Storage Service Tag.
Configuring an outbound security rule in the Network Security Group (NSG) with the destination set to the Storage Service Tag allows direct communication with Azure Storage. Microsoft automatically updates the underlying IP addresses for the Service Tag, which fulfills the requirement to minimize administrative effort.

Adım Adım Çözüm

1
Identify the requirement to minimize administrative effort during IP address changes for Azure Storage.
Determine that Service Tags are the standard Azure mechanism for grouping IP addresses of specific services.
Microsoft automatically updates the IP addresses within a Service Tag, removing the administrative burden of manual updates.
2
Evaluate the use of Network Security Groups (NSGs) for traffic filtering.
An NSG rule with the Storage Service Tag as the destination allows outbound traffic to Azure Storage.
NSGs process outbound rules based on destination prefixes, and using a Service Tag matches all Storage endpoints in the region.
3
Discard options that introduce routing conflicts or SKU mismatches.
Avoid User Defined Routes that alter local system routes and avoid mixing Basic and Standard Load Balancer SKUs.
Overlapping routes disrupt local VNet traffic, and SKU mismatches cause deployment validation failures.

Anahtar Kavram

Using NSG Service Tags to filter outbound traffic to Azure services with minimal administrative effort
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru