A retail company is designing the network security architecture for a new containerized inventory application hosted on Azure Container Apps integrated with a virtual network named VNet1. The design must meet the following requirements:
- The application must securely retrieve secrets from an Azure Key Vault named KV1.
- KV1 must disable all public network access.
- The containerized application must resolve and connect to KV1 over a private IP address within VNet1.
- Administrative maintenance must be minimized.
Which two actions should you include in the design?
- Create a private endpoint for KV1 in a subnet of VNet1.Cevap
- Configure an Azure Private DNS zone named privatelink.vaultcore.azure.net and link it to VNet1.Cevap
- CConfigure Network Security Group (NSG) rules on the application subnet containing the individual public IP addresses of the Key Vault service.
- DCreate a custom User Defined Route (UDR) in VNet1 that routes all Key Vault-bound traffic to a virtual network gateway.
Cevap
To secure access to the Key Vault over private IP addresses and disable public exposure, you must create a private endpoint for the Key Vault inside the virtual network and configure an Azure Private DNS zone named privatelink.vaultcore.azure.net linked to the virtual network for proper name resolution.
To secure the Azure Key Vault by disabling public access while allowing the application to connect over a private IP, a private endpoint must be created in the virtual network. To ensure name resolution works seamlessly without changing connection strings, an Azure Private DNS zone named privatelink.vaultcore.azure.net must be deployed and linked to the virtual network.
Adım Adım Çözüm
Anahtar Kavram
Designing private access to Azure PaaS resources using Private Endpoints and integrated Private DNS zones.