Soru

Zorluk: OrtaNetwork Security and Private Access

A retail company is designing the network security architecture for a new containerized inventory application hosted on Azure Container Apps integrated with a virtual network named VNet1. The design must meet the following requirements:
- The application must securely retrieve secrets from an Azure Key Vault named KV1.
- KV1 must disable all public network access.
- The containerized application must resolve and connect to KV1 over a private IP address within VNet1.
- Administrative maintenance must be minimized.

Which two actions should you include in the design?

  1. Create a private endpoint for KV1 in a subnet of VNet1.Cevap
  2. Configure an Azure Private DNS zone named privatelink.vaultcore.azure.net and link it to VNet1.Cevap
  3. C
    Configure Network Security Group (NSG) rules on the application subnet containing the individual public IP addresses of the Key Vault service.
  4. D
    Create a custom User Defined Route (UDR) in VNet1 that routes all Key Vault-bound traffic to a virtual network gateway.

Cevap

To secure access to the Key Vault over private IP addresses and disable public exposure, you must create a private endpoint for the Key Vault inside the virtual network and configure an Azure Private DNS zone named privatelink.vaultcore.azure.net linked to the virtual network for proper name resolution.
To secure the Azure Key Vault by disabling public access while allowing the application to connect over a private IP, a private endpoint must be created in the virtual network. To ensure name resolution works seamlessly without changing connection strings, an Azure Private DNS zone named privatelink.vaultcore.azure.net must be deployed and linked to the virtual network.

Adım Adım Çözüm

1
Identify the private connectivity requirements.
Since the Key Vault must have public access disabled and be accessed over a private IP, Azure Private Link (Private Endpoint) is required.
Private endpoints expose PaaS services on a private IP address within a virtual network subnet.
2
Determine the DNS resolution mechanism.
An Azure Private DNS zone named privatelink.vaultcore.azure.net must be linked to the application VNet.
Applications must still address the Key Vault using its public FQDN, which must resolve to the private endpoint IP address locally.
3
Evaluate and eliminate administrative overhead options.
Avoid manual NSG IP configuration and custom routing rules.
Manual IP rules in NSGs and redundant UDRs increase configuration overhead and fail to align with Azure network security best practices.

Anahtar Kavram

Designing private access to Azure PaaS resources using Private Endpoints and integrated Private DNS zones.
Bu soruyu puanla