Examkin

Soru

Zorluk: OrtaNetwork Security and Private Access

A company is planning to restrict outbound network traffic from an Azure Virtual Network subnet named Subnet1. The virtual machines in Subnet1 must be allowed to send metric and log data to Azure Monitor, but all other outbound internet traffic must be blocked. You need to design a Network Security Group (NSG) rule configuration for Subnet1 that permits this traffic while minimizing administrative effort and avoiding manual rule updates when Azure Monitor IP addresses change. Which rule configuration should you recommend?

  1. A
    A design that deploys a separate Log Analytics workspace in every region to isolate traffic, bypassing NSG controls entirely
  2. B
    Outbound security rules with the destination set to the individual public IP address ranges of the Azure Monitor endpoints
  3. An outbound security rule with the destination set to the AzureMonitor Service TagCevap
  4. D
    A User Defined Route with a destination of 0.0.0.0/0 pointing to a virtual appliance, along with overlapping routes for each Azure Monitor public IP address

Cevap

An outbound security rule with the destination set to the AzureMonitor Service Tag
The correct answer recommends using the AzureMonitor Service Tag in the outbound NSG rule. Service Tags represent a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, thereby minimizing the administrative effort of managing security rules.

Adım Adım Çözüm

1
Identify the target service destination for outbound traffic from the virtual network subnet.
The destination is Azure Monitor (including Log Analytics and Application Insights).
The requirement states that virtual machines must be permitted to send metrics and logs to Azure Monitor.
2
Select a mechanism in Network Security Groups (NSGs) that represents group IP address prefixes from a specific Azure service.
The AzureMonitor Service Tag is identified as the built-in system tag representing these IP address ranges.
Service Tags simplify NSG rule creation and are automatically managed and updated by Microsoft.
3
Evaluate the options against the constraint to minimize administrative effort and avoid manual rule updates.
Configuring the outbound NSG rule to use the AzureMonitor Service Tag meets all requirements, while manual IP configuration or complex routing overrides introduce administrative overhead and failure risks.
This provides the most operationally efficient and robust network security configuration.

Anahtar Kavram

Azure Service Tags simplify NSG management by letting you reference groups of IP address prefixes for specific Azure services.
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru