Examkin

Soru

Zorluk: OrtaNetwork Security and Private Access

Solaria Energy is designing a secure architecture for a cloud-based analytics system. The system consists of a virtual network named VNet-Analytics containing a subnet named Processing-Subnet. Virtual machines in Processing-Subnet must securely access an Azure SQL Database instance and an Azure Key Vault.

The design must meet the following requirements:
- All traffic to Azure SQL Database and Azure Key Vault must remain within the Microsoft backbone network.
- Virtual machines in Processing-Subnet must resolve the database and key vault hostnames using their private IP addresses.
- Public endpoint access to the Azure SQL Database and Azure Key Vault must be fully disabled.
- The solution must minimize administrative overhead.

Which two actions should you include in the design to meet the requirements?

  1. Create a private endpoint for the Azure SQL Database and a private endpoint for the Azure Key Vault.Cevap
  2. Configure a private DNS zone named privatelink.database.windows.net and a private DNS zone named privatelink.vaultcore.azure.net, and link both zones to VNet-Analytics.Cevap
  3. C
    Configure Network Security Group (NSG) outbound rules allowing traffic to the individual public IP addresses of the Azure SQL Database and Azure Key Vault.
  4. D
    Create a User Defined Route (UDR) in Processing-Subnet that routes all traffic destined for the SQL Database and Key Vault to the virtual network's default gateway.

Cevap

Create a private endpoint for each service and configure the corresponding private DNS zones linked to the virtual network.
The correct architecture requires creating a private endpoint for the Azure SQL Database and another for the Azure Key Vault. This exposes them via private IPs on the virtual network and allows disabling public access. Additionally, the corresponding Azure Private DNS zones (privatelink.database.windows.net and privatelink.vaultcore.azure.net) must be configured and linked to the virtual network to ensure the virtual machines resolve the service hostnames to their private IP addresses.

Adım Adım Çözüm

1
Identify the private access method that keeps traffic on the Microsoft backbone and allows disabling public endpoints.
Determine that Azure Private Endpoints (Private Link) must be deployed for both Azure SQL Database and Azure Key Vault.
Private Endpoints secure the services by bringing them into the virtual network via private IP addresses, fulfilling the network isolation and security requirements.
2
Determine the DNS configuration required for the services to resolve to their private endpoints.
Identify that privatelink.database.windows.net and privatelink.vaultcore.azure.net private DNS zones must be created and linked to the virtual network.
Without these specific private DNS zones linked to the VNet, the virtual machines would resolve the public IP addresses of the services instead of their private IP addresses, failing name resolution requirements.
3
Evaluate alternative methods to ensure they do not introduce unnecessary administrative overhead or break system routes.
Reject manual IP routing and custom route tables (UDRs) that override system routes, as well as manually maintaining lists of IP addresses in NSG rules.
Custom routes can conflict with system routes automatically created for private endpoints, and manual IP rules in NSGs fail to keep traffic secure and introduce excessive administrative overhead.

Anahtar Kavram

Private Endpoints and Private DNS Zone Integration
Bu soruyu puanla

Konular

Network Security and Private Access

Bu konudan daha fazla soru