AeroSpace Dynamics is designing the network security for a subnet named ProcessingSubnet that hosts Azure Virtual Machines. The virtual machines require outbound access to Azure Storage and Azure Key Vault to process data. All other outbound internet access from the subnet must be blocked. The design must minimize administrative maintenance.
Which two outbound configurations should you recommend for the Network Security Group (NSG) associated with ProcessingSubnet?
- An outbound security rule that allows traffic to the Storage service tagCevap
- An outbound security rule that allows traffic to the AzureKeyVault service tagCevap
- CIndividual outbound security rules that allow traffic to the specific public IP address ranges of the Azure Storage and Azure Key Vault endpoints
- DA custom route table with user-defined routes (UDRs) that direct Storage and Key Vault traffic to the Internet gateway, overriding the default Azure system routes
Cevap
Configure outbound NSG security rules that allow traffic to the Storage and AzureKeyVault service tags.
Using service tags like Storage and AzureKeyVault in outbound NSG rules allows the virtual machines to reach the respective Azure services. Azure manages the IP address prefixes under these service tags automatically, minimizing administrative maintenance while enforcing the required outbound security boundary.
Adım Adım Çözüm
Anahtar Kavram
Azure Network Security Group (NSG) Service Tags simplify outbound security rule management by grouping IP address prefixes for Azure services.