Examkin

Design Infrastructure Solutions

360 soru

Tüm türler360Çoktan seçmeli189Çoklu seçim171
Soru 221Soru →

An enterprise is designing a hub-and-spoke network topology in Azure. The topology consists of the following components:
* A hub virtual network named `vnet-neur-hub` (10.10.0.0/1610.10.0.0/16) containing an Azure Firewall deployed at IP address 10.10.1.410.10.1.4.
* A production spoke virtual network named `vnet-neur-prod` (10.20.0.0/1610.20.0.0/16) peered with `vnet-neur-hub`.
* A shared services spoke virtual network named `vnet-neur-shared` (10.30.0.0/1610.30.0.0/16) peered with `vnet-neur-hub`.

There is no direct virtual network peering between `vnet-neur-prod` and `vnet-neur-shared`.

You need to implement a routing design that achieves the following objectives:
1. All outbound internet traffic from `vnet-neur-prod` must transit through the Azure Firewall.
2. All traffic from `vnet-neur-prod` destined for `vnet-neur-shared` must transit through the Azure Firewall.
3. All traffic between resources within `vnet-neur-prod` must route directly within the virtual network without traversing the firewall.

Which TWO actions should you perform to configure the route table associated with the subnets in `vnet-neur-prod`?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Add a route for 0.0.0.0/00.0.0.0/0 with a next hop of Virtual Appliance and IP address 10.10.1.410.10.1.4.; Add a route for 10.30.0.0/1610.30.0.0/16 with a next hop of Virtual Appliance and IP address 10.10.1.410.10.1.4.

Cevap

To configure routing for the production spoke subnets, you must add a default route of 0.0.0.0/00.0.0.0/0 pointing to the Azure Firewall private IP address (10.10.1.410.10.1.4) as a Virtual Appliance, and add a route for the shared services spoke VNet range (10.30.0.0/1610.30.0.0/16) pointing to the same Azure Firewall IP (10.10.1.410.10.1.4) as a Virtual Appliance.
To route internet traffic through the firewall, a default route (0.0.0.0/00.0.0.0/0) pointing to the firewall's private IP (10.10.1.410.10.1.4) as a Virtual Appliance next hop is required. To route traffic to the peered spoke VNet, a specific route for 10.30.0.0/1610.30.0.0/16 pointing to the firewall's private IP as a Virtual Appliance next hop is required. These custom routes steer external and cross-spoke traffic through the hub firewall without affecting local VNet traffic, which is automatically handled by the system's local route.

Adım Adım Çözüm

1
Determine the route required to direct outbound internet traffic through the central firewall.
Create a route for 0.0.0.0/00.0.0.0/0 (the default route representing all external traffic) with a next hop of Virtual Appliance pointing to the firewall IP (10.10.1.410.10.1.4).
This satisfies the requirement that all outbound internet traffic from the production spoke VNet must transit through the Azure Firewall.
2
Determine the route required to enable cross-spoke communication through the firewall.
Create a route for the target shared services spoke range (10.30.0.0/1610.30.0.0/16) with a next hop of Virtual Appliance pointing to the firewall IP (10.10.1.410.10.1.4).
Since Azure virtual network peering is non-transitive by default, traffic between two spokes must be explicitly routed through the firewall in the hub VNet.
3
Evaluate the impact on local VNet traffic within the production spoke.
Do not define any custom routes for the local VNet prefix (10.20.0.0/1610.20.0.0/16) in the route table.
Azure automatically manages intra-VNet routing using the default system route (10.20.0.0/1610.20.0.0/16 -> Local). Adding a custom route for this prefix would override the system route and break direct subnet-to-subnet connectivity.

Anahtar Kavram

Configuring custom routing using User Defined Routes (UDRs) in a hub-and-spoke Azure topology while avoiding overlapping routes that override system-defined local paths.
Soru 222Soru →

A media streaming company is designing a serverless backend solution to transcode user-uploaded video files. The transcoding utility is packaged as a custom Docker container image. The transcoding process is event-driven, triggered by new files arriving in an Azure Blob Storage container. Each transcoding operation takes approximately 15 minutes to complete. The company requires a solution that minimizes administrative overhead, scales automatically, and incurs no costs when no video files are being processed. Which Azure service should you recommend?

Cevabı ve açıklamayı göster

Cevap: Azure Container Apps Jobs

Cevap

Azure Container Apps Jobs is the recommended service because it runs containerized batch workloads to completion, scales to zero to avoid idle costs, and does not impose the 10-minute timeout constraint found in Azure Functions Consumption plans.
Azure Container Apps Jobs is the ideal option because it is built for run-to-completion, containerized event-driven tasks. It supports custom container images, scales to zero when no executions are triggered, and allows jobs to run for up to 24 hours, comfortably accommodating the 15-minute runtime requirement.

Adım Adım Çözüm

1
Analyze the execution duration requirement.
The transcoding process requires 15 minutes of execution time.
This exceeds the maximum 10-minute execution limit of the Azure Functions Consumption plan, ruling it out.
2
Evaluate cost and scaling requirements.
The solution must scale to zero and incur zero costs when idle.
This eliminates Dedicated App Service plans and Azure Functions Premium plans, both of which require minimum running instances and incur base fees when idle.
3
Analyze containerization and administrative overhead.
The utility is a custom container image and needs minimal management overhead.
Azure Container Apps Jobs is fully managed, supports custom containers, runs containerized tasks to completion (up to 24 hours), and scales to zero, meeting all criteria without the complexity of managing an AKS cluster.

Anahtar Kavram

Selecting serverless hosting options for event-driven, containerized, run-to-completion tasks that exceed standard function timeouts.
Soru 223Soru →

An organization is designing a hybrid network in Azure to support dynamic routing between their on-premises datacenter (192.168.0.0/16192.168.0.0/16) and Azure resources.

The architecture consists of the following components:
- A hub virtual network named `vnet-useast-hub-transit` (10.30.0.0/1610.30.0.0/16) that hosts an Azure Route Server named `ars-useast` in the dedicated `RouteServerSubnet`, an ExpressRoute gateway, and two active-active Network Virtual Appliances (NVAs) that establish BGP sessions with the Route Server.
- A spoke virtual network named `vnet-useast-spoke-prod` (10.40.0.0/1610.40.0.0/16) that hosts application workloads.
- A virtual network peering connection between `vnet-useast-hub-transit` and `vnet-useast-spoke-prod`.

The routing requirements are as follows:
- BGP routes from the on-premises datacenter must propagate dynamically to the virtual machines in `vnet-useast-spoke-prod` via the NVAs.
- Static User-Defined Routes (UDRs) must not be configured or managed in `vnet-useast-spoke-prod` to avoid operational overhead.
- Traffic must route dynamically between the ExpressRoute gateway and the NVAs.

Which two configuration settings should you implement to meet these requirements? (Choose two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable the branch-to-branch setting on the Azure Route Server `ars-useast`.; Configure the virtual network peering from `vnet-useast-spoke-prod` to `vnet-useast-hub-transit` to use the remote virtual network's gateway or Route Server.

Cevap

To meet the routing requirements, you must enable the branch-to-branch setting on the Azure Route Server `ars-useast` to allow dynamic route exchange between the ExpressRoute gateway and the NVAs, and configure the virtual network peering from the spoke VNet to the hub VNet to use the remote virtual network's gateway or Route Server.
To establish dynamic routing between the ExpressRoute gateway and the NVAs, the branch-to-branch setting must be enabled on the Azure Route Server. This allows the Route Server to transit routes between the virtual network gateway and the BGP-enabled NVAs. Additionally, to propagate these dynamically learned routes to the spoke virtual network without using static routes, the virtual network peering from the spoke VNet to the hub VNet must be configured to use the remote virtual network's gateway or Route Server.

Adım Adım Çözüm

1
Enable dynamic routing between the ExpressRoute gateway and the NVAs.
Dynamic route propagation is established between on-premises and the NVAs.
By default, Azure Route Server does not route traffic directly between gateways. Enabling the branch-to-branch setting allows the Route Server to transit routes between the ExpressRoute gateway and the NVA BGP peers.
2
Enable route propagation from the hub VNet to the spoke VNet.
The spoke virtual network learns the routes advertised by the Azure Route Server in the hub.
Configuring the virtual network peering from the spoke to use the remote virtual network's gateway or Route Server allows the spoke subnets to dynamically inherit routes from the hub Route Server.

Anahtar Kavram

Azure Route Server enables dynamic BGP route propagation across peered VNets and gateways using the branch-to-branch setting without requiring manual user-defined routes.
Soru 224Soru →

An agricultural technology startup is designing a serverless architecture to host two workloads:

1. A public API for farmers that experiences highly variable traffic, scaling from zero to thousands of concurrent requests, with a target response time under 200200 ms.
2. A background data analysis job that runs once daily to generate complex crop yield models. This job takes between 1515 to 2525 minutes to complete.

The startup requires a solution that minimizes both operational overhead and cost.

Which two Azure hosting services should you recommend?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure Functions on a Consumption plan to host the public API; Azure Container Apps Jobs to run the daily background data analysis job

Cevap

Azure Functions on a Consumption plan to host the public API, and Azure Container Apps Jobs to run the daily background data analysis job.
The correct recommendation is to host the public API on Azure Functions (Consumption plan) and the background job on Azure Container Apps Jobs. Azure Functions Consumption plan is cost-effective and highly responsive for light, bursty API request patterns. Azure Container Apps Jobs allows containerized tasks to run on-demand for up to multiple hours without timeout issues, fulfilling the requirement for the 1515-to-2525 minute process while remaining fully serverless with minimal administrative overhead.

Adım Adım Çözüm

1
Analyze the API workload requirements.
The API requires rapid scaling from zero, low latency (under 200200 ms), and minimal cost. A serverless compute model like Azure Functions on a Consumption plan fits perfectly.
Azure Functions on the Consumption plan scales dynamically and charges only for execution time, aligning with variable API workloads.
2
Analyze the background job requirements.
The background job runs daily for 1515 to 2525 minutes. Standard serverless options like Azure Functions Consumption plan will timeout (max 1010 minutes limit).
An alternative serverless processing service that supports longer executions without infrastructure overhead is required, pointing to Azure Container Apps Jobs.
3
Evaluate operational overhead and cost constraints.
Azure Container Apps Jobs run on demand, scale to zero, and have no platform management overhead. Azure Kubernetes Service (AKS) or Virtual Machines would require active infrastructure management and higher idle costs.
Selecting Azure Container Apps Jobs and Azure Functions minimizes administrative management and keeps resource costs tightly aligned to actual usage.

Anahtar Kavram

Selecting Azure hosting plans and services based on execution duration limits, scaling patterns, and administrative overhead.
Tahmini Süre:2m 0s
Soru 225Soru →

An enterprise is designing a secure administrative management solution for virtual machines deployed in a subnet named ComputeSubnet within a virtual network named VNet1. You deploy Azure Bastion in a subnet named AzureBastionSubnet to provide secure RDP and SSH access. To comply with security policies, you must configure a Network Security Group (NSG) associated with AzureBastionSubnet to restrict outbound traffic to only what is required for Azure Bastion to function properly, including connectivity to Azure public services (such as Azure Active Directory, Azure Monitor, and Azure Storage) for logging and diagnostics. The solution must minimize administrative overhead and avoid manual rule updates when Azure service IP addresses change. Which outbound NSG rule configuration should you recommend for AzureBastionSubnet?

Cevabı ve açıklamayı göster

Cevap: Create an outbound security rule with the destination set to the AzureCloud Service Tag for ports 443 and 12000.

Cevap

Create an outbound security rule with the destination set to the AzureCloud Service Tag for ports 443 and 12000.
The correct option is correct because Azure Bastion relies on outbound access to Azure public services (e.g., Azure Active Directory, Azure Monitor, Azure Storage) on port 443 and port 12000 for service telemetry, control plane logging, and validation. The built-in AzureCloud service tag represents these endpoints dynamically, minimizing administrative overhead by automatically updating underlying IP addresses.

Adım Adım Çözüm

1
Analyze Azure Bastion network requirements
Azure Bastion requires outbound access to Azure public endpoints (such as Azure Storage and Azure Monitor) for diagnostic logging and telemetry on ports 443 and 12000.
Ensures that the management plane of the service can communicate with its supporting Azure cloud infrastructure.
2
Select the most efficient NSG destination type
The AzureCloud Service Tag is chosen over static IP addresses or custom ranges.
Using the built-in Service Tag automatically keeps up with changing IP addresses, eliminating manual maintenance and reducing administrative overhead.
3
Validate routing constraints
Ensure no default UDR (0.0.0.0/0) is assigned to the AzureBastionSubnet that redirects traffic away from the public internet.
Azure Bastion does not support forced tunneling as it breaks required control plane and certificate validation communications.

Anahtar Kavram

Azure Bastion Outbound NSG Rules and Service Tags
Soru 226Soru →

Your company is designing the network security architecture for a new application environment in Azure. The application workloads will run on virtual machines in a subnet named ProductionSubnet. The virtual machines must meet the following requirements:
- Outbound access to the public internet must be blocked.
- The virtual machines must be able to securely store files in an Azure Storage account named storage1 without traversing the public internet.
- The virtual machines must be able to send diagnostic logs to Azure Monitor.
- Administrative overhead for managing network access rules must be minimized.

Which two actions should you include in the recommendation?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a Private Endpoint for storage1 in ProductionSubnet.; Associate a Network Security Group (NSG) with ProductionSubnet and configure an outbound security rule that allows traffic to the AzureMonitor service tag.

Cevap

To meet the requirements, you must recommend deploying a Private Endpoint for the Azure Storage account and configuring a Network Security Group (NSG) with an outbound rule allowing traffic to the AzureMonitor service tag.
Deploying a Private Endpoint for the storage account assigns it a private IP within the subnet, ensuring traffic does not traverse the public internet. Configuring an NSG outbound rule with the AzureMonitor service tag ensures that virtual machines can safely transmit logs to Azure Monitor while avoiding the administrative overhead of maintaining individual IP addresses.

Adım Adım Çözüm

1
Analyze storage access requirements
Determine that private endpoint is needed to keep storage traffic off the public internet
Private Endpoints assign private IP addresses from the virtual network subnet to the Azure service, securing traffic and preventing public internet traversal.
2
Analyze monitoring requirements
Determine that NSG outbound rule must allow traffic to Azure Monitor using a service tag
Using service tags simplifies management because Microsoft automatically maintains the IP addresses within the tag, minimizing administrative effort compared to manually configuring individual IP ranges.
3
Evaluate and eliminate incorrect architectures
Discard solutions proposing manually managed IP rules, Basic/Standard SKU mixing, and invalid UDRs
Mixing basic/standard SKUs fails deployment validation, routing all traffic to a storage public IP is invalid, and manual IP rules violate the administrative overhead constraint.

Anahtar Kavram

Designing secure network access and private connectivity using Private Endpoints and NSG Service Tags to minimize administrative overhead.
Soru 227Soru →

An organization has a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-weur-hub` (10.200.0.0/1610.200.0.0/16), contains a Network Virtual Appliance (NVA) at IP address 10.200.1.410.200.1.4 in a subnet named `snet-nva`. The spoke virtual network, `vnet-weur-spoke1` (10.201.0.0/1610.201.0.0/16), contains a subnet named `snet-app` (10.201.1.0/2410.201.1.0/24).

To meet security compliance, you associate a route table named `rt-spoke-app` with `snet-app`. The route table contains the following user-defined routes (UDRs):
* Route 1: Prefix 10.200.0.0/1610.200.0.0/16, Next hop: Virtual Appliance (10.200.1.410.200.1.4)
* Route 2: Prefix 10.201.0.0/1610.201.0.0/16, Next hop: Virtual Appliance (10.200.1.410.200.1.4)
* Route 3: Prefix 0.0.0.0/00.0.0.0/0, Next hop: Virtual Appliance (10.200.1.410.200.1.4)

After applying `rt-spoke-app`, virtual machines in `snet-app` cannot communicate with other virtual machines located in the same spoke virtual network, `vnet-weur-spoke1`.

You need to restore intra-spoke communication while ensuring that all internet-bound and hub-bound traffic continues to be routed through the NVA.

What should you do?

Cevabı ve açıklamayı göster

Cevap: Remove the route with the 10.201.0.0/1610.201.0.0/16 prefix from the route table.

Cevap

Remove the route with the 10.201.0.0/1610.201.0.0/16 prefix from the route table.
Removing the route with the 10.201.0.0/1610.201.0.0/16 prefix allows the system-defined route for the local virtual network to take over. Azure automatically creates a system route for the local VNet address space with the next hop type 'Virtual Network'. Since User-Defined Routes (UDRs) override system routes for the same prefix, the custom route was forcing local traffic to the NVA. Removing this route restores local communication. The remaining routes for 10.200.0.0/1610.200.0.0/16 and 0.0.0.0/00.0.0.0/0 ensure that hub-bound and internet-bound traffic continue to route through the NVA.

Adım Adım Çözüm

1
Analyze the precedence of Azure routing tables and identify why intra-spoke communication failed.
Azure evaluates routes based on longest prefix match (LPM). However, User-Defined Routes (UDRs) always override system-defined routes of the same prefix. The custom route for 10.201.0.0/1610.201.0.0/16 (Route 2) overrides the default system route for the local virtual network (next hop: Virtual Network).
Understanding why traffic is incorrectly redirected is the first step in troubleshooting virtual network routing.
2
Determine the impact of removing the custom route for 10.201.0.0/1610.201.0.0/16.
Removing the UDR for 10.201.0.0/1610.201.0.0/16 allows the default system route for the local VNet to handle intra-spoke traffic, directing it straight to the local virtual network next hop without going to the NVA.
This restores local connectivity since local traffic no longer hairpins through the NVA.
3
Verify that the remaining requirements (routing hub-bound and internet-bound traffic through the NVA) are still met.
Traffic destined for the hub virtual network matches the UDR for 10.200.0.0/1610.200.0.0/16 (Route 1), and internet-bound traffic matches the default UDR for 0.0.0.0/00.0.0.0/0 (Route 3). Both routes direct traffic to the NVA at 10.200.1.410.200.1.4.
Ensures compliance with the security requirements while restoring local spoke traffic flow.

Anahtar Kavram

Azure routing priority and the override of local system routes by User-Defined Routes (UDRs).
Tahmini Süre:1m 30s
Soru 228Soru →

An enterprise is designing a regional application delivery and load balancing solution in Azure. The architecture must support a multi-tier application with the following requirements:

1. Handle incoming HTTP/HTTPS traffic, perform SSL/TLS termination, and route requests to different backend pools based on the URL path (/orders/* and /products/*).
2. Load balance inbound TCP traffic on port 9090 across a pool of Azure Virtual Machines.
3. The virtual machines currently use Basic SKU public IP addresses for direct administrative access.
4. The load balancing components must support Availability Zones for high availability.

Which two actions should you include in the design to meet the requirements while preventing configuration failures? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy an Azure Application Gateway v2 to manage the URL path-based routing and SSL/TLS termination.; Deploy an Azure Standard Load Balancer to route the TCP traffic on port 9090, and upgrade the virtual machine public IP addresses to Standard SKU.

Cevap

Deploying an Azure Application Gateway v2 to manage the URL path-based routing and SSL/TLS termination, and deploying an Azure Standard Load Balancer to route the TCP traffic on port 9090 while upgrading the virtual machine public IP addresses to Standard SKU.
Deploying an Azure Application Gateway v2 satisfies the requirement for Layer 7 load balancing, which includes URL path-based routing and SSL/TLS termination within a region, and supports availability zones. Since the backend virtual machines must also load balance Layer 4 TCP traffic on port 9090 with availability zone support, an Azure Standard Load Balancer is required. To prevent a SKU mismatch, any public IP addresses associated with the virtual machines in the Standard Load Balancer's backend pool must be upgraded from Basic to Standard SKU.

Adım Adım Çözüm

1
Analyze the Layer 7 requirements for HTTP/HTTPS routing and SSL/TLS termination.
Determine that Azure Application Gateway v2 is required because it supports URL-based path routing (/orders/* and /products/*), handles SSL/TLS termination, and provides zone redundancy.
Layer 7 inspection is necessary for URL routing, and v2 SKUs are required for availability zones.
2
Analyze the Layer 4 requirements for TCP traffic load balancing.
Determine that an Azure Standard Load Balancer is required to route TCP traffic on port 9090 with zone-redundancy support.
Standard SKU is required for availability zone support at Layer 4.
3
Identify SKU compatibility constraints for public IP addresses on the virtual machines.
Determine that the existing Basic SKU public IP addresses on the virtual machines must be upgraded to Standard SKU.
Azure does not allow mixing Basic SKU public IPs with Standard SKU load balancers or backend configurations, which would cause validation failures.

Anahtar Kavram

Designing regional application delivery solutions requires selecting the correct load balancing tier (Layer 4 vs Layer 7) and ensuring all associated resources, including virtual machine public IPs and load balancer SKUs, match to prevent configuration and deployment failures.
Soru 229Soru →

Zephyr Logistics is designing a secure hybrid networking architecture. The environment consists of an on-premises datacenter with local Active Directory DNS servers, an Azure subscription with a hub virtual network and a peered spoke virtual network, and an ExpressRoute connection linking the on-premises datacenter to the hub virtual network. Virtual machines (VMs) are deployed in a subnet named AppSubnet in the spoke virtual network to host a business-critical application that connects to an Azure SQL Database containing sensitive customer records.

The architecture must meet the following requirements:
- The Azure SQL Database must not be exposed to the public internet.
- The VMs in AppSubnet must connect to the database securely using the private IP address of the database.
- On-premises client machines must be able to resolve and query the database using the same fully qualified domain name (FQDN) as the Azure VMs.
- Administrative overhead for security rules and DNS management must be minimized.

Which two actions should you recommend to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a Private Endpoint for the Azure SQL Database in the spoke virtual network, and link the Azure Private DNS zone named privatelink.database.windows.net to the hub virtual network.; Configure an inbound endpoint on the Azure Private DNS Resolver in the hub virtual network, and configure the on-premises DNS servers to forward queries for database.windows.net to the private IP address of the inbound endpoint.

Cevap

Configure a Private Endpoint for the Azure SQL Database in the spoke virtual network, link the Azure Private DNS zone named privatelink.database.windows.net to the hub virtual network, and deploy an Azure Private DNS Resolver inbound endpoint in the hub virtual network while configuring conditional forwarding on the on-premises DNS servers.
The correct architecture requires establishing a Private Endpoint for the database to remove public internet exposure. Resolving the database FQDN from on-premises requires configuring an Azure Private DNS Resolver in the hub virtual network (where the ExpressRoute terminates) and creating a conditional forwarder on-premises pointing to the resolver's inbound endpoint. In addition, the Azure Private DNS zone must be linked to the hub virtual network so that the Private DNS Resolver can query and return the private IP address of the SQL Database.

Adım Adım Çözüm

1
Isolate database traffic from the public internet by creating a Private Endpoint.
The Azure SQL Database is assigned a private IP address within the spoke virtual network, and its public endpoint is secured or disabled.
This satisfies the security requirement to restrict public internet exposure and ensures connection is made via private IP.
2
Link the Azure Private DNS zone to the hub virtual network.
The hub virtual network has access to the private DNS records configured for the Private Endpoint.
This allows the Azure Private DNS Resolver located in the hub virtual network to resolve the database private IP address.
3
Deploy an Azure Private DNS Resolver with an inbound endpoint in the hub virtual network and configure conditional forwarding on-premises.
On-premises DNS queries for database.windows.net are forwarded to the inbound endpoint, which queries the linked Private DNS Zone.
This enables on-premises clients to resolve the database FQDN to the Private Endpoint IP address without exposing the database publicly.

Anahtar Kavram

Azure Private Endpoint and Azure Private DNS Resolver integration for secure hybrid name resolution and private access.
Tahmini Süre:3m 0s
Soru 230Soru →

An organization is designing a secure network environment for a batch processing workload running on Azure Virtual Machines inside a dedicated subnet. The virtual machines must connect to an Azure SQL Database and an Azure Key Vault to retrieve data and connection secrets. The security team requires that all outbound internet traffic from the subnet be blocked, except for the traffic destined for these two Azure services. The solution must minimize administrative overhead and ensure that network rules do not require manual updates when Microsoft changes the IP addresses of these services.

Which configuration should you recommend for the Network Security Group (NSG) associated with the subnet?

Cevabı ve açıklamayı göster

Cevap: Create outbound security rules that allow traffic with the destination set to the SQL and AzureKeyVault Service Tags, and a lower-priority rule that denies all outbound traffic to the Internet Service Tag.

Cevap

Create outbound security rules that allow traffic with the destination set to the SQL and AzureKeyVault Service Tags, and a lower-priority rule that denies all outbound traffic to the Internet Service Tag.
The correct configuration is to use built-in Service Tags (SQL and AzureKeyVault) in the NSG outbound rules, followed by a rule blocking the Internet Service Tag. This allows outbound access only to the specified services and delegates the management of service IP addresses to Azure, satisfying the constraint of minimizing administrative effort.

Adım Adım Çözüm

1
Identify the target services and security requirements.
The target services are Azure SQL Database and Azure Key Vault. Outbound internet traffic must be blocked except for connections to these two services.
This establishes the boundary conditions for the NSG rules.
2
Determine the optimal NSG destination settings to minimize administrative overhead.
Use the SQL and AzureKeyVault Service Tags as destinations rather than specific IP addresses.
Service Tags are managed by Microsoft and automatically update when IP addresses of Azure services change, eliminating manual updates.
3
Define the rule ordering and priorities within the NSG.
Create high-priority Allow rules for SQL and AzureKeyVault Service Tags, and a lower-priority Deny rule for the Internet Service Tag.
NSG rules are processed in priority order. Allowing specific services first before denying all internet traffic ensures the VMs can communicate with the required endpoints while blocking everything else.

Anahtar Kavram

Azure Network Security Group Service Tags allow you to define network access controls for Azure services without maintaining individual IP addresses.
Soru 231Soru →

An enterprise is designing a hub-and-spoke network topology in Azure to support their application infrastructure. The topology includes the following components:
* A hub virtual network named `vnet-hub-useast` (10.100.0.0/1610.100.0.0/16) that hosts a Virtual Network Gateway and an Azure Firewall with the private IP address `10.100.1.410.100.1.4`.
* A spoke virtual network named `vnet-spoke-app` (10.101.0.0/1610.101.0.0/16) that contains two subnets: `snet-web` (10.101.1.0/2410.101.1.0/24) and `snet-db` (10.101.2.0/2410.101.2.0/24).
* An on-premises network (172.16.0.0/12172.16.0.0/12) connected to the hub's Virtual Network Gateway via an ExpressRoute circuit.
* Virtual network peering established between `vnet-hub-useast` and `vnet-spoke-app` with gateway transit enabled.

You are designing a routing solution for the subnets in `vnet-spoke-app` to meet these requirements:
1. All outbound traffic destined for the internet must be inspected by the Azure Firewall.
2. All traffic destined for the on-premises network (172.16.0.0/12172.16.0.0/12) must route through the Virtual Network Gateway.
3. Traffic between `snet-web` and `snet-db` must route directly within the spoke virtual network without traversing the hub.
4. The configuration must minimize administrative overhead and avoid using statically defined routes for on-premises address ranges.

Which two configurations should you include in the route table associated with the spoke subnets to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: A route for 0.0.0.0/00.0.0.0/0 with a next hop type of Virtual appliance and a next hop IP address of 10.100.1.410.100.1.4; Gateway route propagation enabled on the route table

Cevap

Add a user-defined route for 0.0.0.0/00.0.0.0/0 pointing to the Azure Firewall private IP address as a Virtual Appliance, and keep virtual network gateway route propagation enabled on the route table associated with the spoke subnets.
The correct configurations are defining a default route (0.0.0.0/00.0.0.0/0) pointing to the Azure Firewall IP address as a Virtual Appliance, and keeping gateway route propagation enabled on the route table. The default route redirects internet traffic to the firewall. Since Azure routes traffic based on the longest prefix match (LPM), the dynamically propagated routes from the ExpressRoute gateway (such as 172.16.0.0/12172.16.0.0/12) are more specific than 0.0.0.0/00.0.0.0/0 and will take precedence, directing on-premises traffic to the Virtual Network Gateway. Furthermore, because no user-defined route is created for the local VNet range (10.101.0.0/1610.101.0.0/16), traffic between subnets within the spoke VNet will follow the default system local route and route directly, meeting all criteria with minimal administrative effort.

Adım Adım Çözüm

1
Determine the routing mechanism for internet-bound traffic.
Create a User Defined Route (UDR) for 0.0.0.0/00.0.0.0/0 with the next hop set to the Azure Firewall's private IP address (10.100.1.410.100.1.4) as a Virtual Appliance.
This redirects all default traffic (internet) to the firewall for security inspection.
2
Determine the routing mechanism for on-premises traffic.
Ensure gateway route propagation is enabled on the route table.
This allows the spoke subnets to dynamically learn the 172.16.0.0/12172.16.0.0/12 route from the hub's ExpressRoute gateway, minimizing administrative overhead and avoiding static route configuration.
3
Verify inter-subnet routing behavior within the spoke VNet.
Ensure no UDR exists for 10.101.0.0/1610.101.0.0/16 pointing to the hub.
This allows the default system route for local traffic to handle communication between `snet-web` and `snet-db` directly within the VNet, preventing traffic from traversing the hub.

Anahtar Kavram

Azure Virtual Network routing priorities, specifically how Longest Prefix Match (LPM) dictates that dynamically learned BGP routes from a Virtual Network Gateway take precedence over user-defined default routes (0.0.0.0/00.0.0.0/0), and how UDRs for a local VNet prefix override default system local routing between subnets.
Soru 232Soru →

A logistics company is designing a serverless infrastructure solution for two application workloads:

* A REST API for package tracking that must scale out rapidly to handle sudden spikes in traffic, integrate with an Azure Virtual Network (VNet), and avoid cold-start latency.
* An event-driven invoice processing job that extracts metadata from uploaded documents using OCR. This job can take up to 20 minutes to complete.

You need to recommend the compute services that satisfy these requirements while minimizing operational overhead.

Which two Azure compute solutions should you recommend? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure Functions on the Premium plan for the REST API; Azure Container Apps Jobs for the invoice processing job

Cevap

Azure Functions on the Premium plan for the REST API and Azure Container Apps Jobs for the invoice processing job.
The REST API requires rapid scaling, VNet integration, and no cold starts, which are all key features provided by the Azure Functions Premium plan. The invoice processing job runs for up to 20 minutes, which exceeds the timeout limits of the Consumption plan. Azure Container Apps Jobs is the ideal serverless choice for this run-to-completion, event-driven task, as it supports execution runtimes of up to several hours without VM management overhead.

Adım Adım Çözüm

1
Analyze the requirements for the REST API component, including virtual network integration, rapid scaling, and cold-start avoidance.
Identify that Azure Functions Premium plan supports pre-warmed instances to avoid cold starts and provides VNet integration.
This meets all requirements for the API while keeping operational overhead low.
2
Evaluate the execution duration constraints for the event-driven invoice processing job.
Identify that the job runs up to 20 minutes, which exceeds the 10-minute maximum limit of Azure Functions on a Consumption plan.
A plan or service supporting longer runtimes, such as Azure Container Apps Jobs, is required to prevent timeout failures.
3
Minimize administrative overhead by selecting serverless options over fully managed Kubernetes clusters.
Determine that AKS is overly complex for these workloads, whereas Azure Functions Premium and Azure Container Apps Jobs are serverless and low-maintenance.
Designing for low operational overhead is a core requirement of the scenario.

Anahtar Kavram

Selecting appropriate serverless hosting plans based on execution limits, virtual network integration, latency profiles, and operational complexity.
Soru 233Soru →

An enterprise is designing a secure hybrid network topology in Azure. The design includes a hub virtual network named `vnet-hub-prod` (10.50.0.0/1610.50.0.0/16) that contains an Azure VPN Gateway connected to an on-premises datacenter. A spoke virtual network named `vnet-spoke-app` (10.60.0.0/1610.60.0.0/16) is peered with `vnet-hub-prod`. The spoke network contains a subnet named `subnet-app` (10.60.1.0/2410.60.1.0/24).

The enterprise requires that all outbound internet traffic from `subnet-app` is redirected to the on-premises datacenter for security inspection. Resources within `vnet-spoke-app` must retain the ability to communicate directly with each other.

Which three configuration steps should you recommend to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: On the virtual network peering from vnet-hub-prod to vnet-spoke-app, enable the Allow gateway transit option.; On the virtual network peering from vnet-spoke-app to vnet-hub-prod, enable the Use the remote virtual network's gateway or Route Server option.; Associate a route table with subnet-app that contains a route for 0.0.0.0/00.0.0.0/0 with a next hop type of Virtual network gateway.

Cevap

To meet the requirements, you must enable Allow gateway transit on the peering link from the hub, enable Use the remote virtual network's gateway or Route Server on the peering link from the spoke, and associate a route table with the spoke subnet containing a route for 0.0.0.0/00.0.0.0/0 with a next hop type of Virtual network gateway.
To route spoke traffic through a hub gateway, the hub-side peering must have 'Allow gateway transit' enabled, and the spoke-side peering must have 'Use the remote virtual network's gateway or Route Server' enabled. Additionally, to force all internet-bound traffic to on-premises via this gateway, a default route (0.0.0.0/00.0.0.0/0) must be defined in a route table associated with the spoke subnet, with the next hop set to the Virtual network gateway.

Adım Adım Çözüm

1
Enable gateway transit on the hub virtual network peering.
Allows the hub virtual network's VPN gateway to be shared with the peered spoke virtual network.
By default, virtual network peering is non-transitive. Enabling gateway transit allows peered spokes to route traffic through the hub's gateway.
2
Configure the spoke virtual network peering to use the remote gateway.
Permits the spoke virtual network to send and receive traffic via the peered hub's gateway.
This configuration establishes the link necessary for spoke resources to forward traffic to the hub's gateway.
3
Create and associate a route table with the spoke subnet featuring a default route pointing to the gateway.
Forces all outbound internet traffic (0.0.0.0/00.0.0.0/0) to be directed to the VPN gateway (which forwards it to on-premises) while preserving local virtual network routing.
A user-defined route for 0.0.0.0/00.0.0.0/0 with next hop type Virtual network gateway overrides the default Azure system route that sends internet traffic directly to the public internet, satisfying the forced tunneling requirement.

Anahtar Kavram

Forced tunneling and gateway transit in virtual network peering
Soru 234Soru →

An organization is designing a secure network environment for a microservices application hosted on Azure Virtual Machine Scale Sets in a dedicated subnet. The application must connect to an Azure Key Vault and an Azure Storage account. Corporate security policy requires restricting outbound traffic to the internet, and the design must minimize administrative effort to maintain security rules as Azure services evolve. Which two actions should you include in the network security design? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an outbound security rule in the Network Security Group (NSG) associated with the subnet that allows traffic to the AzureKeyVault service tag.; Configure an outbound security rule in the Network Security Group (NSG) associated with the subnet that allows traffic to the Storage service tag.

Cevap

Configure outbound security rules in the Network Security Group (NSG) associated with the subnet that allow traffic to the AzureKeyVault and Storage service tags.
The correct configurations involve using Network Security Group (NSG) outbound rules with the AzureKeyVault and Storage service tags. Service tags represent groups of IP address prefixes from Azure services, which Microsoft manages automatically. This satisfies the security requirement to restrict outbound traffic while meeting the constraint to minimize administrative effort, as you do not need to manually track or update IP ranges.

Adım Adım Çözüm

1
Identify the target services requiring connection security controls.
The application must establish outbound connections to Azure Key Vault and Azure Storage.
Determines the destination service endpoints that must be defined in the network security rules.
2
Evaluate the rule management overhead constraint.
Determine that Service Tags are the optimal choice to represent IP groups for Azure services since Microsoft manages their updates automatically.
Satisfies the design constraint to minimize administrative effort as Azure IP addresses change.
3
Formulate the correct NSG rules using the appropriate service tags.
Select AzureKeyVault and Storage service tags for the outbound rules.
Allows traffic directly to the target services safely while blocking other unauthorized outbound internet traffic.

Anahtar Kavram

Azure Service Tags simplify network security group management by representing groups of IP address prefixes from specific Azure services managed by Microsoft.
Tahmini Süre:2m 0s
Soru 235Soru →

An organization is designing a serverless solution for a new application that processes user-uploaded medical images. The solution contains two workloads:

1. An API frontend that receives image upload events and metadata. This API experiences highly volatile traffic patterns with long periods of idle time and must scale to zero to minimize hosting costs.
2. A background worker that performs computational analysis on the uploaded images. Each analysis task takes approximately 15 minutes to complete.

You need to select the compute resources that minimize operational overhead and hosting costs while ensuring that all processing tasks complete successfully.

Which two Azure hosting options should you recommend? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure Functions on a Consumption plan to host the API frontend; Azure Container Apps Jobs to run the background worker

Cevap

Azure Functions on a Consumption plan to host the API frontend, and Azure Container Apps Jobs to run the background worker
Azure Functions on a Consumption plan is ideal for the API frontend because it scales dynamically to zero during idle periods, handles volatile traffic efficiently, and minimizes hosting costs. Azure Container Apps Jobs are suitable for the background worker because they can execute tasks that run for longer than 10 minutes (such as the 15-minute image analysis) while scaling to zero when no jobs are active, thus minimizing cost and administrative overhead.

Adım Adım Çözüm

1
Analyze the API frontend requirements.
The API frontend has highly volatile traffic, must scale to zero to minimize costs during idle periods, and processes lightweight requests (HTTP trigger). Azure Functions on a Consumption plan matches these needs perfectly and minimizes management overhead.
Understanding workload patterns helps identify the most cost-effective scaling model.
2
Analyze the background worker requirements and execution duration constraints.
The worker processes computational tasks taking 15 minutes. Azure Functions Consumption plan has a 10-minute maximum timeout limit and is unsuitable. Azure Container Apps Jobs allow containerized tasks to run to completion without strict execution duration limits and support event-driven scaling to zero.
Evaluating runtime duration limits prevents application failure due to platform timeouts.
3
Evaluate operational overhead and complexity constraints.
Using Azure Kubernetes Service (AKS) would introduce excessive administrative overhead, setup complexity, and ongoing maintenance duties, which fails the requirement to minimize operational overhead.
Comparing management overhead ensures the simplest serverless solution is chosen.

Anahtar Kavram

Selecting appropriate serverless hosting options based on execution limits, scaling needs, and operational overhead.
Soru 236Soru →

A financial services company is designing a serverless solution to process end-of-day transaction reconciliation files. The reconciliation process runs once daily, parses large files containing transaction records, validates the data, and writes the results to a database. The process typically takes 25 minutes to complete. The company wants to minimize administrative overhead and ensure they only pay for compute resources while the process is running. Which hosting solution should you recommend?

Cevabı ve açıklamayı göster

Cevap: Azure Container Apps Jobs

Cevap

Azure Container Apps Jobs
Azure Container Apps Jobs is the ideal solution because it is designed for run-to-completion, serverless batch tasks. It supports execution times beyond the 10-minute limit of the Azure Functions Consumption plan, automatically scales to zero when not running to ensure costs are only incurred during execution, and operates with minimal administrative overhead.

Adım Adım Çözüm

1
Analyze the execution duration requirement of the reconciliation process.
The process takes 25 minutes to run.
Azure Functions on a Consumption plan has a strict maximum execution limit of 10 minutes, making it unsuitable for tasks exceeding this threshold.
2
Evaluate the requirement for administrative overhead and cost efficiency.
The solution must minimize administrative overhead and charge only for active execution time.
Hosting options like Azure Kubernetes Service (AKS) require managing cluster control planes and upgrades, which increases operational complexity. Furthermore, standard virtual machines incur ongoing costs even when idle.
3
Compare the remaining options against the requirements.
Azure Container Apps Jobs is selected.
Azure Container Apps Jobs is designed for run-to-completion batch tasks, supports execution times extending to multiple hours, scales to zero when not running, and operates as a fully managed serverless platform with minimal administrative overhead.

Anahtar Kavram

Designing serverless hosting solutions for long-running batch workloads while minimizing cost and administrative overhead.
Tahmini Süre:1m 30s
Soru 237Soru →

An enterprise is implementing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-prod-hub` (10.10.0.0/1610.10.0.0/16), hosts a firewall at 10.10.1.410.10.1.4. The spoke virtual network, `vnet-prod-spoke` (10.20.0.0/1610.20.0.0/16), contains two subnets named `subnet-web` (10.20.1.0/2410.20.1.0/24) and `subnet-app` (10.20.2.0/2410.20.2.0/24). To inspect traffic between the two spoke subnets, an administrator creates a route table and associates it with both subnets in `vnet-prod-spoke`. The route table contains a user-defined route (UDR) with the address prefix 10.20.0.0/1610.20.0.0/16 and a next hop of the firewall at 10.10.1.410.10.1.4. After this change, virtual machines within `subnet-web` can no longer communicate with each other, nor with virtual machines in `subnet-app`. Which of the following describes the cause of this connectivity failure?

Cevabı ve açıklamayı göster

Cevap: The user-defined route for the spoke address space overrides the default system route for the local virtual network, causing all local traffic to be forwarded to the firewall.

Cevap

The user-defined route for the spoke address space overrides the default system route for the local virtual network, causing all local traffic to be forwarded to the firewall.
The correct answer is correct because Azure route selection prioritizes user-defined routes (UDRs) over default system routes when the prefixes are identical. By configuring a UDR with the prefix 10.20.0.0/1610.20.0.0/16 (which matches the spoke VNet address space) and setting the next hop to the firewall, all traffic within the VNet (including intra-subnet traffic) is forwarded to the firewall. Since the firewall is not designed to receive, process, and return traffic destined for the same local subnet without complex configurations, internal communication breaks.

Adım Adım Çözüm

1
Analyze the user-defined route prefix configured in the route table.
The route table has a route for 10.20.0.0/1610.20.0.0/16 pointing to the firewall at 10.10.1.410.10.1.4.
To identify the destination and next hop of the user-defined route.
2
Compare the route prefix with the local virtual network address space.
The prefix matches the address space of `vnet-prod-spoke` (10.20.0.0/1610.20.0.0/16) exactly.
To determine how the route interacts with the default local system route.
3
Apply Azure routing precedence rules.
UDRs take precedence over default system routes. The route to 10.20.0.0/1610.20.0.0/16 via the firewall overrides the default 'Vnet' route.
To identify why intra-subnet and inter-subnet traffic within the spoke is diverted to the firewall, causing communication to break.

Anahtar Kavram

User-defined route overrides for local virtual network traffic
Soru 238Soru →

A digital publishing company is migrating its content management and rendering platforms to Azure. The system requires two compute tiers:

1. Editorial Backend: A stateful web application that runs continuously, requires a 99.99%99.99\% availability SLA, and must be isolated on dedicated physical hardware due to compliance requirements.
2. Rendering Workers: A stateless batch video-rendering workload that can tolerate interruptions and must run at the absolute lowest cost.

Which compute virtualization solution should you recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Azure Dedicated Hosts deployed across multiple Availability Zones for the Editorial Backend, and Azure Virtual Machine Scale Sets using Spot Virtual Machines for the Rendering Workers.

Cevap

Azure Dedicated Hosts deployed across multiple Availability Zones for the Editorial Backend, and Azure Virtual Machine Scale Sets using Spot Virtual Machines for the Rendering Workers.
The correct option configuration uses Azure Dedicated Hosts deployed across multiple Availability Zones for the Editorial Backend and Azure Virtual Machine Scale Sets using Spot VMs for the Rendering Workers. Dedicated Hosts satisfy the regulatory requirement for physical isolation. Spreading them across multiple zones ensures that the virtual machines can meet the 99.99%99.99\% availability SLA. Using Spot VMs in a Virtual Machine Scale Set satisfies the requirement for running the stateless, interruptible batch video-rendering workload at the lowest possible cost.

Adım Adım Çözüm

1
Analyze the Editorial Backend requirements: continuous execution, 99.99%99.99\% availability SLA, and dedicated physical hardware isolation.
Identify that Azure Dedicated Hosts are required for physical isolation, and they must be deployed across multiple Availability Zones to meet the 99.99%99.99\% SLA.
Dedicated Hosts provide single-tenant physical servers, and multi-zone deployment ensures high availability against datacenter outages.
2
Analyze the Rendering Workers requirements: stateless batch video-rendering, interruptible, and lowest possible cost.
Identify that Azure Virtual Machine Scale Sets using Spot VMs are the most suitable and cost-effective option.
Spot VMs offer significant discounts by utilizing unused Azure capacity, which matches the fault-tolerant and stateless nature of batch rendering.
3
Evaluate the combined choices to select the correct configuration.
Select the option specifying Dedicated Hosts across multiple zones for the Editorial Backend and Virtual Machine Scale Sets with Spot VMs for the Rendering Workers.
This is the only option that satisfies all technical, compliance, SLA, and cost constraints.

Anahtar Kavram

Selecting and configuring Azure compute virtualization solutions based on availability, isolation, and cost requirements.
Soru 239Soru →

An enterprise architecture team is implementing a hub-and-spoke virtual network topology in Azure for a secure payment application. The hub virtual network hosts an Azure Firewall with the private IP address 10.0.0.410.0.0.4. A spoke virtual network named `VNet1` contains two subnets:

* `Subnet1` (10.1.1.0/2410.1.1.0/24): Contains Azure Virtual Machines hosting the payment application.
* `Subnet2` (10.1.2.0/2410.1.2.0/24): Contains a Private Endpoint (IP address 10.1.2.410.1.2.4) for a secure Azure SQL Database.

You must ensure that all traffic from the Virtual Machines in `Subnet1` to the SQL Database Private Endpoint in `Subnet2` is inspected by the Azure Firewall. The design must also enforce network security group (NSG) rules on both subnets.

Which two actions should you perform? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable private endpoint network policies for route tables and network security groups on Subnet2.; Associate a route table to Subnet1 containing a route to the private endpoint IP address, and associate a route table to Subnet2 containing a route to Subnet1, with both route tables pointing to the Azure Firewall as the next hop.

Cevap

Enable private endpoint network policies on the subnet hosting the private endpoint (Subnet2), and configure route tables on both Subnet1 (destination private endpoint IP via the firewall) and Subnet2 (destination Subnet1 IP via the firewall) to ensure symmetric traffic inspection.
To force traffic destined for the private endpoint through Azure Firewall, we must configure a user-defined route (UDR) on the source subnet (Subnet1) pointing to the firewall. However, because Azure Firewall is stateful, the return traffic from the private endpoint back to the VMs must also go through the firewall. This requires a corresponding UDR on the destination subnet (Subnet2) pointing to the firewall. For this UDR and any NSG rules to be active and applied to the private endpoint network interface, we must enable private endpoint network policies on the subnet hosting the private endpoint (Subnet2).

Adım Adım Çözüm

1
Enable network policies for private endpoints on Subnet2.
Allows User-Defined Routes (UDRs) and Network Security Groups (NSGs) to be evaluated and applied to traffic going to or coming from the private endpoint.
By default, system routes override custom routes for private endpoints, and network policies are disabled on subnets containing private endpoints, which bypasses custom routing and NSG rules.
2
Configure routing from the application VMs to the private endpoint.
Associate a route table with Subnet1 containing a route for the private endpoint IP address (10.1.2.4/3210.1.2.4/32) with the next hop set to the Azure Firewall (10.0.0.410.0.0.4).
This configuration overrides the default virtual network routing for traffic bound for the private endpoint, sending it to the firewall for security inspection.
3
Configure routing for return traffic from the private endpoint.
Associate a route table with Subnet2 containing a route for Subnet1 (10.1.1.0/2410.1.1.0/24) with the next hop set to the Azure Firewall (10.0.0.410.0.0.4).
Since the firewall is a stateful device, the return traffic must pass back through the same firewall instance. Without this route, return traffic would take the default direct local virtual network route back to Subnet1, resulting in asymmetric routing and connection drop.

Anahtar Kavram

Enforcing security inspection and NSG rules on Private Endpoints in Azure requires enabling private endpoint network policies on the hosting subnet, and configuring symmetric user-defined routes on both the source and destination subnets.

Alternatif Yöntem

Instead of using Azure Firewall for inspection, you could use a third-party Network Virtual Appliance (NVA) deployed in the hub virtual network, which would require the same UDR and private endpoint network policy configurations on the subnets.
Tahmini Süre:3m 0s
Soru 240Soru →

Solaris Energy operates a distributed workload on Azure Virtual Machines within a subnet named BackendSubnet. The application running on these virtual machines must securely connect to Azure Key Vault to retrieve database credentials and certificate keys. The network team must implement a security design that restricts outbound traffic from the virtual machines to ONLY Azure Key Vault, blocking all other internet-bound traffic. Which network security configuration should you recommend to meet these requirements with the least administrative effort?

Cevabı ve açıklamayı göster

Cevap: Configure an outbound security rule in a Network Security Group (NSG) associated with the subnet, setting the destination to the AzureKeyVault service tag with an Allow action, followed by a lower-priority rule blocking outbound traffic to the Internet.

Cevap

Configure an outbound security rule in a Network Security Group (NSG) associated with the subnet, setting the destination to the AzureKeyVault service tag with an Allow action, followed by a lower-priority rule blocking outbound traffic to the Internet.
Using the AzureKeyVault service tag as the destination in an NSG outbound rule allows the network security group to dynamically manage the underlying IP addresses for the service. This, combined with a rule to deny outbound traffic to the Internet, satisfies the security constraint with minimal administrative overhead.

Adım Adım Çözüm

1
Identify the destination service that needs to be reached securely (Azure Key Vault).
Confirming the destination allows selection of the appropriate Service Tag.
Using Service Tags is the standard recommended method to specify destination categories instead of individual IP addresses.
2
Add an outbound NSG security rule allowing traffic to the service tag.
Created a rule with destination set to AzureKeyVault and action set to Allow.
This permits legitimate outbound traffic to all Azure Key Vault endpoints in the region.
3
Add a lower-priority rule blocking outbound traffic to the Internet destination.
Created a deny rule with destination set to Internet.
This blocks all other outbound internet traffic while allowing the higher-priority Key Vault rule to function.

Anahtar Kavram

Using Network Security Group Service Tags to simplify and maintain outbound access control to Azure services without managing individual IP addresses.
ÖncekiSayfa 12 / 18Sonraki
Design Infrastructure Solutions Alıştırma Soruları — Microsoft Azure Solutions Architect (AZ-305) — Sayfa 12 | Examkin