AZ-104 Question 197
Single answerYou have an Azure virtual network (VNet) with two subnets: SubnetA (hosting a web application) and SubnetB (hosting a database server). You want to restrict inbound traffic to the database server so that only traffic originating from SubnetA is allowed, while blocking any external (internet) access. Which Azure feature should you use to accomplish this?
- A
Configure a Network Security Group (NSG) on SubnetB to allow traffic from SubnetA and deny all other inbound traffic
- B
Create a Virtual Network Gateway to encrypt all traffic between SubnetA and SubnetB
- C
Enable a service endpoint on SubnetB to restrict connectivity from public networks
- D
Set up Azure Firewall to control inbound and outbound connectivity for the database
Show answer and explanation
Correct answer: A
Explanation
Network Security Groups are the most direct way to control traffic at the subnet or NIC level within a VNet. By configuring an NSG on SubnetB to only allow traffic from SubnetA and block outside connections, you can secure the database server without introducing unnecessary complexity.
- A. Correct.
Network Security Groups (NSGs) let you define inbound and outbound traffic rules at the subnet or NIC level. By creating appropriate allow rules for SubnetA and deny rules for internet traffic, you can restrict connectivity to the database server.
- B. Incorrect.
Virtual Network Gateways are commonly used for hybrid connectivity (e.g., site-to-site VPN), not for restricting traffic between subnets within the same VNet.
- C. Incorrect.
Service endpoints secure access to Azure services, but do not inherently limit inter-subnet traffic or block external access by themselves.
- D. Incorrect.
Azure Firewall provides advanced security and threat protection at the network level, but for simple subnet-level traffic filtering, an NSG is typically more straightforward and cost-effective.