AZ-104 Question 215
Single answerYou have an Azure VM running a web application on port 443 within a single virtual network (VNet). All inbound connections must be restricted to a known list of external IP addresses, and you also need to securely allow traffic from your on-premises network via a site-to-site VPN. Which approach should you implement to meet these requirements with minimal complexity?
- A
Use a Network Security Group (NSG) to allow inbound traffic only from specified IP ranges and configure a VPN Gateway for site-to-site connectivity
- B
Deploy Azure Firewall with custom application rules to filter inbound traffic, and configure VNet peering to your on-premises environment
- C
Attach a public load balancer to the VM and limit inbound traffic using load balancer rules
- D
Enable Azure Bastion and configure multi-factor authentication (MFA) for all inbound requests
Show answer and explanation
Correct answer: A
Explanation
Combining a Network Security Group with strict inbound rules on port 443 and a site-to-site VPN gateway provides a straightforward way to secure external and on-premises traffic. NSGs regulate traffic down to allowed source IPs, and the VPN gateway enables protected connectivity from your on-premises network, meeting all stated requirements while keeping configuration complexity low.
- A. Correct.
An NSG can restrict inbound traffic to specific IP addresses and ports, and a VPN Gateway provides secure site-to-site connectivity to on-premises networks, fulfilling the requirements with minimal overhead.
- B. Incorrect.
Azure Firewall offers more advanced filtering but is not strictly necessary here if only traffic from specific IPs on port 443 is needed; additionally, VNet peering alone doesn’t cover secure on-premises connectivity.
- C. Incorrect.
A public load balancer can help manage inbound traffic, but you would still need NSG rules or additional configurations to restrict IP addresses properly, making this approach more complex.
- D. Incorrect.
Azure Bastion is designed for remote management via RDP or SSH within Azure, not for filtering web application traffic from specific IP addresses; MFA helps secure administrative access but doesn’t meet the scenario requirements.