AZ-500 Question 43
Select 2Your organization hosts a multi-tier application in Azure with a front-end subnet and a private subnet for application servers. You need to restrict inbound traffic to the front-end subnet so only specific trusted IP addresses can connect, and ensure all outbound traffic from the private subnet is inspected by an Azure Firewall. Which of the following design steps should you include in your plan?
- A
Associate a Network Security Group (NSG) with the front-end subnet to allow inbound connections only from the trusted IP addresses.
- B
Assign a public IP address directly to each application server in the private subnet to simplify Internet connectivity.
- C
Deploy Azure Firewall in a dedicated subnet and create a user-defined route to send all private subnet outbound traffic to the firewall for inspection.
- D
Allow inbound traffic from any source to the front-end subnet for easier connectivity and rely solely on application-level authentication.
Show answer and explanation
Correct answers: A, C
Explanation
To plan and implement secure virtual networks in Azure, it is crucial to use NSGs to limit inbound connections to trusted IP addresses and to route outbound traffic through Azure Firewall for inspection. Refer to the Microsoft documentation on 'Filter network traffic with network security groups' and 'Deploy and configure Azure Firewall' for best practices and detailed configuration steps.
- A. Correct.
Option 1: Correct. Associating an NSG with the front-end subnet and limiting inbound rules to specific trusted IP addresses reduces the attack surface by allowing only known traffic to reach the application.
- B. Incorrect.
Option 2: Incorrect. Assigning public IPs directly to application servers in the private subnet bypasses the isolation benefits of the private subnet and increases exposure to external threats.
- C. Correct.
Option 3: Correct. Placing Azure Firewall in a dedicated subnet and configuring a user-defined route (UDR) ensures all outbound traffic from the private subnet is forced through the firewall for inspection and control.
- D. Incorrect.
Option 4: Incorrect. Allowing inbound connections from any source to the front-end subnet defeats the purpose of restricting traffic to trusted IP addresses, leaving the environment open to potential attacks.