SC-100: Microsoft Cybersecurity ArchitectDemo

By Microsoft · Question Mode

QuestionQ332

Design security solutions for applications and data

You have an on-premises datacenter named Site1.

Your Azure subscription contains a virtual network named VNet1 and multiple Azure App Service apps. Site1 connects to VNet1 by using a Site-to-Site (P2S) VPN connection. The apps are accessed by public internet connections.

Recommend a solution that provides secure access to the apps and meets these requirements:

  • Servers on Site1 must use a VPN connection to access the apps.
  • Access to the apps must be restricted to specific Site1 servers.
  • VNet1 security administrators must be able to control which servers can access the apps.
  • Costs must be minimized.

What should you include in the recommendation?

Select
Provide access to the apps for the servers on Site1 by using:
Enable the security administrators to control access to the apps by using:
Explanation

A private endpoint gives an App Service app a private IP address in the virtual network. On-premises clients connected to that virtual network by VPN can access the app through Azure Private Link rather than its public endpoint. App Service access restrictions do not evaluate traffic that enters through a private endpoint; when private-endpoint network policies are enabled, an NSG on the private-endpoint subnet controls which source servers can reach it. NSGs avoid the additional cost of Azure Firewall or a WAF.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!