Microsoft Certified: Azure Solutions Architect ExpertDesign identity, governance, and monitoring solutionsHard
An educational institution is hosting a research portal on Azure. They need to ensure that specific virtual machines (VMs) are only accessible from within their campus network or via a dedicated VPN connection, and never directly from the public internet. The solution must also log all connection attempts. Which Azure networking and security feature set should be used?
- ANetwork Security Groups (NSGs) and Azure VPN Gateway
- BAzure Sentinel and Azure Security Center
- CAzure DDoS Protection and Azure Firewall
- DNetwork Security Groups (NSGs) and Azure Private Link
Show answer & explanationAnswer & explanation
Correct answer: A. Network Security Groups (NSGs) and Azure VPN Gateway
Network Security Groups (NSGs) allow you to filter network traffic to and from Azure resources in an Azure Virtual Network, enabling you to restrict VM access to specific IP ranges (like your campus network). An Azure VPN Gateway provides the secure connection for users outside the campus. NSG flow logs can then be sent to Log Analytics for auditing and logging all connection attempts.
Why the other options are wrong
- B. Azure Sentinel and Security Center are for security information and event management (SIEM) and posture management, not direct network access control.
- C. DDoS Protection guards against denial-of-service attacks, and Azure Firewall provides centralized network security, but NSGs are primary for VM-level access control.
- D. Azure Private Link creates private endpoints for Azure services, not for restricting direct public internet access to VMs or enabling VPN connectivity for users.
NSG + VPN Gateway
Network Security Groups (NSGs) control network traffic to Azure resources, while Azure VPN Gateway establishes secure, encrypted connections between on-premises networks and Azure virtual networks.
- NSGs filter traffic based on IP, port, protocol.
- VPN Gateway enables secure private connectivity.
- NSG Flow Logs can be enabled for auditing network traffic.
Memory trick: NSG + VPN: The bouncer and the secret tunnel.