AZ-120 · Question #209
You have an existing SAP landscape on Azure. All SAP virtual machines are on the same virtual network. The SAP application servers, SAP management servers, and SAP database servers are each on their…
The correct answer is C. network security groups (NSGs). NSGs allow you to create rules that control inbound and outbound traffic at the subnet or network interface level in an Azure virtual network. By assigning an NSG to the database subnet, you can restrict access so that only the IP ranges or subnets of the application and…
Question
You have an existing SAP landscape on Azure. All SAP virtual machines are on the same virtual network. The SAP application servers, SAP management servers, and SAP database servers are each on their own subnet. You need to ensure that only the application and management servers can access the subnet to which the database servers connect. What should you configure?
Options
- AAzure AD service principals
- BAzure Key Vault secrets
- Cnetwork security groups (NSGs)
- DAzure Application Gateway and firewall rules
How the community answered
(36 responses)- A3% (1)
- C92% (33)
- D6% (2)
Explanation
NSGs allow you to create rules that control inbound and outbound traffic at the subnet or network interface level in an Azure virtual network. By assigning an NSG to the database subnet, you can restrict access so that only the IP ranges or subnets of the application and management servers are allowed to communicate with the database subnet. This approach enforces network segmentation and limits access to the database servers, enhancing security. Azure Application Gateway and firewall rules are more suitable for web traffic and perimeter security, not for controlling subnet-to-subnet access inside a virtual network. Azure AD service principals and Azure Key Vault secrets are related to identity and secrets management, not network access control.
Topics
Community Discussion
No community discussion yet for this question.