Microsoft AZ-700 - Designing and Implementing Microsoft Azure Networking Solutions

Here are the steps and explanations for ensuring that requests for wwwjelecloud.com from any of your Azure virtual networks resolve to frontdoor1.azurefd.net:

To use a custom domain with your Azure Front Door, you need to create a CNAME record with your domain provider that points to the Front Door default frontend host.  A CNAME record is a type of DNS record that maps a source domain name to a destination domain name 1 .

To create a CNAME r ecor d, you need to sign in to your domain registrar’s website and go to the page for managing DNS settings 1 .

Creat e a CNAME record with the followin g information 1 :

Source domain name: wwwjelecloud.com

Destination domain name: frontdoor1.azurefd.net

Save your changes and wait for the DNS propagation to take effect 1 .

To verify the custom domain, you need to go to the Azure portal and select your Front Door profile.  Then select Domains un der Settings and select Add 2 .

On the Add a domain page, select Non-Azure validated domain as the Domain type and enter wwwjeleclou d.com as the Domain name.  Then select Add 2 .

On the Domains page, select wwwjelecloud.com and select Verify.  This will check if the CNAME record is correctly configured 2 .

Once the domain is verified, you can associate it with your Front Door endpoint. On the Domains page, select wwwjelecloud.com and select Associate endpoint.  Then select your Front Door endpoint from the drop-down list and select Associa te 2 .

To configure a policy in Azure API Management that can be used by an Azure Application Gateway to protect against known web attack vectors and only allow requests from IP addresses in Canada, follow these steps:

Step-by-Step Solution

Step 1: Create or Access Your API Management Instance

Navigate to the Azure Portal .

Search for “ API Management services”  and select your API Management instance.

Step 2: Configure the Policy

In the API Management instance , go to the  “APIs”  section.

Select the API  you want to apply the policy to.

Go to the “Design” tab .

Select “All operations”  if you want to apply the policy to all operations, or select a specific operation.

Step 3: Add the Inbound Policy

In the Inbound processing section , click on  “+ Add policy” .

Select “IP filter”  from the list of policies.

Add the IP address ranges for Canada . You c an find the IP ranges for Canada from a reliable source or use a service that provides this information.

 

Here is an example of the XML configuration for the policy:

< inbound >

< ip-filter action= " allow " >

< address-range from= " 24.0.0.0 " to= " 24.255.255.255 " / >

< address-range from= " 47.0.0.0 " to= " 47.255.255.255 " / >

< !-- Add other Canadian IP ranges as needed -- >

< /ip-filter >

< ip-filter action= " deny " >

< address-range from= " 0.0.0.0 " to= " 255.255.255.255 " / >

< /ip-filter >

< /inbound >

Save the policy  to apply the changes.

Explanation

IP Filter Policy : This policy allows you to filter incoming requests based on their IP addresses. By specifying the IP ranges for Canada, you ensure that only requests originating from these IPs are allowed.

Inbound Processing : Applying the policy in the inbound section ensures that the requests are filtered before they reach your API.

By following these steps, you can configure a polic y in Azure API Management that res tricts a ccess to your API to only those requests ori ginating from IP ad dresses in Canada, thereby enhancing security and compliance

To create an Azure Firewall instance, you need to go to the Azure portal and select Create a resource. Type firewall in the search box and press Enter.  Sel ect Firewall and then select Create 1 .

To assign an IP address from the address range of 1 0.1.255.0/24 to the firewall, you need to select a public IP address that belongs to that range.  You can either create a new public IP address or use an existing one 1 .

To use a new Premium firewall policy named FW-policy1, you need to select Premium as the Firewall tier and c reate a new policy with the name FW-policy1 2 .  A Pre mium firewall pol icy allows you t o configure ad vanced features such as TLS Inspection, IDPS, URL Filtering, and Web Categories 3 .

To route traffic directly to the internet, you need to enable SNAT (Source Network Address Translation) for the firewall.  SNAT allows the firewall to use its pub lic IP address as the source address for out bound t raffic 4 .

To ensure that only hosts on VNET1 can access the slcnage42150372 storage account and that access occurs over the Azure backbone network, you can use  Azure Private Endpoints . This method secures the connection by assigning a private IP address from your virtual network to the storage account, ensuring that traffic does not traverse the public internet.

Step-by-Step Solution

Step 1: Create a Private Endpoint for the Storage Account

Navigate to the Azure Portal .

Search for “Storage accounts”  and select the slcnage42150372 storage account.

In the storage account blade , select  “Networking”  under the “Security + networking” section.

Under “Private endpoint connections” , click on  “Add private endpoint” .

Enter the following details :

Name : Enter a name for the private endpoint (e.g., PrivateEndpoint-VNET1).

Region : Select the same region as your virtual network (VNET1).

Click on “Next: Resource” .

Step 2: Configure the Resource

Select “Target sub-resource” : Choose the storage service you want to connect to (e.g., blob, file, queue, table).

Click on “Next: Virtual network” .

Step 3: Select the Virtual Network and Subnet

Select the virtual n etwork : Choose VNET1.

Select the subnet : Choose the appropriate subnet within VNET1.

Click on “Next: Configuration” .

Step 4: Configure DNS Integration (Optional)

Configure DNS settings  if needed to ensure proper name resolution within your virtual network.

Click on “Next: Tags” , add any tags if necessary, and then click on  “Review + create” .

Review your settings  and click on  “Create” .

Step 5: Restrict Public Network Access

Navigate back to the storage account .

Select “Networking”  under the “Security + networking” section.

Under “Firewalls and virtual networks” , select  “Selected networks” .

Ensure that only VNET1 is listed  under the virtual networks section.

Click on “Save” .

Explanation

Private Endpoints : These provide secure connectivity to Azure services by assigning a private IP address from your VNet to the service, ensuring that traffic stays wit hin the Azure backbone ne twork 1 2 .

Firewall and Virtual Networks : Configuring the storage account to allow access only from selected networks (VNET1) ensures that no other network can access the s torage account 3 .

By following these steps, you can ensure that only hosts on VNET1 can access the slcnage42150372 storage account, and that all access occurs over the secure Azure backbone network.