Network performance and network security – Azure architecture (AZ-305, lesson 31)

What you learn in this lesson

Choose measures for network performance (Accelerated Networking, proximity placement groups, FastPath, placement) by requirement and name their limits

Choose a service endpoint or a private endpoint for access to PaaS services

Tell Azure Firewall, Web Application Firewall and DDoS Protection apart by tier and requirement

Write an ADR with a Bicep sketch for securing the data access of Nordlicht Reisen

Nordlicht Reisen GmbH, a fictional travel agency, wants the booking database and the file storage in Azure to be unreachable from the internet, wants the offices in Hamburg to reach them anyway, and wants the portal not to fail on the network in the summer wave (G-09). This lesson chooses what makes the network faster and what makes it more secure, and says which limit tips each choice.

Prior knowledge: AZ-104, lesson 4.3 sets up network security groups and application security groups; AZ-104, lesson 4.4 covers Azure Bastion, service endpoints and private endpoints with their name resolution. K4, lesson 4.7.2 shows the network decisions of the Kladde, and K3, lesson 3.3.4 covers Front Door and WAF in outline. None of that is repeated here. Lesson 6.2 chose the connection to the data center and the name resolution across it; lesson 6.1 chose outbound access and the topology; the distribution of incoming requests follows in lesson 6.4.

The requirement

All figures are assumptions of the exercise, not measured. G-01 to G-10 apply.

No.	Requirement	Type	Metric	Weight	Source
6.3-01	The database and the file storage in Azure are not reachable from the internet.	R	no public access	Must	Data protection
6.3-02	The offices in Hamburg reach both through the connection from lesson 6.2.	F	access without a public path	Must	Operations
6.3-03	Incoming web requests are checked for typical attacks.	Q	check before the server	Must	Data protection
6.3-04	The network services absorb overload attacks on public addresses.	Q	protection per public address	Should	Management
6.3-05	Outbound calls from the servers go only to twelve named destinations.	Q	filter by domain name; assumption	Should	Data protection
6.3-06	The response time between portal servers and the database server stays small.	Q	at most 2 ms on average; assumption	Should	Operations
6.3-07	Traffic between Hamburg and Azure and through the firewall reaches 2 Gbit/s at peak.	Q	2 Gbit/s; assumption	Should	Operations
6.3-08	Costs drop before operating comfort, not before security or availability.	K	ranking	Could	Management

This lesson belongs to course AZ-305

You will see the rest of this lesson and its video once you have bought the course. The goals above show what you learn here.

€129.00

incl. VAT, one-time payment

Access to all of the course's lessons with their exercises, solutions and videos on this site, for 24 months from the purchase. A self-study course: no tutoring, no exams or grading by us, and no certificate.

Withdraw from contract here