Security at Relecloud requires that the Machine Learning workspace be unreachable from the public internet, that managed training compute have no public IP address, and that jobs reach only the company's own storage account and container registry. Which two actions should you take? Each correct answer presents part of the solution.
Choose 2.
- A.
Enable the managed virtual network in allow-only-approved-outbound mode, add private endpoint outbound rules for the storage account and container registry, and provision compute without a public IP address.
- B.
Apply a network security group to the workspace resource that denies all inbound traffic from the internet service tag.
- C.
Enable the managed virtual network in allow-internet-outbound mode and rely on storage account firewall rules.
- D.
Replace the workspace private endpoint with a service endpoint for Microsoft.MachineLearningServices on the subnet.
- E.
Create a private endpoint for the workspace and set public network access on the workspace to disabled.
- F.
Assign public IP addresses to the compute cluster nodes and restrict them with an Azure Firewall rule collection.
Show answer
Answer: A, E
Inbound isolation comes from a workspace private endpoint with public access disabled; outbound isolation comes from the managed virtual network in approved-outbound mode with private endpoint rules and no public IP compute.
- A. Approved-outbound managed network with private endpoint outbound rules limits job egress to the named resources, and no-public-IP compute removes the public address.
- B. Network security groups apply to subnets and network interfaces, not to a platform service such as a workspace, so this cannot be configured.
- C. Allow-internet-outbound permits general egress and a storage firewall does nothing about compute public IP addresses.
- D. A service endpoint keeps traffic on the backbone from a subnet but gives the workspace no private address and does not disable its public endpoint.
- E. A private endpoint plus disabled public network access is the supported way to make the workspace reachable only from the virtual network.
- F. Giving nodes public IP addresses contradicts the explicit requirement that managed compute have none.