A payments company runs self-hosted pipeline agents that must reach an Azure Key Vault and a private storage account without crossing the public internet. The security team also wants the agent subnet's inbound and outbound flows tightly restricted. What is the best design?
Show answer and explanation
Answer: C
Self-hosted agents can be deployed into a subnet of an Azure virtual network. Private endpoints give the vault and storage account private IP addresses inside that network, so the traffic stays on the Microsoft backbone rather than crossing the public internet. Network security group rules then limit which inbound and outbound flows the subnet may use. Public allowlisting still exposes the endpoints to the internet, and access policies govern permissions rather than network paths. Removing connectivity would stop the agents from reaching Azure DevOps at all.
Why the other options are wrong
- A. Static public addresses still route traffic over the public internet and widen the attack surface, which the scenario explicitly wants to avoid. Allowlisting an address does not keep the traffic off the public path.
- B. Unrestricted outbound access with only vault access policies leaves the network path open. Access policies control identity and permissions, not which routes or ports the agents may use.
- D. Agents need network connectivity to the Azure DevOps service to receive jobs and report results, so disabling connectivity breaks the pipeline. Physical media transfer is also unrelated to running automated builds.