Exam AZ-700 topic 3 question 41 discussion

Actual exam question from Microsoft's AZ-700

Question #: 41
Topic #: 3

You have an Azure subscription that contains the following resources:

• A virtual network named Vnet1
• Two subnets named subnet1 and AzureFirewallSubnet
• A public Azure Firewall named FW1
• A route table named RT1 that is associated to Subnet1
• A rule routing of 0.0.0.0/0 to FW1 in RT1

After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machines were activated.

You need to ensure that the virtual machines can be activated.

What should you do?

A. On FW1, configure a DNAT rule for port 1688
B. Deploy a NAT gateway.
C. Add an internet route to RT1 for the Azure Key Management Service (KMS).
D. To Subnet1, associate a network security group (NSG) that allows outbound access to port 1688.

Show Suggested Answer

Suggested Answer: C 🗳️

by makkelijkzat at July 6, 2023, 5:56 a.m.

Comments

Submit Cancel

a250fb0

2 months, 3 weeks ago

Selected Answer: C

Adding an internet route specifically for the Azure KMS server ensures that VMs can activate without exposing other traffic to the internet, meeting both functionality and security requirements efficiently

upvoted 1 times

...

Ditka

9 months, 3 weeks ago

Same question, different answer. The answer to Topic 3, Q24 states to add a rule to FW1 to allow outbound traffic to the Azure KMS. Both will accomplish the goal, but bypassing your FW should not be best practice. An "Internet" route sends the traffic directly to the Azure Internet service which is always accessible by default or with "Internet" routes.

upvoted 2 times

...

makkelijkzat

10 months, 1 week ago

Selected Answer: C

Same question, same answer...

upvoted 3 times

...

Exam AZ-700 All Questions

View all questions & answers for the AZ-700 exam

Exam AZ-700 topic 3 question 41 discussion

Comments

a250fb0

Ditka

makkelijkzat

SY0-701