Exam AZ-301 topic 6 question 24 discussion

Seems the answer is correct "You use a virtual network to extend an on-premises IT environment into the cloud" .

I still believed NIC and the NSG are the closest answer. You can create NSG restriction on the subnet or specific NIC. Hence this is for 2 x VM and its defense from external access. NIC and NSG still the best answer.

C and D is correct

C. Azure ExpressRoute D. Network Security Groups (NSG)

I choose AD

You can use Azure ExpressRoute to create a dedicate and private connection between the on-premise network and the Azure virtual network. This will ensure data on the virtual machines is only available to workloads that run in the on-premise network. They can also use Network Security Groups either on the Azure Virtual Machine Network Interface Card or the subnet to restrict traffic flow to the Internet.

Answers are correct NSG I think we all agree can set a rule to block outbound traffic. For the other debated answer ... - NIC (The VM must have a NIC seems irrelevant to me, an indeed no one has really touted it as a possible answer) -SNAT my understanding of SNAT or PAT is that it is used to re-write the IP address and port tuple of a private IP and outbound port number to a public IP and port tuple, with the purpose of allowing multiple devices communicate out a single public IP. Doesn't really seem like what they are after ExpressRoute will mean the traffic of the VM's is directed across express route connection (via the BGP advertised routes) to your on premise firewall. I believe they are looking for you to understand you can create a similar restriction as per with the NSG on your on premise firewall, blocking the outbound flow (just a hunch that this is what MS are intending here)

I'm wondering if the question may have been misspelled and should read "You need to ensure that the VMs cannot accessed from the Internet", in this case ExpressRoute and NSGs make sense

C and D should be correct.. Express Route for internal communication channels and NSG for permitting Internet access to those VMs

I strongly believe A&D because NIC, VNET, NSG are required for this use case and VNET is already available.

CD is correct. Please see link https://reticent.net.nz/prevent-internet-access-from-azure-virtual-machines/

"Internet access to those VMs is not permitted. You need to ensure that the VMs cannot access the Internet" For a NIC for private communications (AKA VPN) and a NSG to block inbound and outbound internet connectivity

Express route is not the right answer, SNAT still make some sense other than NSG https://docs.microsoft.com/en-us/azure/virtual-network/nat-gateway-resource

I think that the question is which two options should you recommend to prevent VMs from accessing the Internet. So for me the answers are: B. Source Network Address Translation (SNAT) D. Network Security Groups (NSG)

Why ExpressRoute?