Microsoft Certified Azure Network Engineer Associate · Free Practice Question Medium
Question 4
You are assigned to conduct a security review on a recently launched Azure application. This application is hosted on virtual machines in a virtual network called VNetApp01. The goal is to confirm that the application can only access Azure SQL resources in the East US Azure region. Which outbound rules for the network security group (NSG) must be in place to ensure the application has the correct access? Please select three options.
-
A
The source is VirtualNetwork, the destination is 0.0.0.0/0, and the rule denies access.
-
B
A deny rule with a source of 0.0.0.0/0 and a destination of 0.0.0.0/0.
-
C
A deny rule with the VNetApp01 IP address range as the source and 168.63.129.0/24 as the destination.
-
D
An allow rule with the source IP address range of VNetApp01 and the destination as Sql.EastUS.
Reveal correct answers
Correct answers: A, C, D
Explanation
The virtual network should not have access to the internet since it only needs access to the SQL resources. To reflect this requirement, a deny rule with a source of VirtualNetwork and a destination of 0.0.0.0/0 is necessary. Additionally, the network should not have access to other Azure resources, which are always located in IP address 168.63.129.0/24. Lastly, to ensure access to the appropriate SQL resources, an allow rule with the destination of Sql.EastUS and the source as the IP address range of VNetApp01 must be present.
If you want to learn more, go to:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
