Microsoft Certified Azure Administrator Associate · Free Practice Question Medium
Question 18
You have an Azure subscription that contains 10 virtual machines, a key vault named Vault1, and a network security group (NSG) named NSG1. All the resources are deployed to the East US Azure region.
The virtual machines are protected by using NSG1. NSG1 is configured to block all outbound traffic to the internet.
You need to ensure that the virtual machines can access Vault1. The solution must use the principle of least privilege and minimize administrative effort
What should you configure as the destination of the outbound security rule for NSG1?
-
A
an application security group
-
B
an IP address range
-
C
a service tag
Reveal correct answer
Correct answer: C
C.
In order to ensure that the virtual machines can access Vault1 while also using the principle of least privilege and minimizing administrative effort, you should configure a service tag as the destination of the outbound security rule for NSG1. Service tags represent a group of IP addresses associated with Azure PaaS and SaaS services.
https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
