Microsoft AZ-104 Exam - Topic 4 Question 112 Discussion

Actual exam question for Microsoft's AZ-104 exam

Question #: 112
Topic #: 4

You have an Azure subscription that contains 10 virtual machines, a key vault named Vault 1, and a network security group (NSG) named NSG1. All the resources are deployed to the East US Azure region.

The virtual machines are protected by using NSG1. NSG1 is configured to block all outbound traffic to the internet.

You need to ensure that the virtual machines can access Vault1. The solution must use the principle of least privilege and minimize administrative effort.

What should you configure as the destination of the outbound security rule for NSG1?

Aa service tag

Ban application security group

Can IP address range

Show Suggested Answer

Suggested Answer: A

by Temeka at Dec 05, 2024, 03:48 PM

Limited Time Offer

25%

Off

Get Premium AZ-104 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Louvenia

3 months ago

Surprised this isn't more straightforward!

upvoted 0 times

...

Lon

3 months ago

Definitely need to use the least privilege principle here.

upvoted 0 times

...

Tish

3 months ago

Isn't it risky to allow outbound traffic at all?

upvoted 0 times

...

Royal

4 months ago

I think an application security group could work too.

upvoted 0 times

...

Toshia

4 months ago

A service tag is the way to go!

upvoted 0 times

...

Frederica

4 months ago

I feel like the service tag is the best option here since it aligns with least privilege and minimizes admin effort.

upvoted 0 times

...

Mollie

4 months ago

I practiced a similar question where we had to allow access to a key vault. I think using an IP address range might be too broad for this scenario.

upvoted 0 times

...

Deane

4 months ago

I'm not entirely sure, but I think application security groups could also work here. They allow for more granular control, right?

upvoted 0 times

...

Johnathon

5 months ago

I remember something about service tags being used for Azure resources. They might simplify the configuration for NSGs.

upvoted 0 times

...

I'm leaning towards C, an IP address range. That way, I can specifically allow access to the key vault's IP address and nothing else. Seems more secure than a broad service tag, even if it takes a bit more work to set up.

upvoted 0 times

...

Vince

5 months ago

Definitely option A for me. Service tags are the way to go - they're easy to set up and maintain, and they'll give the VMs access to the key vault without exposing the whole internet. Seems like the most efficient solution.

upvoted 0 times

...

Ivette

5 months ago

Hmm, I'm a bit confused on this one. I'm not sure if using a service tag is the best approach since the question mentions minimizing administrative effort. Maybe an application security group would be better?

upvoted 0 times

...

Alisha

5 months ago

I think the key here is to use the principle of least privilege, so I'd go with option A and use a service tag. That way, the VMs can access the key vault without needing to open up the whole internet.

upvoted 0 times

...

Ahmed

1 year ago

Guys, let's not overthink this. Just use a service tag and call it a day. It's the 'principle of least privilege', not the 'principle of maximum confusion'.

upvoted 0 times