Discuss Microsoft AZ-700 Exam Topic 2 Question 99

You have an Azure virtual network named Vnet1.

You need to ensure that the virtual machines in Vnet1 can access only the Azure SQL resources in the East US Azure region. The virtual machines must be prevented from accessing any Azure Storage resources.

Which two outbound network security group (NSG) rules should you create? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point

Aa deny rule that has a source of Virtual Network service tag and a destination of Sql service tag

Ba deny rule that has a source of IP address range of Vnet1 and destination of Storage service tag.

Ca deny rule that has a source of VirtualNetwork service tag and a destination of 168.63.129.0/24 IP Addresses

Dan allow rule that has a source of IP address range of Vnet1 and destination of Sql.EastUS service tag

Suggested Answer: B, D

Get Premium AZ-700 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

17 comments · newest first

Rebecka 1 month ago

I think A and B are the best combo for this scenario.

Cassie 1 month ago

I’m leaning towards A and D. SQL access is vital for VMs.

Erinn 1 month ago

Right! A and B together ensure proper security.

Matilda 2 months ago

But if we allow SQL, we must deny Storage. A and B cover that.

Selma 2 months ago

I feel like D is necessary too. Allowing SQL access is a must.

Huey 2 months ago

Definitely A and B. It makes sense to restrict resources.

Luis 2 months ago

I agree, but option B is also important. We need to block Storage access.

Josphine 2 months ago

I think option A is crucial. Denying access to SQL is key.

Antione 3 months ago

A deny rule for Storage is spot on, no doubt!

Val 3 months ago

Seems right, but I’m not sure about the Sql service tag specifics.

Hyman 3 months ago

Wait, can we really block all Storage access like that?

Emerson 3 months ago

I think option D is a must-have too.

Jesusa 3 months ago

Definitely need that deny rule for Storage!

Gretchen 3 months ago

I definitely recall that we need to allow SQL access while blocking storage, so I think D and B could be the right choices, but I’m not entirely confident.

Tiera 4 months ago

I’m a bit confused about the service tags. Is the Virtual Network service tag in option A really necessary for denying SQL access?

Lorriane 4 months ago

I remember practicing a similar question where we had to block access to certain services. I feel like option B makes sense for blocking storage access.

Marla 4 months ago

I think we need to allow access to the SQL resources, so maybe option D is correct? But I'm not sure about the deny rules.

Microsoft AZ-700 Exam - Topic 2 Question 99 Discussion