Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Microsoft AZ-700 Exam - Topic 2 Question 99 Discussion

You have an Azure virtual network named Vnet1.You need to ensure that the virtual machines in Vnet1 can access only the Azure SQL resources in the East US Azure region. The virtual machines must be prevented from accessing any Azure Storage resources.Which two outbound network security group (NSG) rules should you create? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point
B) a deny rule that has a source of IP address range of Vnet1 and destination of Storage service tag. and D) an allow rule that has a source of IP address range of Vnet1 and destination of Sql.EastUS service tag
A) a deny rule that has a source of Virtual Network service tag and a destination of Sql service tag
C) a deny rule that has a source of VirtualNetwork service tag and a destination of 168.63.129.0/24 IP Addresses

Microsoft AZ-700 Exam - Topic 2 Question 99 Discussion

Actual exam question for Microsoft's AZ-700 exam
Question #: 99
Topic #: 2
[All AZ-700 Questions]

You have an Azure virtual network named Vnet1.

You need to ensure that the virtual machines in Vnet1 can access only the Azure SQL resources in the East US Azure region. The virtual machines must be prevented from accessing any Azure Storage resources.

Which two outbound network security group (NSG) rules should you create? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point

Show Suggested Answer Hide Answer
Suggested Answer: B, D

by Carman at May 29, 2026, 12:47 AM

Limited Time Offer

25%

Off

Get Premium AZ-700 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Hyman
3 days ago
Wait, can we really block all Storage access like that?
upvoted 0 times
...
Emerson
8 days ago
I think option D is a must-have too.
upvoted 0 times
...
Jesusa
13 days ago
Definitely need that deny rule for Storage!
upvoted 0 times
...
Gretchen
18 days ago
I definitely recall that we need to allow SQL access while blocking storage, so I think D and B could be the right choices, but I’m not entirely confident.
upvoted 0 times
...
Tiera
23 days ago
I’m a bit confused about the service tags. Is the Virtual Network service tag in option A really necessary for denying SQL access?
upvoted 0 times
...
Lorriane
29 days ago
I remember practicing a similar question where we had to block access to certain services. I feel like option B makes sense for blocking storage access.
upvoted 0 times
...
Marla
1 month ago
I think we need to allow access to the SQL resources, so maybe option D is correct? But I'm not sure about the deny rules.
upvoted 0 times
...

Save Cancel