Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Microsoft AZ-700 Exam - Topic 4 Question 77 Discussion

You have an Azure subscription that contains a virtual machine named VM1 and a network security group (NSG) named NSG1. NSG1 has the default rules configured VM1 runs Windows Server and contains a single NIC named NIC1 NIC! is associated with NSG1.You need to prevent access to the Azure Instance Metadata Service (IMDS) REST API on VM1 The solution must minimize administrative effort.What should you add to NSG1?
A) an outbound rule that blocks traffic to an IP address
B) an outbound rule that blocks traffic to a service tag
C) an inbound and outbound rule that blocks traffic to an application security group.
D) an inbound rule that blocks traffic to an IP address

Microsoft AZ-700 Exam - Topic 4 Question 77 Discussion

Actual exam question for Microsoft's AZ-700 exam
Question #: 77
Topic #: 4
[All AZ-700 Questions]

You have an Azure subscription that contains a virtual machine named VM1 and a network security group (NSG) named NSG1. NSG1 has the default rules configured VM1 runs Windows Server and contains a single NIC named NIC1 NIC! is associated with NSG1.

You need to prevent access to the Azure Instance Metadata Service (IMDS) REST API on VM1 The solution must minimize administrative effort.

What should you add to NSG1?

Show Suggested Answer Hide Answer
Suggested Answer: A

Here are the steps and explanations for ensuring that requests for wwwjelecloud.com from any of your Azure virtual networks resolve to frontdoor1.azurefd.net:

To use a custom domain with your Azure Front Door, you need to create a CNAME record with your domain provider that points to the Front Door default frontend host.A CNAME record is a type of DNS record that maps a source domain name to a destination domain name1.

To create a CNAME record, you need to sign in to your domain registrar's website and go to the page for managing DNS settings1.

Create a CNAME record with the following information1:

Source domain name: wwwjelecloud.com

Destination domain name: frontdoor1.azurefd.net

Save your changes and wait for the DNS propagation to take effect1.

To verify the custom domain, you need to go to the Azure portal and select your Front Door profile.Then select Domains under Settings and select Add2.

On the Add a domain page, select Non-Azure validated domain as the Domain type and enter wwwjelecloud.com as the Domain name.Then select Add2.

On the Domains page, select wwwjelecloud.com and select Verify.This will check if the CNAME record is correctly configured2.

Once the domain is verified, you can associate it with your Front Door endpoint. On the Domains page, select wwwjelecloud.com and select Associate endpoint.Then select your Front Door endpoint from the drop-down list and select Associate2.


by Jodi at Dec 06, 2024, 04:20 PM

Limited Time Offer

25%

Off

Get Premium AZ-700 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Deeanna
8 months ago
C seems overkill for just blocking IMDS access.
upvoted 0 times
...
Tom
9 months ago
Wait, can you really block IMDS like that? Sounds tricky.
upvoted 0 times
...
Hester
9 months ago
I think A might work too, but it feels less efficient.
upvoted 0 times
...
Ashley
9 months ago
Definitely B, service tags are the way to go!
upvoted 0 times
...
Allene
9 months ago
You need to block access to the IMDS API.
upvoted 0 times
...
Percy
10 months ago
I’m a bit confused about whether I should focus on inbound or outbound rules here. I thought inbound rules were more about preventing access from outside, but this seems different.
upvoted 0 times
...
Rebbecca
10 months ago
I feel like we practiced a similar question where we had to block access to a specific service. I think an outbound rule is what we used then.
upvoted 0 times
...
Dallas
10 months ago
I'm not entirely sure, but I think using a service tag could simplify things. It might be a good option to minimize admin effort.
upvoted 0 times
...
Boris
10 months ago
I remember we discussed how the Azure Instance Metadata Service has a specific IP address, so blocking outbound traffic to that IP might be the way to go.
upvoted 0 times
...
Annette
10 months ago
I'm a little confused here. Wouldn't blocking traffic to an IP address or application security group be more specific and targeted than using a service tag? I'm not sure if that would be considered "minimizing administrative effort" compared to the other options.
upvoted 0 times
...
Lavonda
10 months ago
Okay, let me think this through. We need to prevent access to the IMDS REST API, and the question says the solution should minimize administrative effort. I'm thinking option B, the outbound rule blocking a service tag, might be the way to go. It seems like the most straightforward approach.
upvoted 0 times
...
Darrel
10 months ago
Hmm, I'm a bit unsure about this one. Blocking traffic to an IP address or application security group seems like it might require more manual configuration. I'm wondering if the service tag approach in option B could be the simplest solution.
upvoted 0 times
...
Adria
10 months ago
I think the key here is to block access to the IMDS REST API on VM1. Based on the question, the solution should minimize administrative effort, so I'm leaning towards option B - adding an outbound rule that blocks traffic to a service tag.
upvoted 0 times
...
Lashon
1 year ago
Forget all this networking stuff, I'm just going to use the IMDS API to order some tacos. What could go wrong?
upvoted 0 times
...
Margret
1 year ago
Ha! I bet the exam writers are trying to trip us up with these options. Let's see, B seems like the winner to me.
upvoted 0 times
Isaiah
1 year ago
User4: Let's go with B then. It seems like the most logical choice.
upvoted 0 times
...
Alonso
1 year ago
User3: I'm not so sure, but I'll go with B too.
upvoted 0 times
...
Jeanice
1 year ago
User2: Yeah, I agree. B sounds like the right choice.
upvoted 0 times
...
Chandra
1 year ago
User1: I think B is the best option.
upvoted 0 times
...
...
Corrina
1 year ago
This is a tricky one. I was considering C, but I'm not sure if adding both inbound and outbound rules is really necessary to achieve the desired outcome.
upvoted 0 times
Elke
1 year ago
User3: I'm not sure, but I think D is the right choice as well. Let's go with that.
upvoted 0 times
...
Shaun
1 year ago
User2: I agree with User1. D seems like the most straightforward solution.
upvoted 0 times
...
Carlene
1 year ago
User1: I think D is the correct option. Just block traffic to the IP address.
upvoted 0 times
...
...
Eden
1 year ago
I'm not sure about this one. Wouldn't an inbound rule that blocks traffic to an IP address (D) be a more targeted solution?
upvoted 0 times
Lonny
1 year ago
User1: Maybe we should consider both options and see which one works best for our scenario.
upvoted 0 times
...
Rebeca
1 year ago
User2: I disagree, I believe an inbound rule that blocks traffic to an IP address (D) would be more effective.
upvoted 0 times
...
Shalon
1 year ago
User1: I think an outbound rule that blocks traffic to an IP address (A) would be the best option.
upvoted 0 times
...
...
Felicitas
1 year ago
Hmm, I think B is the correct answer. Blocking traffic to the IMDS service tag seems like the most straightforward way to prevent access to the IMDS REST API.
upvoted 0 times
Ammie
1 year ago
User4: Let's go with option B then.
upvoted 0 times
...
Della
1 year ago
User3: That sounds like the most straightforward way to prevent access to the IMDS REST API.
upvoted 0 times
...
Alverta
1 year ago
User2: I agree, blocking traffic to the IMDS service tag makes sense.
upvoted 0 times
...
Tomas
1 year ago
User1: I think B is the correct answer.
upvoted 0 times
...
...
Noah
1 year ago
I'm not sure. Wouldn't it be better to add an inbound rule that blocks traffic to an IP address instead?
upvoted 0 times
...
Julie
1 year ago
I agree with Melodie. Blocking traffic to a specific IP address seems like the most straightforward solution.
upvoted 0 times
...
Melodie
1 year ago
I think we should add an outbound rule that blocks traffic to an IP address.
upvoted 0 times
...

Save Cancel