Microsoft AZ-700 Exam - Topic 4 Question 77 Discussion

Actual exam question for Microsoft's AZ-700 exam

Question #: 77
Topic #: 4

You have an Azure subscription that contains a virtual machine named VM1 and a network security group (NSG) named NSG1. NSG1 has the default rules configured VM1 runs Windows Server and contains a single NIC named NIC1 NIC! is associated with NSG1.

You need to prevent access to the Azure Instance Metadata Service (IMDS) REST API on VM1 The solution must minimize administrative effort.

What should you add to NSG1?

Aan outbound rule that blocks traffic to an IP address

Ban outbound rule that blocks traffic to a service tag

Can inbound and outbound rule that blocks traffic to an application security group.

Dan inbound rule that blocks traffic to an IP address

Show Suggested Answer

Suggested Answer: A

Here are the steps and explanations for ensuring that requests for wwwjelecloud.com from any of your Azure virtual networks resolve to frontdoor1.azurefd.net:

To use a custom domain with your Azure Front Door, you need to create a CNAME record with your domain provider that points to the Front Door default frontend host.A CNAME record is a type of DNS record that maps a source domain name to a destination domain name1.

To create a CNAME record, you need to sign in to your domain registrar's website and go to the page for managing DNS settings1.

Create a CNAME record with the following information1:

Source domain name: wwwjelecloud.com

Destination domain name: frontdoor1.azurefd.net

Save your changes and wait for the DNS propagation to take effect1.

To verify the custom domain, you need to go to the Azure portal and select your Front Door profile.Then select Domains under Settings and select Add2.

On the Add a domain page, select Non-Azure validated domain as the Domain type and enter wwwjelecloud.com as the Domain name.Then select Add2.

On the Domains page, select wwwjelecloud.com and select Verify.This will check if the CNAME record is correctly configured2.

Once the domain is verified, you can associate it with your Front Door endpoint. On the Domains page, select wwwjelecloud.com and select Associate endpoint.Then select your Front Door endpoint from the drop-down list and select Associate2.

by Jodi at Dec 06, 2024, 04:20 PM

Limited Time Offer

25%

Off

Get Premium AZ-700 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Deeanna

5 months ago

C seems overkill for just blocking IMDS access.

upvoted 0 times

...

Tom

5 months ago

Wait, can you really block IMDS like that? Sounds tricky.

upvoted 0 times

...

Hester

6 months ago

I think A might work too, but it feels less efficient.

upvoted 0 times

...

Ashley

6 months ago

Definitely B, service tags are the way to go!

upvoted 0 times

...

Allene

6 months ago

You need to block access to the IMDS API.

upvoted 0 times

...

Percy

6 months ago

I’m a bit confused about whether I should focus on inbound or outbound rules here. I thought inbound rules were more about preventing access from outside, but this seems different.

upvoted 0 times

...

Rebbecca

6 months ago

I feel like we practiced a similar question where we had to block access to a specific service. I think an outbound rule is what we used then.

upvoted 0 times

...

Dallas

7 months ago

I'm not entirely sure, but I think using a service tag could simplify things. It might be a good option to minimize admin effort.

upvoted 0 times

...

Boris

7 months ago

I remember we discussed how the Azure Instance Metadata Service has a specific IP address, so blocking outbound traffic to that IP might be the way to go.

upvoted 0 times

...

Annette

7 months ago

I'm a little confused here. Wouldn't blocking traffic to an IP address or application security group be more specific and targeted than using a service tag? I'm not sure if that would be considered "minimizing administrative effort" compared to the other options.

upvoted 0 times

...

Lavonda

7 months ago

Okay, let me think this through. We need to prevent access to the IMDS REST API, and the question says the solution should minimize administrative effort. I'm thinking option B, the outbound rule blocking a service tag, might be the way to go. It seems like the most straightforward approach.

upvoted 0 times

...

Darrel

7 months ago

Hmm, I'm a bit unsure about this one. Blocking traffic to an IP address or application security group seems like it might require more manual configuration. I'm wondering if the service tag approach in option B could be the simplest solution.

upvoted 0 times

...

Adria

7 months ago

I think the key here is to block access to the IMDS REST API on VM1. Based on the question, the solution should minimize administrative effort, so I'm leaning towards option B - adding an outbound rule that blocks traffic to a service tag.

upvoted 0 times

...

Lashon

12 months ago

Forget all this networking stuff, I'm just going to use the IMDS API to order some tacos. What could go wrong?

upvoted 0 times

...

Margret

12 months ago

Ha! I bet the exam writers are trying to trip us up with these options. Let's see, B seems like the winner to me.

upvoted 0 times

Isaiah

11 months ago

User4: Let's go with B then. It seems like the most logical choice.

upvoted 0 times

...

Alonso

11 months ago

User3: I'm not so sure, but I'll go with B too.

upvoted 0 times

...

Jeanice

11 months ago

User2: Yeah, I agree. B sounds like the right choice.

upvoted 0 times

...

Chandra

11 months ago

User1: I think B is the best option.

upvoted 0 times

...

Corrina

12 months ago

This is a tricky one. I was considering C, but I'm not sure if adding both inbound and outbound rules is really necessary to achieve the desired outcome.

upvoted 0 times

Elke

10 months ago

User3: I'm not sure, but I think D is the right choice as well. Let's go with that.

upvoted 0 times

...

Shaun

10 months ago

User2: I agree with User1. D seems like the most straightforward solution.

upvoted 0 times

...

Carlene

11 months ago

User1: I think D is the correct option. Just block traffic to the IP address.

upvoted 0 times

...

Eden

12 months ago

I'm not sure about this one. Wouldn't an inbound rule that blocks traffic to an IP address (D) be a more targeted solution?

upvoted 0 times

Lonny

11 months ago

User1: Maybe we should consider both options and see which one works best for our scenario.

upvoted 0 times

...

Rebeca

11 months ago

User2: I disagree, I believe an inbound rule that blocks traffic to an IP address (D) would be more effective.

upvoted 0 times

...

Shalon

11 months ago

User1: I think an outbound rule that blocks traffic to an IP address (A) would be the best option.

upvoted 0 times

...

Felicitas

1 year ago

Hmm, I think B is the correct answer. Blocking traffic to the IMDS service tag seems like the most straightforward way to prevent access to the IMDS REST API.

upvoted 0 times