AZ-700 Exam - Question 235

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure subscription that contains the following resources:

✑ A virtual network named Vnet1

✑ A subnet named Subnet1 in Vnet1

✑ A virtual machine named VM1 that connects to Subnet1

✑ Three storage accounts named storage1, storage2, and storage3

You need to ensure that VM1 can access storage1. VM1 must be prevented from accessing any other storage accounts.

Solution: You create a network security group (NSG) and associate the NSG to Subnet1.

Does this meet the goal?

Examice · Accepted Answer

Simply creating a network security group (NSG) and associating it to Subnet1 does not meet the goal. To ensure VM1 can access only storage1 while being prevented from accessing storage2 and storage3, you need to configure specific rules within the NSG. The NSG must explicitly allow outbound traffic to storage1 and deny outbound traffic to the other two storage accounts. Therefore, additional configuration beyond just creating and associating an NSG is required to meet the stated goal.

derrrp · Answer

Assuming the NSG does not magically know what you're trying to do, we can assume the answer is no.

tartarus23 · Answer

B. No

I do not think it meets the goal since the NSG was not specific on what account or access it allowed or denied.

hogemax · Answer

B. No
This just creates a network security group and associates it to Subnet1. Further configuration is required.

BenH · Answer

I think this will meet the goal.

omgMerrick · Answer

B. No

This solution does not fully meet the goal.

Although creating a network security group (NSG) and associating it to Subnet1 is a step in the right direction for securing network traffic, simply associating an NSG to a subnet does not restrict outbound traffic from VM1 to the storage accounts.

To ensure that VM1 can access storage1 and is prevented from accessing any other storage accounts, you need to apply a specific set of rules to the NSG. One way to achieve this is by configuring the NSG to allow outbound traffic only to storage1 and deny outbound traffic to all other storage accounts.

So, to fully meet the goal, you need to create an NSG, associate it to Subnet1, and then configure appropriate rules in the NSG to allow traffic from VM1 to storage1 and block traffic to all other storage accounts.

Swetareddy · Answer

It happens only thru service endpoint policies  using which u can restrict access to only one storage account.

jeffangel28 · Answer

Correct!, is not only create and associate NSG necessary!

Jamesat · Answer

A NSG would do nothing without Rules.

Also if the Storage Accounts are public then you would need to set a Service Endpoint and then block it. This would affect all the storage accounts.

Without clarity this is cleared a NO.

azeem0077 · Answer

Just adding an NSG won't do any change. So answer is B. Incase if the question also said that outbound and inbound rules are there in the NSG, then the answer may have been A.

GohanF2 · Answer

it's too vague the solution so the answer is NO.

rac_sp · Answer

extremely abstract the information provided in the question.

Alessandro365 · Answer

No is correct

BlackZeros · Answer

default NSG will allow the traffic to still go out.

Prutser2 · Answer

it doesnt stipulate what is in the NSG, so assuming it is empty, in which case it will not do anything

AzureJobsTillRetire · Answer

Hey guys, I think the answer might be A yes. I had this question in my exam in a group of three YES/NO questions. I passed the exam with a score of 900, which is not very high but enough. I thought that there would be one YES in the three questions, and if that is true, this one is the only one could be YES. We can either assume the NSG does not configure well and give it a NO, or assume the NSG is configured as it should be and give it a YES.

unclegrandfather · Answer

Appeared on exam Jun/28/22

TJ001 · Answer

NSG wont help...we can define rules to deny/allow access to Storage service or a regional storage service by using service tags...but in this case the VM should access only one storage account... so NSG wont help here... Answer No

AZ-700 Exam - Question 235

Discussion