AZ-104 Exam - Question 396

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups.

Another administrator plans to create several network security groups (NSGs) in the subscription.

You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks.

Solution: You assign a built-in policy definition to the subscription.

Does this meet the goal?

Examice · Accepted Answer

To ensure that any newly created network security group (NSG) automatically blocks TCP port 8080 between virtual networks, one would need a specific policy addressing this particular rule. Azure's built-in policy definitions might not cover this exact requirement. Therefore, creating a custom policy definition specifying the block on TCP port 8080 is necessary. Built-in policies cover more general scenarios and may not include every specific custom rule needed. Thus, simply assigning a built-in policy definition to the subscription is insufficient to meet the stated goal.

STH · Answer

there is no such built-in policy (yet), that is why we need a custom one

mlantonis · Answer

Correct Answer: B - No

You need to use a custom policy definition, because there is not a built-in policy.

Resource policy definition used by Azure Policy enables you to establish conventions for resources in your organization by describing when the policy is enforced and what effect to take. By defining conventions, you can control costs and more easily manage your resources.

Reference:

https://docs.microsoft.com/en-us/azure/azure-policy/policy-definition

https://docs.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies

oooMooo · Answer

You need to use a custom policy definition.

favela · Answer

Answer is B passed today score 900

majerly · Answer

Today in exam , is B

toniiv · Answer

Answer B. is correct. You need to create a custom policy

AubinBakana · Answer

I would have answered A here. Thank heavens I have spent time going through these. So there's no such a built-in role huh?! :)

janshal · Answer

again, when NSG  is created  the default NSG rule will NOT permit any traffic between 2 different VNETs So i think that the answer to All Q in this series is YES. unless you peer the networks or create VPN gateway between them, they will NOT be able to Talk to each other

ZUMY · Answer

Sorry ignore previous 
No is answer
when NSG is created the default NSG rule will NOT permit any traffic between 2 different VNETs . unless you peer the networks or create VPN gateway

ZUMY · Answer

No is correct!
when NSG is created the default NSG rule will NOT permit any traffic between 2 different VNETs So i think that the answer to All Q in this series is YES. unless you peer the networks or create VPN gateway

Lazylinux · Answer

I Luv Honey Because it is B

Nothing relates to the solution no such thing in NSG

EmnCours · Answer

there is no such built-in policy (yet), that is why we need a custom one

Adebowale · Answer

Hello STH, Well done for the clarification

EleChie · Answer

Correct Answer B: NO

We need to use a custom policy definition, because there is no such a built-in policy.

tashakori · Answer

No is right

blejzer2 · Answer

Today in exam , is B.

AZ-104 Exam - Question 396

Discussion