DRAG DROP
-

Your on-premises network uses an IP address space of 10.0.0.0/20.

You have an Azure subscription that contains the resources shown in the following table.



The on-premises network is connected to HubVnet by using a Site-to-Site (S2S) VPN.

You deploy an Azure firewall named AZFW1 to HubVNet.

You need to ensure that AZFW/1 can inspect all the traffic between the on-premises network and SpokeVNet.

What should you do in RT1? To answer, drag the appropriate destination to the correct route. Each resource may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Correct Answer:

You purchase an Azure subscription. You plan to deploy resources shown in the following table to the subscription.



You need to create a NSG1 rule named Rule1 to meet the following requirements:

•Enable the search servers of App1 to establish outbound HTTP connections to internet services.
•Minimize administrative effort when new search servers are deployed.
•Use the principle of least privilege.

What should you select as the source for Rule1?

You have an Azure subscription that contains a virtual machine named VM1 and a network security group (NSG) named NSG1. NSG1 has the default rules configured. VM1 runs Windows Server 2022 and contains a single NIC named NIC1. NIC1 is associated with NSG1.

You need to prevent access to the Azure Instance Metadata Service (IMDS) REST API on VM1. The solution must minimize administrative effort.

What should you add to NSG1?

HOTSPOT
-

You have a firewall that is managed by using an Azure Firewall Premium policy named Policy1.

You need to configure Policy1 to block outbound traffic to the following locations:

•Malicious addresses identified by Microsoft.
•Social networking sites

The solution must minimize administrative effort.

What should you configure in Policy1 for each requirement? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Correct Answer:

You have an Azure subscription that contains the resources shown in the following table.



NSG1 is associated to the NIC of VM1 and contains the rules shown in the following table.



You collect NSG flow logs for five minutes for the following activities:

•Two RDP sessions from VM1 to VM2, each initiated from a different TCP port
•Three SSH sessions from VM2 to VM1, each initiated from a different TCP port

You analyze the logs by using Traffic Analytics in Azure Network Watcher.

How many aggregated flow entries will Traffic Analytics identify?