nerdexam
Microsoft

AZ-104 · Question #290

You have the Azure virtual network named VNet1 that contains a subnet named Subnet1. Subnet1 contains three Azure virtual machines. Each virtual machine has a public IP address. The virtual machines…

The correct answer is B. Create a deny rule in a network security group (NSG) that is linked to Subnet1. You can use a site-to-site VPN to connect your on-premises network to an Azure virtual network. Users on your on-premises network connect by using the RDP or SSH protocol over the site-to- site VPN connection. You don't have to allow direct RDP or SSH access over the internet…

Submitted by wei.xz· Mar 4, 2026Configure and manage virtual networking

Question

You have the Azure virtual network named VNet1 that contains a subnet named Subnet1. Subnet1 contains three Azure virtual machines. Each virtual machine has a public IP address. The virtual machines host several applications that are accessible over port 443 to users on the Internet. Your on-premises network has a site-to-site VPN connection to VNet1. You discover that the virtual machines can be accessed by using the Remote Desktop Protocol (RDP) from the Internet and from the on-premises network. You need to prevent RDP access to the virtual machines from the Internet, unless the RDP connection is established from the on-premises network. The solution must ensure that all the applications can still be accessed by the Internet users. What should you do?

Options

  • AModify the address space of the local network gateway
  • BCreate a deny rule in a network security group (NSG) that is linked to Subnet1
  • CRemove the public IP addresses from the virtual machines
  • DModify the address space of Subnet1

How the community answered

(44 responses)
  • A
    9% (4)
  • B
    82% (36)
  • C
    2% (1)
  • D
    7% (3)

Explanation

You can use a site-to-site VPN to connect your on-premises network to an Azure virtual network. Users on your on-premises network connect by using the RDP or SSH protocol over the site-to- site VPN connection. You don't have to allow direct RDP or SSH access over the internet. https://docs.microsoft.com/en-us/azure/security/fundamentals/network-best-practices

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-104 Practice