AZ-104 · Question #290
AZ-104 Question #290: Real Exam Question with Answer & Explanation
The correct answer is B: Create a deny rule in a network security group (NSG) that is linked to Subnet1. You can use a site-to-site VPN to connect your on-premises network to an Azure virtual network. Users on your on-premises network connect by using the RDP or SSH protocol over the site-to- site VPN connection. You don't have to allow direct RDP or SSH access over the internet. ht
Question
You have the Azure virtual network named VNet1 that contains a subnet named Subnet1. Subnet1 contains three Azure virtual machines. Each virtual machine has a public IP address. The virtual machines host several applications that are accessible over port 443 to users on the Internet. Your on-premises network has a site-to-site VPN connection to VNet1. You discover that the virtual machines can be accessed by using the Remote Desktop Protocol (RDP) from the Internet and from the on-premises network. You need to prevent RDP access to the virtual machines from the Internet, unless the RDP connection is established from the on-premises network. The solution must ensure that all the applications can still be accessed by the Internet users. What should you do?
Options
- AModify the address space of the local network gateway
- BCreate a deny rule in a network security group (NSG) that is linked to Subnet1
- CRemove the public IP addresses from the virtual machines
- DModify the address space of Subnet1
Explanation
You can use a site-to-site VPN to connect your on-premises network to an Azure virtual network. Users on your on-premises network connect by using the RDP or SSH protocol over the site-to- site VPN connection. You don't have to allow direct RDP or SSH access over the internet. https://docs.microsoft.com/en-us/azure/security/fundamentals/network-best-practices
Community Discussion
No community discussion yet for this question.