nerdexam
Microsoft

AZ-104 · Question #512

Hotspot Question You have a network security group (NSG) named NSG1 that has the rules defined in the exhibit. (Click the Exhibit tab.) NSG1 is associated to a subnet named Subnet1. Subnet1 contains…

The correct answer is Server2 resolves host2.contoso.com to 131.107.50.50. = No; Server2 resolves host1.contoso.com to 131.107.10.15. = Yes; Server3 resolves host2.contoso.com to 131.107.50.50. = No. To allow VM1 to ping VM2, you need to create an inbound rule that permits ICMP traffic. Since the principle of least privilege requires the most restrictive rule possible, the rule should specify the exact source (VM1's IP address), destination (VM2's IP address), protocol…

Submitted by renata2k· Mar 4, 2026Configure and manage virtual networking - specifically implementing NSG rules to control inbound and outbound traffic while adhering to least-privilege security principles (AZ-104: Implement and Manage Virtual Networking)

Question

Hotspot Question You have a network security group (NSG) named NSG1 that has the rules defined in the exhibit. (Click the Exhibit tab.) NSG1 is associated to a subnet named Subnet1. Subnet1 contains the virtual machines shown in the following table. You need to add a rule to NSG1 to ensure that VM1 can ping VM2. The solution must use the principle of least privilege. How should you configure the rule? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:

Exhibits

AZ-104 question #512 exhibit 1
AZ-104 question #512 exhibit 2
AZ-104 question #512 exhibit 3
AZ-104 question #512 exhibit 4

Answer Area

  • Server2 resolves host2.contoso.com to 131.107.50.50.No
  • Server2 resolves host1.contoso.com to 131.107.10.15.Yes
  • Server3 resolves host2.contoso.com to 131.107.50.50.No

Explanation

To allow VM1 to ping VM2, you need to create an inbound rule that permits ICMP traffic. Since the principle of least privilege requires the most restrictive rule possible, the rule should specify the exact source (VM1's IP address), destination (VM2's IP address), protocol (ICMP), and action (Allow), rather than using broad ranges like 'Any' or entire subnet CIDRs. ICMP is the protocol used by ping, and scoping the rule to specific IPs ensures no unnecessary access is granted to other resources.

Topics

#Network Security Groups#Azure Networking#ICMP/Ping Rules#Principle of Least Privilege

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-104 Practice