Microsoft
AZ-104 · Question #629
You have two Azure virtual machines named VM1 and VM2 that run Windows Server. The virtual machines are in a subnet named Subnet1. Subnet1 is in a virtual network named VNet1. You need to prevent…
The correct answer is A. Create a network security group (NSG) that has an outbound security rule to deny destination. It will prevent connections from VM1 on port 3389 to any destination, including the other VM. Question does not say that VM1 should be able to access other VMs on this port so it's fine to block all outgoing connections.
Submitted by alyssa_d· Mar 4, 2026Configure and manage virtual networking
Question
You have two Azure virtual machines named VM1 and VM2 that run Windows Server. The virtual machines are in a subnet named Subnet1. Subnet1 is in a virtual network named VNet1. You need to prevent VM1 from accessing VM2 on port 3389. What should you do?
Options
- ACreate a network security group (NSG) that has an outbound security rule to deny destination
- BConfigure Azure Bastion in VNet1.
- CCreate a network security group (NSG) that has an outbound security rule to deny source port
- DCreate a network security group (NSG) that has an inbound security rule to deny source port
How the community answered
(43 responses)- A70% (30)
- B7% (3)
- C19% (8)
- D5% (2)
Explanation
It will prevent connections from VM1 on port 3389 to any destination, including the other VM. Question does not say that VM1 should be able to access other VMs on this port so it's fine to block all outgoing connections.
Community Discussion
No community discussion yet for this question.