AZ-140 · Question #21
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might…
The correct answer is A. Yes. Configuring outbound rules in a Network Security Group (NSG) attached to the session host subnet is a valid and supported method to block general internet access while allowing required Microsoft services. Azure provides Service Tags (e.g., WindowsVirtualDesktop…
Question
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Azure Virtual Desktop host pool that contains five session hosts. The session hosts run Windows 10 Enterprise multi-session. You need to prevent users from accessing the internet from Azure Virtual Desktop sessions. The session hosts must be allowed to access all the required Microsoft services. Solution: You configure rules in the network security group (NSG) linked to the subnet of the session hosts. Does that meet the goal?
Options
- AYes
- BNo
How the community answered
(57 responses)- A95% (54)
- B5% (3)
Explanation
Configuring outbound rules in a Network Security Group (NSG) attached to the session host subnet is a valid and supported method to block general internet access while allowing required Microsoft services. Azure provides Service Tags (e.g., WindowsVirtualDesktop, AzureActiveDirectory, AzureMonitor) that can be used as NSG rule destinations, allowing traffic to necessary Microsoft endpoints without permitting broad internet access. This approach meets both goals: users cannot browse the internet, and session hosts can still reach all required Microsoft services. The solution works correctly.
Topics
Community Discussion
No community discussion yet for this question.