nerdexam
Microsoft

AZ-500 · Question #114

Drag and Drop Question You have an Azure subscription that contains the following resources: - A virtual network named VNET1 that contains two subnets named Subnet1 and Subnet2. - A virtual machine…

The correct answer is Create a new subnet.; Deploy Azure Firewall.; Create a NAT rule collection. To enable Remote Desktop (RDP) access to a VM with only a private IP from the internet, you must first create a dedicated subnet (AzureFirewallSubnet) to host the Azure Firewall, then deploy Azure Firewall into that subnet to act as the internet-facing entry point. Finally, you…

Submitted by mateo_ar· Mar 6, 2026Configure and manage virtual networking - Implement and manage network security (AZ-104 / Implement network security in Azure)

Question

Drag and Drop Question You have an Azure subscription that contains the following resources: - A virtual network named VNET1 that contains two subnets named Subnet1 and Subnet2. - A virtual machine named VM1 that has only a private IP address and connects to Subnet1. You need to ensure that Remote Desktop connections can be established to VM1 from the internet. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange then in the correct order. Answer:

Exhibit

AZ-500 question #114 exhibit

Answer Area

Drag items

Configure a network security group (NSG).Create a network rule collection.Create a NAT rule collection.Create a new subnet.Deploy Azure Application Gateway.Deploy Azure Firewall.

Correct arrangement

  • Create a new subnet.
  • Deploy Azure Firewall.
  • Create a NAT rule collection.

Explanation

To enable Remote Desktop (RDP) access to a VM with only a private IP from the internet, you must first create a dedicated subnet (AzureFirewallSubnet) to host the Azure Firewall, then deploy Azure Firewall into that subnet to act as the internet-facing entry point. Finally, you create a NAT rule collection on the Azure Firewall to translate inbound RDP traffic (port 3389) from the firewall's public IP to VM1's private IP address, enabling connectivity. This sequence is necessary because Azure Firewall uses DNAT (Destination Network Address Translation) via NAT rule collections to forward external traffic to internal private resources.

Topics

#Azure Firewall#NAT Rule Collection#Network Security#Remote Desktop Protocol

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice