AZ-500 · Question #477
Hotspot Question You have an Azure subscription that is linked to an Azure AD tenant and contains the virtual machines shown in the following table. The subnets of the virtual networks have the…
The correct answer is Connections from VM1 to storage1 always use IP address 10.1.1.5. = Yes; Connections from VM2 to Vault1 always use IP address 20.224.219.230. = No; Authentication from VM3 to the tenant uses either IP address 10.11.1.5 or 40.122.155.212. = No. Statement 1 is Yes because VM1 is on a subnet with a Microsoft.Storage service endpoint configured, meaning traffic to storage1 bypasses the public internet and flows through the Azure backbone using the VM's private IP (10.1.1.5) rather than a public IP. Statement 2 is No…
Question
Exhibits
Answer Area
- Connections from VM1 to storage1 always use IP address 10.1.1.5.Yes
- Connections from VM2 to Vault1 always use IP address 20.224.219.230.No
- Authentication from VM3 to the tenant uses either IP address 10.11.1.5 or 40.122.155.212.No
Explanation
Statement 1 is Yes because VM1 is on a subnet with a Microsoft.Storage service endpoint configured, meaning traffic to storage1 bypasses the public internet and flows through the Azure backbone using the VM's private IP (10.1.1.5) rather than a public IP. Statement 2 is No because VM2's subnet has a Microsoft.KeyVault service endpoint, so connections to Vault1 would also use the VM's private IP address (e.g., 10.2.x.x), NOT the public IP (20.224.219.230) of the vault. Statement 3 is No because Azure AD authentication traffic does NOT use service endpoints (there is no Microsoft.AzureActiveDirectory service endpoint scenario that forces private IP usage in this context, or the subnet lacks such an endpoint), meaning VM3 would use its public IP or the standard routing path, not consistently one of those two addresses as stated.
Topics
Community Discussion
No community discussion yet for this question.