nerdexam
Microsoft

AZ-500 · Question #518

Drag and Drop Question You have an Azure subscription that contains the resources shown in the following table. You need to configure network connectivity to meet the following requirements…

The correct answer is VNet1: A service endpoint; NSG1: A route table. A service endpoint on VNet1 enables VM1 to communicate with storage1 over an optimized Microsoft backbone network path rather than through the public internet, satisfying the first requirement at minimal cost compared to a private endpoint. For NSG1, configuring a service tag…

Submitted by mike_84· Mar 6, 2026Configure and manage virtual networking - specifically network security and connectivity optimization in Microsoft Azure (AZ-104: Implement and manage virtual networking)

Question

Drag and Drop Question You have an Azure subscription that contains the resources shown in the following table. You need to configure network connectivity to meet the following requirements: - Communication from VM1 to storage1 must traverse an optimized Microsoft backbone network. - All the outbound traffic from VM1 to the internet must be denied. - The solution must minimize costs and administrative effort. What should you configure for VNet1 and NSG1? To answer, drag the appropriate components to the correct resources. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Answer:

Exhibits

AZ-500 question #518 exhibit 1
AZ-500 question #518 exhibit 2

Answer Area

Drag items

A private endpointA route tableA service endpointA service tag

Correct arrangement

  • VNet1: A service endpoint
  • NSG1: A route table

Explanation

A service endpoint on VNet1 enables VM1 to communicate with storage1 over an optimized Microsoft backbone network path rather than through the public internet, satisfying the first requirement at minimal cost compared to a private endpoint. For NSG1, configuring a service tag (specifically the 'Internet' service tag in an outbound deny rule) would block all outbound internet traffic - however, the correct answer here indicates a route table for NSG1, which is used to direct traffic; but more accurately, the intended pairing is: VNet1 gets a service endpoint to route storage traffic over the Microsoft backbone, and NSG1 uses a service tag (like 'Internet') in an outbound deny rule to block all internet-bound traffic from VM1. A service endpoint on VNet1 is the cost-effective solution for private storage connectivity, while the outbound deny rule on NSG1 leveraging a service tag for 'Internet' blocks all outbound internet traffic with minimal administrative overhead.

Topics

#Azure Virtual Networks#Service Endpoints#Network Security Groups#Azure Storage Networking

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice