AZ-700 · Question #162
You have an Azure subscription that contains the following resources: - A virtual network named Vnet1 - Two subnets named subnet1 and AzureFirewallSubnet - A public Azure Firewall named FW1 - A…
The correct answer is B. Add an internet route to RT1 for the Azure Key Management Service (KMS). Windows Server VMs in Azure activate against Microsoft's Azure KMS server (kms.core.windows.net, IP 23.102.135.246, port 1688). Because RT1 has a 0.0.0.0/0 route pointing all traffic to FW1, KMS activation traffic also hits the firewall. If FW1 has no rule permitting KMS…
Question
You have an Azure subscription that contains the following resources:
- A virtual network named Vnet1
- Two subnets named subnet1 and AzureFirewallSubnet
- A public Azure Firewall named FW1
- A route table named RT1 that is associated to Subnet1
- A rule routing of 0.0.0.0/0 to FW1 in RT1
After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machines were activated. You need to ensure that the virtual machines can be activated. What should you do?
Options
- AOn FW1, create an outbound service tag rule for AzureCloud.
- BAdd an internet route to RT1 for the Azure Key Management Service (KMS).
- COn FW1, configure a DNAT rule for port 1688.
- DDeploy an Azure Standard Load Balancer that has an outbound NAT rule.
How the community answered
(30 responses)- A10% (3)
- B80% (24)
- C7% (2)
- D3% (1)
Explanation
Windows Server VMs in Azure activate against Microsoft's Azure KMS server (kms.core.windows.net, IP 23.102.135.246, port 1688). Because RT1 has a 0.0.0.0/0 route pointing all traffic to FW1, KMS activation traffic also hits the firewall. If FW1 has no rule permitting KMS traffic, activation fails. The correct fix is to add a specific User Defined Route (UDR) in RT1 for the KMS server IP (23.102.135.246/32) with 'Internet' as the next hop, bypassing the firewall for that specific address. This is Microsoft's documented recommendation for this exact scenario. Option A (AzureCloud service tag rule on FW1) is overly broad and non-minimal. Option C (DNAT rule) is for inbound traffic, not outbound activation. Option D (Standard Load Balancer with outbound NAT) is unnecessarily complex and unrelated.
Community Discussion
No community discussion yet for this question.