AZ-700 · Question #196
You have an Azure subscription that contains the following resources: - A virtual network named Vnet1 - Two subnets named subnet1 and AzureFirewallSubnet - A public Azure Firewall named FW1 - A…
The correct answer is C. Add an internet route to RT1 for the Azure Key Management Service (KMS). Windows Server VMs in Azure require outbound access to the Azure Key Management Service (KMS) on port 1688 (kms.core.windows.net / 23.102.135.246) for activation. The problem here is that RT1 has a default route (0.0.0.0/0) pointing all traffic through FW1, and FW1 has no rule…
Question
You have an Azure subscription that contains the following resources:
- A virtual network named Vnet1
- Two subnets named subnet1 and AzureFirewallSubnet
- A public Azure Firewall named FW1
- A route table named RT1 that is associated to Subnet1
- A rule routing of 0.0.0.0/0 to FW1 in RT1
After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machines were activated. You need to ensure that the virtual machines can be activated. What should you do?
Options
- AOn FW1, configure a DNAT rule for port 1688
- BDeploy a NAT gateway.
- CAdd an internet route to RT1 for the Azure Key Management Service (KMS).
- DTo Subnet1, associate a network security group (NSG) that allows outbound access to port 1688.
How the community answered
(32 responses)- A16% (5)
- B9% (3)
- C72% (23)
- D3% (1)
Explanation
Windows Server VMs in Azure require outbound access to the Azure Key Management Service (KMS) on port 1688 (kms.core.windows.net / 23.102.135.246) for activation. The problem here is that RT1 has a default route (0.0.0.0/0) pointing all traffic through FW1, and FW1 has no rule permitting KMS traffic, so activation requests are blocked. The correct fix is to add a specific route in RT1 for the KMS service IP with the next hop type set to 'Internet', bypassing FW1 for that specific destination. Option A (DNAT rule) is wrong because DNAT is for inbound traffic. Option B (NAT gateway) is unnecessary since a route to the internet for KMS is sufficient. Option D (NSG rule) won't help because the route table sends traffic to the firewall before the NSG outbound rule could matter - the firewall itself is dropping it.
Community Discussion
No community discussion yet for this question.