AZ-700 · Question #210
You have an Azure subscription that contains the following resources: - A virtual network named Vnet1 - Two subnets named subnet1 and AzureFirewallSubnet - A public Azure Firewall named FW1 - A…
The correct answer is B. On FW1, create an outbound network rule that allows traffic to the Azure Key Management. To activate Windows Server VMs behind an Azure Firewall, an outbound network rule must be configured on the firewall to allow traffic to the Azure Key Management Service (KMS) endpoints.
Question
You have an Azure subscription that contains the following resources:
- A virtual network named Vnet1
- Two subnets named subnet1 and AzureFirewallSubnet
- A public Azure Firewall named FW1
- A route table named RT1 that is associated to Subnet1
- A rule routing of 0.0.0.0/0 to FW1 in RT1
After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machines were activated. You need to ensure that the virtual machines can be activated. What should you do?
Options
- AOn FW1, configure a DNAT rule for port 1688.
- BOn FW1, create an outbound network rule that allows traffic to the Azure Key Management
- CDeploy an application security group that allows outbound traffic to 1688.
- DDeploy an Azure Standard Load Balancer that has an outbound NAT rule.
How the community answered
(46 responses)- A7% (3)
- B76% (35)
- C4% (2)
- D13% (6)
Why each option
To activate Windows Server VMs behind an Azure Firewall, an outbound network rule must be configured on the firewall to allow traffic to the Azure Key Management Service (KMS) endpoints.
A DNAT rule is for inbound traffic translation and would not help with outbound activation traffic.
Windows Server activation requires outbound access to the Microsoft Key Management Service (KMS) endpoints on port 1688. Since all outbound traffic from Subnet1 is forced through FW1 by the UDR, FW1 must have an explicit outbound network rule allowing traffic to the `WindowsActivation` service tag on port 1688 to enable activation.
An application security group (ASG) helps group VMs for NSG rules but does not route or filter traffic like a firewall; outbound access still needs to be explicitly allowed by the Azure Firewall.
A Standard Load Balancer with an outbound NAT rule is for providing outbound internet access, but the Azure Firewall is already handling outbound routing via the UDR, and explicit firewall rules are needed for allowed protocols/ports.
Concept tested: Azure Firewall outbound rules for Windows activation
Source: https://learn.microsoft.com/en-us/azure/firewall/service-tags
Community Discussion
No community discussion yet for this question.