AZ-700 · Question #217
You have an Azure subscription that contains the following resources: - A virtual network named Vnet1 - Two subnets named subnet1 and AzureFirewallSubnet - A public Azure Firewall named FW1 - A…
The correct answer is C. On FW1, create an outbound network rule that allows traffic to the Azure Key Management. To enable Windows Server VM activation when traffic is forced through an Azure Firewall, an explicit outbound network rule allowing access to the Azure Key Management Service must be configured on the firewall.
Question
You have an Azure subscription that contains the following resources:
- A virtual network named Vnet1
- Two subnets named subnet1 and AzureFirewallSubnet
- A public Azure Firewall named FW1
- A route table named RT1 that is associated to Subnet1
- A rule routing of 0.0.0.0/0 to FW1 in RT1
After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machines were activated. You need to ensure that the virtual machines can be activated. What should you do?
Options
- ADeploy a NAT gateway.
- BDeploy an Azure Standard Load Balancer that has an outbound NAT rule.
- COn FW1, create an outbound network rule that allows traffic to the Azure Key Management
- DTo Subnet1, associate a network security group (NSG) that allows outbound access to port 1688.
How the community answered
(24 responses)- A4% (1)
- B13% (3)
- C75% (18)
- D8% (2)
Why each option
To enable Windows Server VM activation when traffic is forced through an Azure Firewall, an explicit outbound network rule allowing access to the Azure Key Management Service must be configured on the firewall.
A NAT gateway provides outbound internet connectivity but does not allow or block traffic based on specific ports or destinations, which is the role of the existing Azure Firewall.
An Azure Standard Load Balancer with an outbound NAT rule is used for providing outbound internet access for VMs that don't have public IPs, but the Azure Firewall is already intercepting outbound traffic and requires explicit rules.
Windows Server activation requires outbound connectivity to Microsoft's Key Management Service (KMS) on port 1688. Since a User Defined Route (UDR) is forcing all outbound traffic from Subnet1 through FW1, a specific outbound network rule must be created on FW1 to permit this traffic to the Azure Key Management Service, typically using the `WindowsActivation` service tag and port 1688.
While an NSG rule could allow outbound access to port 1688, the UDR forcing all traffic to the Azure Firewall means the firewall is the primary point of egress control, and its rules would take precedence over or supersede the NSG for this purpose.
Concept tested: Azure Firewall outbound rules for Windows activation
Source: https://learn.microsoft.com/en-us/azure/firewall/service-tags
Community Discussion
No community discussion yet for this question.