AZ-700 · Question #231
You have an Azure subscription that contains the following resources: - A virtual network named Vnet1 - Two subnets named subnet1 and AzureFirewallSubnet - A public Azure Firewall named FW1 - A…
The correct answer is C. Add an internet route to RT1 for the Azure Key Management Service (KMS). To resolve Windows activation issues when all outbound traffic is routed through an Azure Firewall, a specific User Defined Route (UDR) for the Key Management Service (KMS) can be added to the route table to allow direct internet access for activation traffic.
Question
You have an Azure subscription that contains the following resources:
- A virtual network named Vnet1
- Two subnets named subnet1 and AzureFirewallSubnet
- A public Azure Firewall named FW1
- A route table named RT1 that is associated to Subnet1
- A rule routing of 0.0.0.0/0 to FW1 in RT1
After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machines were activated. You need to ensure that the virtual machines can be activated. What should you do?
Options
- AOn FW1, configure a DNAT rule for port 1688.
- BDeploy an application security group that allows outbound traffic to 1688.
- CAdd an internet route to RT1 for the Azure Key Management Service (KMS).
- DDeploy an Azure Standard Load Balancer that has an outbound NAT rule.
How the community answered
(24 responses)- A13% (3)
- B4% (1)
- C79% (19)
- D4% (1)
Why each option
To resolve Windows activation issues when all outbound traffic is routed through an Azure Firewall, a specific User Defined Route (UDR) for the Key Management Service (KMS) can be added to the route table to allow direct internet access for activation traffic.
DNAT rules are used for translating inbound traffic destinations, not for enabling outbound connectivity from VMs behind a firewall.
Application Security Groups (ASGs) are used to group VMs and define network security rules, typically within NSGs, and do not directly manage outbound internet routing or provide a mechanism to bypass an existing firewall.
When a default route (0.0.0.0/0) directs all outbound traffic to an Azure Firewall, but activation fails, adding a more specific User Defined Route (UDR) to RT1 for the Azure Key Management Service (KMS) can ensure activation. This UDR, with an 'Internet' next hop, would override the default route for KMS traffic, allowing it to bypass the firewall and reach its destination.
An Azure Standard Load Balancer with an outbound NAT rule primarily provides outbound internet connectivity and load balancing, which is not the root cause of blocked activation when traffic is already explicitly routed through an Azure Firewall.
Concept tested: Azure User Defined Routes (UDRs) and routing precedence
Source: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#how-azure-selects-a-route
Community Discussion
No community discussion yet for this question.