AZ-700 · Question #234
You have an Azure subscription that contains the following resources: - A virtual network named Vnet1 - Two subnets named subnet1 and AzureFirewallSubnet - A public Azure Firewall named FW1 - A…
The correct answer is C. On FW1, create an outbound network rule that allows traffic to the Azure Key Management Service (KMS). To enable Windows activation for VMs whose outbound internet traffic is routed through an Azure Firewall, an outbound network rule must be configured on the firewall to explicitly permit traffic to the Key Management Service (KMS).
Question
You have an Azure subscription that contains the following resources:
- A virtual network named Vnet1
- Two subnets named subnet1 and AzureFirewallSubnet
- A public Azure Firewall named FW1
- A route table named RT1 that is associated to Subnet1
- A rule routing of 0.0.0.0/0 to FW1 in RT1
After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machines were activated. You need to ensure that the virtual machines can be activated. What should you do?
Options
- AOn FW1, create an outbound service tag rule for AzureCloud.
- BDeploy an Azure Standard Load Balancer that has an outbound NAT rule.
- COn FW1, create an outbound network rule that allows traffic to the Azure Key Management Service (KMS).
- DTo Subnet1, associate a network security group (NSG) that allows outbound access to port 1688.
How the community answered
(27 responses)- A15% (4)
- B7% (2)
- C74% (20)
- D4% (1)
Why each option
To enable Windows activation for VMs whose outbound internet traffic is routed through an Azure Firewall, an outbound network rule must be configured on the firewall to explicitly permit traffic to the Key Management Service (KMS).
While AzureCloud is a service tag, it is a very broad tag that includes many Microsoft services, making it less specific and potentially more permissive than necessary for just Windows activation, for which a more precise FQDN tag exists.
Deploying an Azure Standard Load Balancer with an outbound NAT rule addresses load balancing and general outbound SNAT, but it does not resolve the specific issue of traffic being blocked by an existing Azure Firewall.
When VMs are configured to route all internet-bound traffic through an Azure Firewall (via a 0.0.0.0/0 UDR), the firewall requires an explicit rule to permit Windows activation traffic. Creating an outbound network rule on FW1 that allows traffic to the Azure Key Management Service (KMS) FQDN tag on TCP port 1688 is the recommended and most secure method to ensure activation.
Associating a Network Security Group (NSG) to Subnet1 allowing outbound access to port 1688 would permit traffic to leave the subnet, but it would still be subject to the Azure Firewall's rules, which would block it if no explicit outbound rule exists on the firewall.
Concept tested: Azure Firewall outbound rules, FQDN tags, Windows KMS
Source: https://learn.microsoft.com/en-us/azure/firewall/fqdn-tags
Community Discussion
No community discussion yet for this question.