nerdexam
Microsoft

AZ-700 · Question #28

You have an Azure virtual network named Vnet1. You need to ensure that the virtual machines in Vnet1 can access only the Azure SQL resources in the East US Azure region. The virtual machines must be…

The correct answer is A. an allow rule that has the IP address range of Vnet1 as the source and destination of Sql.EastUS D. a deny rule that has the IP address range of Vnet1 as the source and destination of Storage. Two outbound NSG rules are needed: (A) An ALLOW rule with the source set to Vnet1's IP range and the destination set to the 'Sql.EastUS' service tag - this explicitly permits outbound traffic to Azure SQL in the East US region only, using Azure-managed service tag IP ranges…

Submitted by klara.se· Apr 18, 2026Secure network connectivity to Azure resources

Question

You have an Azure virtual network named Vnet1. You need to ensure that the virtual machines in Vnet1 can access only the Azure SQL resources in the East US Azure region. The virtual machines must be prevented from accessing any Azure Storage resources. Which two outbound network security group (NSG) rules should you create? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Options

  • Aan allow rule that has the IP address range of Vnet1 as the source and destination of Sql.EastUS
  • Ba deny rule that has a source of VirtualNetwork and a destination of Sql
  • Ca deny rule that has a source of VirtualNetwork and a destination of 168.63.129.0/24
  • Da deny rule that has the IP address range of Vnet1 as the source and destination of Storage

How the community answered

(19 responses)
  • A
    74% (14)
  • B
    16% (3)
  • C
    11% (2)

Explanation

Two outbound NSG rules are needed: (A) An ALLOW rule with the source set to Vnet1's IP range and the destination set to the 'Sql.EastUS' service tag - this explicitly permits outbound traffic to Azure SQL in the East US region only, using Azure-managed service tag IP ranges. (D) A DENY rule with the source set to Vnet1's IP range and the destination set to the 'Storage' service tag - this blocks all outbound traffic to Azure Storage regardless of region. Using service tags keeps the rules maintainable as Microsoft updates the underlying IP ranges. Option B (deny VirtualNetwork to Sql) would block all Azure SQL, including East US, which contradicts the requirement.

Topics

#Network Security Groups (NSG)#Service Tags#Outbound Rules#Access Control

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-700 Practice