AZ-700 · Question #339
You have an Azure subscription that contains the following resources: - A virtual network named Vnet1 - Two subnets named subnet1 and AzureFirewallSubnet - A public Azure Firewall named FW1 - A route
The correct answer is B. On FW1, create an outbound network rule that allows traffic to the Azure Key Management. In Azure, Windows virtual machines need access to the Azure Key Management Service (KMS) to activate their licenses. By default, KMS activation uses TCP port 1688. Since all outbound traffic in Subnet1 is routed through the Azure Firewall (FW1) due to the 0.0.0.0/0 route, the fir
Question
You have an Azure subscription that contains the following resources:
- A virtual network named Vnet1
- Two subnets named subnet1 and AzureFirewallSubnet
- A public Azure Firewall named FW1
- A route table named RT1 that is associated to Subnet1
- A rule routing of 0.0.0.0/0 to FW1 in RT1
After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machine operating systems were activated. You need to ensure that the virtual machines can be activated. What should you do?
Options
- ADeploy a NAT gateway.
- BOn FW1, create an outbound network rule that allows traffic to the Azure Key Management
- CTo Subnet1, associate a network security group (NSG) that allows outbound access to port 1688.
- DDeploy an Azure Standard Load Balancer that has an outbound NAT rule.
How the community answered
(49 responses)- A8% (4)
- B73% (36)
- C14% (7)
- D4% (2)
Explanation
In Azure, Windows virtual machines need access to the Azure Key Management Service (KMS) to activate their licenses. By default, KMS activation uses TCP port 1688. Since all outbound traffic in Subnet1 is routed through the Azure Firewall (FW1) due to the 0.0.0.0/0 route, the firewall needs a rule to allow outbound access to KMS.
Community Discussion
No community discussion yet for this question.