AZ-104 Question 211
Single answerYou have an Azure VM named VM1 in a subnet secured by a Network Security Group (NSG). VM1 can ping the default gateway, but it cannot access any external websites. You suspect a configuration in the subnet’s NSG is blocking outbound traffic. Which troubleshooting step should you perform first to isolate the cause of the connectivity issue?
- A
Check the subnet’s effective NSG rules in the Azure portal
- B
Enable IP forwarding on the VM’s network interface
- C
Redeploy the VM to a different subnet
- D
Deallocate and start the VM
Show answer and explanation
Correct answer: A
Explanation
Examining the effective rules for the NSG at both the VM and subnet levels is key to identifying whether there are any deny rules blocking outbound connections. This is more direct and efficient than reconfiguring or moving the VM without verifying the current NSG settings.
- A. Correct.
Reviewing the effective NSG rules at the subnet and VM levels is the recommended first step to confirm whether outbound traffic is being blocked.
- B. Incorrect.
Enabling IP forwarding is typically used when routing traffic through the VM, not for initial outbound connectivity issues.
- C. Incorrect.
Redeploying the VM to a different subnet might eventually be an option, but it is not the first step when you suspect NSG issues.
- D. Incorrect.
Deallocating and restarting the VM would not directly diagnose outbound network connectivity problems; it just restarts the resource.