AZ-104 Question 212
Single answerYou have deployed a new Azure VM in a subnet that routes all outbound traffic through a Network Virtual Appliance (NVA). The subnet's Network Security Group (NSG) uses default inbound and outbound rules, and your VM cannot access the internet or other external endpoints. What is the best initial troubleshooting step to resolve this connectivity issue?
- A
Check the system firewall settings inside the virtual machine to ensure outbound connections are allowed.
- B
Review the activity logs in Azure Monitor to see if any rules are blocking or dropping packets.
- C
Validate that the subnet's custom route table sends outbound traffic to the correct next hop IP of the NVA.
- D
Reassign a new public IP address to the virtual machine through the Azure portal.
Show answer and explanation
Correct answer: C
Explanation
When using an NVA or custom route tables, misconfiguration of the routes is often a primary cause of connectivity issues. Confirming that the subnet's user-defined route settings point to the correct NVA IP is the essential first step before investigating other layers such as firewalls or monitoring logs.
- A. Incorrect.
While confirming VM firewall settings is important, default NSG rules already allow outbound connections in this scenario. The system firewall is not likely the first place to check if the traffic is being redirected incorrectly.
- B. Incorrect.
Monitoring logs can help, but it is more efficient first to verify the routing configuration to ensure the packets are going to the right next hop before investigating logs.
- C. Correct.
Validating the route table is critical for traffic that is being sent to the NVA. If the next hop is incorrect, the VM will not be able to establish outbound connectivity.
- D. Incorrect.
Reassigning a new public IP will not fix a routing or forwarding issue. Connectivity problems must be diagnosed at the routing and NSG levels first.