AZ-104 Question 213
Single answerYou have deployed a new Azure virtual machine (VM) within a virtual network that hosts multiple subnets. This new VM resides in one subnet, and your existing domain controller (DC) resides in another subnet in the same virtual network. The VM fails to join the domain and cannot communicate with the DC on ports required for Active Directory (e.g., port 53 or 389). You have confirmed that the DC is functioning correctly. What is the next step you should take to troubleshoot this connectivity issue?
- A
Modify the address space of the virtual network to ensure there is no overlap with on-premises networks
- B
Review the effective network security group (NSG) rules applied to the VM’s subnet and the DC’s subnet
- C
Enable boot diagnostics on the new VM to check the operating system logs and ensure the VM boots properly
- D
Assign a public IP address to the DC to allow external traffic over required ports
Show answer and explanation
Correct answer: B
Explanation
NSGs can control inbound and outbound traffic at both the subnet and NIC levels, potentially blocking required domain service ports. Reviewing effective NSG rules is the most direct step to isolate why the VM cannot communicate with the domain controller, ensuring the correct ports are allowed.
- A. Incorrect.
Altering the virtual network address space is only necessary if you have overlapping address ranges that prevent routing. This is not indicated as the issue.
- B. Correct.
Reviewing the effective NSG rules is critical to confirm if traffic for domain services ports is being blocked by a security rule. NSGs commonly restrict inbound or outbound traffic, causing connectivity issues between subnets in the same VNet.
- C. Incorrect.
Boot diagnostics only help you confirm if the VM is starting correctly. While useful for startup issues, it does not help troubleshoot connectivity problems with the domain controller ports.
- D. Incorrect.
Assigning a public IP address to the DC is not recommended for domain controllers and does not address subnet-level connectivity issues within the same VNet.