AZ-500 Question 51
Single answerYou manage a distributed environment with multiple Azure virtual networks (VNETs) across different subscriptions. You want to enforce a single security rule set that denies all inbound connections except for HTTP (port 80) from a specific on-premises IP range. You decide to use Azure Virtual Network Manager to apply these rules across all targeted VNETs. Which of the following steps must you perform to meet this requirement?
- A
A. Create a Network Group of target VNETs, define a Security Admin Configuration with a custom rule allowing inbound HTTP from the on-premises IP range, deny other inbound traffic, and then deploy the configuration.
- B
B. Enable Azure Virtual Network Manager on each subnet, manually configure inbound NSG rules on each subnet, and rely on Azure Virtual Network Manager to replicate these subnet settings across all VNETs.
- C
C. Create a new route table with a custom route to block inbound traffic, link the route table to each VNET, and associate the route table with the Azure Virtual Network Manager deployment.
- D
D. Use Azure Firewall within a single VNET and rely on peering to block all inbound traffic except on port 80 for associated VNETs.
Show answer and explanation
Correct answer: A
Explanation
Azure Virtual Network Manager allows you to group together multiple VNETs and apply configurations, such as Security Admin Configurations, to enforce uniform traffic filtering rules. In this scenario, you create a Network Group, define the appropriate allow/deny rules, and deploy them across all VNETs in that group. For more information, refer to Microsoft documentation on Azure Virtual Network Manager and its Security Admin Configurations: https://learn.microsoft.com/azure/virtual-network-manager/overview.
- A. Correct.
A. Correct. In Azure Virtual Network Manager, you create or pick a Network Group containing all VNETs you want to govern. You then create a Security Admin Configuration with a custom rule to allow inbound traffic only on HTTP (port 80) from the on-premises IP range, while denying other inbound connections. Finally, you deploy the Security Admin Configuration to enforce these rules across all VNETs in the group.
- B. Incorrect.
B. Incorrect. Azure Virtual Network Manager does not replicate manually configured NSG rules at the subnet level across VNETs. You must explicitly define and deploy Security Admin Configurations or Connectivity Configurations in Azure Virtual Network Manager. Creating NSG rules at the subnet level does not automatically propagate these rules unless you have properly integrated and deployed them via Azure Virtual Network Manager.
- C. Incorrect.
C. Incorrect. Route tables focus on traffic routing rather than explicitly denying inbound connections at the network level. Although you can force traffic through specific paths, route tables alone do not provide the granularity of access restriction that Security Admin Configurations do. This approach would not satisfy the inbound traffic blocking requirement for all VNETs.
- D. Incorrect.
D. Incorrect. While an Azure Firewall can block unwanted traffic, the scenario specifically asks about applying rules across multiple VNETs with Azure Virtual Network Manager. Simply deploying Azure Firewall in one VNET requires additional configuration, such as forced tunneling or VNET peering, and does not leverage Azure Virtual Network Manager's centralized security rule deployment model.