AZ-700 Question 277
Select 2You are an Azure network engineer for a large organization with multiple subscriptions. You want to ensure that all development and production virtual networks block inbound Remote Desktop Protocol (RDP) traffic from the internet. You decide to implement a security baseline by using Azure Virtual Network Manager. Which two actions should you take as part of the solution?
- A
Create a Security Admin configuration in Azure Virtual Network Manager and define a deny rule for inbound RDP from the internet, then apply it to a Network Group containing the relevant production and development virtual networks.
- B
Create a Security User rule in Azure Virtual Network Manager that overrides any Security Admin rule for inbound RDP traffic.
- C
In the Connectivity configuration of Azure Virtual Network Manager, define a rule to block inbound RDP from the internet for all participating networks.
- D
Use Security Admin rules in Azure Virtual Network Manager, which take precedence over existing network security group (NSG) rules.
Show answer and explanation
Correct answers: A, D
Explanation
Azure Virtual Network Manager provides two types of security rules: Security Admin and Security User. Security Admin rules have higher precedence than NSG rules and Security User rules, allowing you to enforce critical organizational policies across multiple virtual networks. To block inbound RDP traffic from the internet, you should create a Security Admin configuration defining a deny rule and apply it to a network group containing the target development and production virtual networks. For more information, see: https://learn.microsoft.com/azure/virtual-network-manager/security-overview.
- A. Correct.
Option 1 is correct. In Azure Virtual Network Manager, you must create a Security Admin configuration and define security admin rules for inbound or outbound traffic. Associating those rules with a Network Group containing specific virtual networks applies the rules to all VMs in those networks, effectively blocking inbound RDP from the internet.
- B. Incorrect.
Option 2 is incorrect. Security User rules do not override Security Admin rules; in fact, Security Admin rules have higher precedence than User rules. Trying to override an admin-level rule with a user-level rule will not work.
- C. Incorrect.
Option 3 is incorrect. Connectivity configurations in Azure Virtual Network Manager handle network connectivity (for example, virtual network peering at scale), not security enforcement. Security rules must be defined under a Security Admin configuration rather than the connectivity configuration.
- D. Correct.
Option 4 is correct. Security Admin rules defined through Azure Virtual Network Manager take precedence over existing NSG rules. This ensures that any critical organizational policies, such as blocking inbound RDP from the internet, are always enforced.