QUESTION: 500 Exam Topic: Deploy and manage Azure compute resources Questions

You have an Azure subscription that contains a storage account. The account stores website data.

You need to ensure that inbound user traffic uses the Microsoft point-of-presence (POP) closest to the user's location.

What should you configure?

private endpoints
Azure Firewall rules
Routing preference
load balancing

Answer(s): C

Explanation:

Network routing preference for Azure Storage
You can configure network routing preference for your Azure storage account to specify how network traffic is routed to your account from clients over the internet. By default, traffic from the internet is routed to the public endpoint of your storage account over the Microsoft global network. Azure Storage provides additional options for configuring how traffic is routed to your storage account.

Configuring routing preference gives you the flexibility to optimize your traffic either for premium network performance or for cost. When you configure a routing preference, you specify how traffic will be directed to the public endpoint for your storage account by default. You can also publish route-specific endpoints for your storage account.

Note: Microsoft global network versus Internet routing
By default, clients outside of the Azure environment access your storage account over the Microsoft global network. The Microsoft global network is optimized for low-latency path selection to deliver premium network performance with high reliability. Both inbound and outbound traffic are routed through the point of presence (POP) that is closest to the client. This default routing configuration ensures that traffic to and from your storage account traverses over the Microsoft global network for the bulk of its path, maximizing network performance.

You can change the routing configuration for your storage account so that both inbound and outbound traffic are routed to and from clients outside of the Azure environment through the POP closest to the storage account. This route minimizes the traversal of your traffic over the Microsoft global network, handing it off to the transit ISP at the earliest opportunity. Utilizing this routing configuration lowers networking costs.

Reference:

https://learn.microsoft.com/en-us/azure/storage/common/network-routing-preference

Reveal Solution Next Question

QUESTION: 501 Exam Topic: Deploy and manage Azure compute resources Questions

You have two Azure virtual machines named VM1 and VM2 that run Windows Server. The virtual machines are in a subnet named Subnet1. Subnet1 is in a virtual network named VNet1.

You need to prevent VM1 from accessing VM2 on port 3389.
What should you do?

Create a network security group (NSG) that has an outbound security rule to deny destination port 3389 and apply the NSG to the network interface of VM1.
Configure Azure Bastion in VNet1.
Create a network security group (NSG) that has an outbound security rule to deny source port 3389 and apply the NSG to Subnet1.
Create a network security group (NSG) that has an inbound security rule to deny source port 3389 and apply the NSG to Subnet1.

Answer(s): A

Explanation:

You can use an Azure network security group to filter network traffic between Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources. For each rule, you can specify source and destination, port, and protocol.

Incorrect:
Not B: Azure Bastion is a fully managed service that provides more secure and seamless Remote Desktop Protocol (RDP) and Secure Shell Protocol (SSH) access to virtual machines (VMs) without any exposure through public IP addresses. Provision the service directly in your local or peered virtual network to get support for all the VMs within it.

Reference:

https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

Reveal Solution Next Question

QUESTION: 502 Exam Topic: Deploy and manage Azure compute resources Questions

You have an Azure subscription that contains the resources shown in the following table.

You need to manage outbound traffic from VNET1 by using Firewall1.
What should you do first?

Configure the Hybrid Connection Manager.
Upgrade ASP1 to the Premium SKU.
Create a route table.
Create an Azure Network Watcher.

Answer(s): C

Explanation:

Integrate your app with an Azure virtual network, network routing
You can use route tables to route outbound traffic from your app without restriction. Common destinations can include firewall devices or gateways.

Route tables and network security groups only apply to traffic routed through the virtual network integration.

Reference:

https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration

Reveal Solution Next Question

QUESTION: 503 Exam Topic: Deploy and manage Azure compute resources Questions

You have an Azure subscription that contains the resources shown in the following table.

All the resources connect to a virtual network named VNet1.
You plan to deploy an Azure Bastion host named Bastion1 to VNet1.

Which resources can be protected by using Bastion1?

VM1 only
contoso.com only
App1 and contoso.com only
VM1 and contoso.com only
VM1, App1, and contoso.com

Answer(s): A

Explanation:

Bastion provides secure RDP and SSH connectivity to all of the VMs in the virtual network in which it is provisioned. Using Azure Bastion protects your virtual machines from exposing RDP/SSH ports to the outside world, while still providing secure access using RDP/SSH.

Reference:

https://learn.microsoft.com/en-us/azure/bastion/bastion-overview

Reveal Solution Next Question

Free AZ-104 Exam Braindumps (page: 56)

QUESTION: 500 Exam Topic: Deploy and manage Azure compute resources Questions

Explanation:

Reference:

QUESTION: 501 Exam Topic: Deploy and manage Azure compute resources Questions

Explanation:

Reference:

QUESTION: 502 Exam Topic: Deploy and manage Azure compute resources Questions

Explanation:

Reference:

QUESTION: 503 Exam Topic: Deploy and manage Azure compute resources Questions

Explanation:

Reference: