Examkin

Question

Difficulty: HardConfigure Azure Bastion

Your company has an Azure virtual network named `VNet1` that contains an Azure Bastion host deployed in a subnet named `AzureBastionSubnet`. To secure the environment, you associate a Network Security Group (NSG) named `NSG-Bastion` with `AzureBastionSubnet`. You add a custom outbound security rule to `NSG-Bastion` with a priority of 950 that denies all outbound traffic to the Internet (Destination: `Internet`, Action: `Deny`). After applying the NSG, administrators report that they can no longer connect to virtual machines in `VNet1` using Azure Bastion. You need to resolve the connectivity issue while maintaining the block on general outbound Internet traffic. Which outbound rule should you add to `NSG-Bastion`?

  1. An outbound rule with a priority of 900 that allows TCP port 443 traffic to the AzureCloud service tagAnswer
  2. B
    An outbound rule with a priority of 1000 that allows TCP port 443 traffic to the AzureCloud service tag
  3. C
    An outbound rule with a priority of 900 that allows TCP ports 3389 and 22 traffic to the Internet service tag
  4. D
    An outbound rule with a priority of 1000 that allows TCP ports 3389 and 22 traffic to the VirtualNetwork service tag

Answer

Add an outbound security rule to `NSG-Bastion` with a priority of 900 that allows TCP port 443 traffic to the `AzureCloud` service tag.
The correct option is correct because Azure Bastion needs to communicate with the Azure public endpoints (such as Azure Storage and Azure Active Directory) via port 443. The AzureCloud service tag represents these endpoints. Because a custom rule with a priority of 950 blocks all outbound Internet traffic, we must place an allow rule with a higher priority (lower number, e.g., 900) to permit the necessary control plane traffic.

Step-by-Step Solution

1
Identify the outbound dependencies of Azure Bastion.
Azure Bastion requires outbound connectivity to the Azure public endpoints (AzureCloud service tag) on port 443 for management, logging, and diagnostics.
Azure Bastion hosts must communicate with the Azure control plane to function properly.
2
Analyze the impact of the custom deny rule on the dependencies.
The custom outbound rule denying all traffic to the Internet (priority 950) blocks public Azure endpoints since they are a subset of the Internet IP address ranges.
Without a higher priority rule, control plane traffic to AzureCloud is blocked, causing Azure Bastion sessions to fail.
3
Determine the correct rule configuration to bypass the block.
Add an outbound rule allowing traffic to AzureCloud on port 443 with a priority number lower than 950 (such as 900).
NSG rules are processed in increasing order of priority number. A rule with a lower number takes precedence over a rule with a higher number.

Key Concept

Azure Bastion relies on outbound connectivity to the Azure control plane (AzureCloud service tag) on TCP port 443. Custom NSG rules blocking Internet access will prevent Azure Bastion from working unless an explicit allow rule is placed with a higher priority (lower number) than the block rule.
Rate this question

Topics

Configure Azure Bastion

More questions from this topic