Examkin

Question

Difficulty: HardNetwork Security and Private Access

An enterprise is designing a secure administrative management solution for virtual machines deployed in a subnet named ComputeSubnet within a virtual network named VNet1. You deploy Azure Bastion in a subnet named AzureBastionSubnet to provide secure RDP and SSH access. To comply with security policies, you must configure a Network Security Group (NSG) associated with AzureBastionSubnet to restrict outbound traffic to only what is required for Azure Bastion to function properly, including connectivity to Azure public services (such as Azure Active Directory, Azure Monitor, and Azure Storage) for logging and diagnostics. The solution must minimize administrative overhead and avoid manual rule updates when Azure service IP addresses change. Which outbound NSG rule configuration should you recommend for AzureBastionSubnet?

  1. Create an outbound security rule with the destination set to the AzureCloud Service Tag for ports 443 and 12000.Answer
  2. B
    Create outbound security rules with the destination set to the specific public IP address prefixes of the regional Azure Active Directory, Azure Monitor, and Azure Storage endpoints.
  3. C
    Create an outbound security rule with the destination set to the VirtualNetwork Service Tag and associate a route table with AzureBastionSubnet that has a User Defined Route (UDR) for 0.0.0.0/0 pointing to an on-premises VPN gateway.
  4. D
    Create an outbound security rule with the destination set to the Internet Service Tag for ports 22 and 3389 only, and deny all outbound traffic to the AzureCloud Service Tag.

Answer

Create an outbound security rule with the destination set to the AzureCloud Service Tag for ports 443 and 12000.
The correct option is correct because Azure Bastion relies on outbound access to Azure public services (e.g., Azure Active Directory, Azure Monitor, Azure Storage) on port 443 and port 12000 for service telemetry, control plane logging, and validation. The built-in AzureCloud service tag represents these endpoints dynamically, minimizing administrative overhead by automatically updating underlying IP addresses.

Step-by-Step Solution

1
Analyze Azure Bastion network requirements
Azure Bastion requires outbound access to Azure public endpoints (such as Azure Storage and Azure Monitor) for diagnostic logging and telemetry on ports 443 and 12000.
Ensures that the management plane of the service can communicate with its supporting Azure cloud infrastructure.
2
Select the most efficient NSG destination type
The AzureCloud Service Tag is chosen over static IP addresses or custom ranges.
Using the built-in Service Tag automatically keeps up with changing IP addresses, eliminating manual maintenance and reducing administrative overhead.
3
Validate routing constraints
Ensure no default UDR (0.0.0.0/0) is assigned to the AzureBastionSubnet that redirects traffic away from the public internet.
Azure Bastion does not support forced tunneling as it breaks required control plane and certificate validation communications.

Key Concept

Azure Bastion Outbound NSG Rules and Service Tags
Rate this question

Topics

Network Security and Private Access

More questions from this topic