az-104 Practice Question 1740
Exam: az-104
Domain: Implement and manage virtual networking
Topic: Configure secure access to virtual networks
Difficulty: medium
Contoso Ltd has a hybrid environment with on-premises servers and Azure Virtual Machines (VMs). They want to ensure that only specific on-premises IP addresses can access their Azure VMs. Which configuration should you recommend to achieve this while maintaining security and performance?
Answer Options
A
Create an Application Security Group and add the on-premises IPs to the group.
B
Create an NSG with inbound rules specifying the on-premises IPs.
C
Deploy Azure Bastion for secure access to the VMs.
D
Use Hybrid Connectors to establish a connection between on-premises and Azure resources.
Correct Answer
B: Create an NSG with inbound rules specifying the on-premises IPs.
Explanation
The correct answer is B. Using an Azure Network Security Group (NSG) with inbound rules that specify the allowed on-premises IP addresses ensures that only those IPs can access the VMs, enhancing security. Option A (Application Security Groups) is not suitable as it is used for managing access to resources within the same Azure subscription or across subscriptions, not for controlling inbound traffic from external sources. Option C (Azure Bastion) provides secure access to VMs but does not control inbound traffic directly. Option D (Hybrid Connectors) is used for connecting on-premises networks to Azure services, not for configuring firewall rules.