You save $69.98
A stakeholder asks whether the proposed configuration guarantees: filter traffic through Network Security Group rules at the correct subnet or NIC scope. What qualification is technically accurate?
NSGs are stateful packet filters but cannot inspect all Layer 7 application payloads like an application firewall. That remains a practical service boundary even after the recommended change (create an NSG inbound allow rule for TCP 443 from the approved address range and deny unrelated inbound traffic) is implemented; retest it when identities, policies, service capacity or network paths change.
The two checks cover separate behavior: 'Test HTTPS connectivity from an allowed corporate egress IP' and 'Test the same port from a disallowed origin and inspect effective security rules'. Neither check removes the remaining operational limitation: NSGs are stateful packet filters but cannot inspect all Layer 7 application payloads like an application firewall.
The incident (an unapproved public client can still connect to TCP 443 on the VM) could recur if a related Azure dependency changes. The design still faces the limitation: NSGs are stateful packet filters but cannot inspect all Layer 7 application payloads like an application firewall.
The successful check 'Test HTTPS connectivity from an allowed corporate egress IP' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: NSGs are stateful packet filters but cannot inspect all Layer 7 application payloads like an application firewall.
An Azure administrator must resolve a specific request: A team is worried that an inbound NSG rule allowing established responses will expose a high port range to arbitrary unsolicited internet connections. The expected outcome is: understand stateful NSG connection tracking and apply narrowly scoped inbound initiation rules. Which option is appropriate?
NSGs track established traffic so return packets for permitted flows do not generally require wide inbound ephemeral-port allows. This achieves understand stateful NSG connection tracking and apply narrowly scoped inbound initiation rules through keep least-privilege NSG rules and rely on supported stateful flow tracking for response packets instead of relying on merely similar resource settings.
An unrestricted allow enlarges attack exposure unnecessarily; that would not meet understand stateful NSG connection tracking and apply narrowly scoped inbound initiation rules, for which the relevant Azure action is keep least-privilege NSG rules and rely on supported stateful flow tracking for response packets.
Stateful filtering can manage response flows without blanket unrestricted ingress; that would not meet understand stateful NSG connection tracking and apply narrowly scoped inbound initiation rules, for which the relevant Azure action is keep least-privilege NSG rules and rely on supported stateful flow tracking for response packets.
SAS tokens do not program NSG state tables; that would not meet understand stateful NSG connection tracking and apply narrowly scoped inbound initiation rules, for which the relevant Azure action is keep least-privilege NSG rules and rely on supported stateful flow tracking for response packets.
Operations sees an unexpected outcome: An administrator adds allow-any-inbound ephemeral ports merely to enable responses to approved outbound connections. The original demand was: understand stateful NSG connection tracking and apply narrowly scoped inbound initiation rules. Which cause is most consistent with the evidence?
The trace reports: An administrator adds allow-any-inbound ephemeral ports merely to enable responses to approved outbound connections. The causal misconfiguration is: The administrator has confused stateful return traffic handling with authorization of unsolicited new flows. The targeted action is to remove the unnecessary broad inbound allow and keep the specific authorized new-connection rules.
An applicable subnet NSG has a higher-impact deny or another effective rule blocks the flow; that mechanism would be more consistent with an observation such as an inbound HTTPS connection is denied even though the NIC NSG contains an allow rule, rather than this case's an administrator adds allow-any-inbound ephemeral ports merely to enable responses to approved outbound connections.
NSG rules were written to specific obsolete IPs rather than the intended application-role group; that mechanism would be more consistent with an observation such as new app VMs fail to communicate after their private addresses change, rather than this case's an administrator adds allow-any-inbound ephemeral ports merely to enable responses to approved outbound connections.
The effective NSG rule set allows a broader source prefix or has a higher-priority broad allow; that mechanism would be more consistent with an observation such as an unapproved public client can still connect to TCP 443 on the VM, rather than this case's an administrator adds allow-any-inbound ephemeral ports merely to enable responses to approved outbound connections.
A service owner needs a practical fix after this failure: An administrator adds allow-any-inbound ephemeral ports merely to enable responses to approved outbound connections. What is the best remediation?
Remove the unnecessary broad inbound allow and keep the specific authorized new-connection rules. This addresses the documented failure condition: the administrator has confused stateful return traffic handling with authorization of unsolicited new flows. Retest the affected operation and retain the original least-privilege boundaries.
SAS tokens do not program NSG state tables. In the reported incident (an administrator adds allow-any-inbound ephemeral ports merely to enable responses to approved outbound connections), that change would not correct the cause: the administrator has confused stateful return traffic handling with authorization of unsolicited new flows.
An unrestricted allow enlarges attack exposure unnecessarily. In the reported incident (an administrator adds allow-any-inbound ephemeral ports merely to enable responses to approved outbound connections), that change would not correct the cause: the administrator has confused stateful return traffic handling with authorization of unsolicited new flows.
Stateful filtering can manage response flows without blanket unrestricted ingress. In the reported incident (an administrator adds allow-any-inbound ephemeral ports merely to enable responses to approved outbound connections), that change would not correct the cause: the administrator has confused stateful return traffic handling with authorization of unsolicited new flows.
A deployment claims to meet: understand stateful NSG connection tracking and apply narrowly scoped inbound initiation rules. The environment is: A team is worried that an inbound NSG rule allowing established responses will expose a high port range to arbitrary unsolicited internet connections. Which TWO test results would substantiate that claim? Select TWO answers.
Initiate an approved outbound connection and verify normal response traffic. This supplies observed evidence for understand stateful NSG connection tracking and apply narrowly scoped inbound initiation rules. It is not interchangeable with the second required check, try an unsolicited inbound connection on an unapproved ephemeral port and verify denial, because that checks a separate success or failure boundary.
Try an unsolicited inbound connection on an unapproved ephemeral port and verify denial. This supplies observed evidence for understand stateful NSG connection tracking and apply narrowly scoped inbound initiation rules. It is not interchangeable with the second required check, initiate an approved outbound connection and verify normal response traffic, because that checks a separate success or failure boundary.
A release checklist recording 'Try an unsolicited inbound connection on an unapproved ephemeral port and verify denial' is not evidence that the required operation actually succeeded or failed. To establish the correct result, the team must try an unsolicited inbound connection on an unapproved ephemeral port and verify denial on the actual workload to prove its independent boundary.
A configured resource is not proof of live behavior. The required check must exercise initiate an approved outbound connection and verify normal response traffic on the affected Azure deployment.
A privileged administrator in a different subscription may succeed at 'Initiate an approved outbound connection and verify normal response traffic' even though the intended caller fails. This does not prove the required behavior for initiate an approved outbound connection and verify normal response traffic.
An infrastructure design was selected to meet: understand stateful NSG connection tracking and apply narrowly scoped inbound initiation rules. What caveat remains relevant during operation?
Existing flow state can be affected by rule changes and idle timeouts; statefulness does not guarantee session continuity forever. That remains a practical service boundary even after the recommended change (keep least-privilege NSG rules and rely on supported stateful flow tracking for response packets) is implemented; retest it when identities, policies, service capacity or network paths change.
The incident (an administrator adds allow-any-inbound ephemeral ports merely to enable responses to approved outbound connections) could recur if a related Azure dependency changes. The design still faces the limitation: Existing flow state can be affected by rule changes and idle timeouts; statefulness does not guarantee session continuity forever.
The successful check 'Initiate an approved outbound connection and verify normal response traffic' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: Existing flow state can be affected by rule changes and idle timeouts; statefulness does not guarantee session continuity forever.
The two checks cover separate behavior: 'Initiate an approved outbound connection and verify normal response traffic' and 'Try an unsolicited inbound connection on an unapproved ephemeral port and verify denial'. Neither check removes the remaining operational limitation: Existing flow state can be affected by rule changes and idle timeouts; statefulness does not guarantee session continuity forever.
A subnet already has the Microsoft.Storage service endpoint enabled. Workloads have identities permitted to access Storage accounts A and B, but security policy allows outbound Storage traffic from this subnet only to account A. What Azure network control should the administrator add?
Service endpoint policies restrict traffic over the enabled Azure Storage service endpoint to listed Storage accounts. Associating the policy with the subnet enforces the desired outbound destination boundary.
DNS configuration does not convey subnet service-endpoint identity; that would not meet the selected workload requirement, for which the relevant Azure action is create a Storage service endpoint policy listing only approved account A and associate it with the workload subnet.
A private endpoint is a different viable design but is not the specified service-endpoint configuration; that would not meet the selected workload requirement, for which the relevant Azure action is create a Storage service endpoint policy listing only approved account A and associate it with the workload subnet.
RBAC is separate from network admission; that would not meet the selected workload requirement, for which the relevant Azure action is create a Storage service endpoint policy listing only approved account A and associate it with the workload subnet.
The subnet can reach both Storage accounts A and B through its enabled Microsoft.Storage endpoint, although security policy is intended to permit only A. A test identity legitimately has Blob permissions on B. Which missing network control most directly explains the unwanted access?
The trace reports: The subnet can reach both Storage accounts A and B through its enabled Microsoft.Storage endpoint, although security policy is intended to permit only A. A test identity legitimately has Blob permissions on B. The causal misconfiguration is: No effective service endpoint policy restricting permitted Storage account destinations is associated with the subnet. The targeted action is to associate a Storage service endpoint policy that allows A but not B, and confirm the subnet has its service endpoint enabled.
A correctly associated policy excluding B would block this supported service-endpoint path, contrary to the observed success. Check the actual effective policy association.
An inbound allow rule on A does not enforce an outbound destination allowlist on clients for B. The missing control is the subnet service endpoint policy.
A stale display or cache entry for A cannot explain successful authenticated traffic to the distinct B endpoint.
An Azure subnet with a Storage service endpoint can reach an unapproved Storage account B using a valid B identity. The intended outbound destination list is account A only. What focused correction is required?
Associate a Storage service endpoint policy that allows A but not B, and confirm the subnet has its service endpoint enabled. This addresses the documented failure condition: no effective service endpoint policy restricting permitted Storage account destinations is associated with the subnet. Retest the affected operation and retain the original least-privilege boundaries.
A private endpoint is a different viable design but is not the specified service-endpoint configuration. In the reported incident (the subnet can reach both Storage accounts A and B through its enabled Microsoft.Storage endpoint, although security policy is intended to permit only A. A test identity legitimately has Blob permissions on B), that change would not correct the cause: no effective service endpoint policy restricting permitted Storage account destinations is associated with the subnet.
DNS configuration does not convey subnet service-endpoint identity. In the reported incident (the subnet can reach both Storage accounts A and B through its enabled Microsoft.Storage endpoint, although security policy is intended to permit only A. A test identity legitimately has Blob permissions on B), that change would not correct the cause: no effective service endpoint policy restricting permitted Storage account destinations is associated with the subnet.
RBAC is separate from network admission. In the reported incident (the subnet can reach both Storage accounts A and B through its enabled Microsoft.Storage endpoint, although security policy is intended to permit only A. A test identity legitimately has Blob permissions on B), that change would not correct the cause: no effective service endpoint policy restricting permitted Storage account destinations is associated with the subnet.
A service endpoint policy should allow VNet-subnet traffic to approved Storage account A and deny destination account B, although test identities have valid permissions on each. Which TWO observations verify the network policy? Select TWO answers.
The successful test verifies that the endpoint policy does not block permitted account A traffic and that the approved workload path functions.
A deliberately authorized B identity isolates the network-policy decision from an RBAC denial. Blocking B under those conditions demonstrates the restrictive destination control.
Enabling the generic Storage service endpoint does not prove the account-level allowlist is associated or effective.
An RBAC-denied call cannot prove a network policy blocked the destination. Use a valid credential for B to isolate the network boundary.
Azure resource inventory does not reveal whether packets from the selected subnet can reach each account.
The Storage service endpoint policy now restricts subnet egress to account A. Which boundary remains true?
A Storage service endpoint policy filters supported account destinations, but it does not create Private Link IPs or replace Storage data-plane authorization. That remains a practical service boundary even after the recommended change (create a Storage service endpoint policy listing only approved account A and associate it with the workload subnet) is implemented; retest it when identities, policies, service capacity or network paths change.
Service endpoints continue to reach the Azure Storage public service endpoint, not a private IP allocated inside a subnet. Use Private Link for that requirement.
The endpoint policy controls reachable Storage resource destinations. Authentication and data-plane authorization are still separately evaluated by the account.
Policies are associated with specific subnets. Other subnets require their own applicable configuration, not an assumption of subscription-wide enforcement.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (606 Questions, Last Updated on Oct 25, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
