AZ-104 Question 102

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B3

  To ensure that the virtual machines can access Vault1 while adhering to the principle of least privilege and minimizing administrative effort, you should configure the destination of the outbound security rule for NSG1 to use B. a service tag. Specifically, you should use the AzureKeyVault service tag. This service tag represents the IP addresses used by Azure Key Vault, allowing your virtual machines to access Vault1 without opening broader access to the internet.

• 1

  AzureKeyVault service tag specifically represents the IP addresses used by Azure Key Vault. By using this service tag in your network security group (NSG) rules, you can allow or deny traffic to and from Azure Key Vault without needing to specify individual IP addresses. This is particularly useful for scenarios where you want to ensure secure access to your key vaults while blocking other outbound traffic. For example, if you want your virtual machines to access Vault1, you can create an outbound security rule in NSG1 with the destination set to the AzureKeyVault service tag. This allows the VMs to communicate with Azure Key Vault while keeping other outbound traffic blocked

• 4

  it says " least privilege" but B will give access to all vaults, not only vault1. I don't like this question. I would rather answer C and create a private endpoint to vault1 but one will say the question does not say there is a private endpoint, and it says least administrative task.... Those days, Who wants to favor less admin task compare to least permissions??