Question
You have an on-premises server named Server1 that runs Windows Server.
You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Windows Server. The subscription contains a network security group (NSG) named NSG1 that has the following custom rules.
| Name | Priority | Port | Protocol | Source | Destination | Action | Direction |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Rule1 | 100 | 443 | TCP | VirtualNetwork | Internet | Block | Outbound |
| Rule2 | 200 | Any | Any | Internet | VirtualNetwork | Block | Inbound |
The network interface of VM1 is associated with NSG1.
You plan to manage VM1 from Server1 by using Windows Admin Center from the Azure portal.
You need to ensure that you can install Windows Admin Center on VM1 by using the Azure portal. The solution must minimize administrative effort.
What should you do?
- A. Modify the priority of Rule2 and add an outbound port rule.
- B. Modify the priority of Rule1 and add an inbound port rule.
- C. Modify the priority of Rule2 and add an inbound port rule.
- D. Modify the priority of Rule1 and add an outbound port rule. Correct
Explanation
To install Windows Admin Center from the Azure portal, the VM must reach the Windows Admin Center service over HTTPS. The requirement is outbound internet access or an outbound port rule that allows TCP 443 to the WindowsAdminCenter and AzureActiveDirectory service tags. Rule1 blocks outbound TCP 443 from VirtualNetwork to Internet at priority 100, the highest custom priority, and the outbound rule the portal creates also uses priority 100. You therefore change Rule1 to a lower priority (a higher number) and add an outbound allow rule for 443 that is processed before it. Rule2 only blocks inbound traffic from the Internet. An inbound rule is needed only to connect to Windows Admin Center through a public IP address, not to install it, so changing Rule2 or adding an inbound rule does not fix the installation.
