Question
You use Azure Virtual Network Manager to manage multiple virtual networks in a network group named Group1.
You discover that the virtual machines in Group1 are accessible from the internet by using TCP port 3389.
You need to block inbound TCP 3389 from the internet across all the virtual networks in Group1. The solution must minimize administrative effort.
What should you use?
- A. a connectivity configuration
- B. a security admin configuration Correct
- C. a user-defined route (UDR)
- D. a network security group (NSG)
Explanation
A security admin configuration holds rule collections that are associated with a network group, and when deployed its rules apply to every virtual network in that group. A Deny rule for inbound TCP 3389 is evaluated before NSG rules and stops the traffic, and 3389 is one of the high-risk ports the documentation recommends restricting this way. NSGs attach to individual subnets or network interfaces, so they would need configuring many times. A connectivity configuration defines the network topology, and a UDR controls routing rather than filtering a port.
