Azure Administrator (AZ-104) · Free practice question 8 of 12
Regional service tags in NSG rules
VMs in the snet-data subnet at Lowther Mining must be allowed outbound access only to Azure Storage in the East US region, and the rule must adapt automatically when Microsoft changes the service's IP ranges. What should you use as the destination in the outbound NSG rule?
- A.An application security group containing the storage account
- B.The public IP address of the storage account
- C.The VirtualNetwork service tag
- D.The Storage.EastUS service tag
Show answer and explanation
Correct answer: D. The Storage.EastUS service tag
Why: Service tags represent groups of IP prefixes for Azure services and are maintained by Microsoft, and regional tags such as Storage.EastUS limit the scope to one region. ASGs contain VM network interfaces, not PaaS services. A single public IP address is not stable or complete for a service, and VirtualNetwork covers your own address space.
More free Azure Administrator (AZ-104) questions
- Elevate Global Administrator access
- Registering a resource provider
- Static website hosting in Storage
- Secure transfer required setting
- Spot VMs for interruptible workloads
- Proximity placement groups
- App Service Always On
- NAT gateway for predictable outbound IP
- Azure DNS alias record at apex
- Metric alerts with dynamic thresholds
- Service Health alerts