Microsoft Exam AZ-120 Topic 17 Question 87 Discussion

Actual exam question for Microsoft's AZ-120 exam

Question #: 87
Topic #: 17

You have an existing SAP landscape on Azure. All SAP virtual machines are on the same virtual network. The SAP application servers, SAP management servers, and SAP database servers are each on their own subnet

You need to ensure that only the application and management servers can access the subnet to which the database servers connect

What should you configure?

AAzure Key Vault secrets

BAzure Application Gateway and firewall rules

Cnetwork security groups (NSGs)

DAzure AD service principals

Show Suggested Answer

Suggested Answer: B

by Taryn at Apr 12, 2024, 03:05 AM

Limited Time Offer

25%

Off

Get Premium AZ-120 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Sheridan

5 months ago

I believe Azure Key Vault secrets might not be the best choice here, as we need to control access between specific subnets.

upvoted 0 times

...

Ernest

5 months ago

But wouldn't NSGs be easier to manage and more cost-effective in this scenario?

upvoted 0 times

...

Yesenia

5 months ago

I personally think Azure Application Gateway and firewall rules could also be a good option to control traffic.

upvoted 0 times

...

France

5 months ago

I agree with Ernest. NSGs are the best option to restrict access between different subnets.

upvoted 0 times

...

Ernest

6 months ago

I think we should configure network security groups (NSGs) to control the traffic between subnets.

upvoted 0 times

...

Dorsey

6 months ago

Key Vault secrets are more for storing sensitive information, not for controlling access within a virtual network

upvoted 0 times

...

Ryann

6 months ago

What about using Azure Key Vault secrets for extra security?

upvoted 0 times

...

Tyisha

6 months ago

I believe NSGs are sufficient as they can control traffic at the network level

upvoted 0 times

...

Leila

7 months ago

But wouldn't Azure Application Gateway and firewall rules be more effective in this scenario?

upvoted 0 times

...

Trina

7 months ago

I agree, NSGs can help us control traffic to the database servers subnet

upvoted 0 times

...

Terina

7 months ago

I think we should configure network security groups (NSGs)

upvoted 0 times

...

Gracia

8 months ago

Seriously, though, I think the NSGs are the way to go here. It's the most straightforward solution and it's what I would recommend to a client. Plus, it's a core Azure networking concept, so it's probably the answer they're looking for.

upvoted 0 times

...

Sabine

8 months ago

Haha, you guys are really overthinking this! I bet the answer is just to use some good old-fashioned network security groups. Simple and effective, just the way I like it.

upvoted 0 times

...

Shaun

8 months ago

Hmm, I was leaning towards B - Azure Application Gateway and firewall rules. That sounds like a more comprehensive solution that could handle the network traffic management. But I'm not 100% sure, we should really dig into the details on this one.

upvoted 0 times

Norah

6 months ago

That's true, but NSGs specifically cater to network security needs, which might be more suitable in this scenario.

upvoted 0 times

...

Ashleigh

6 months ago

But wouldn't Azure Application Gateway and firewall rules also be able to control traffic flow between different subnets?

upvoted 0 times

...

Billye

7 months ago

I agree with you. NSGs provide granular control over inbound and outbound traffic.

upvoted 0 times

...

Norah

7 months ago

I think C) network security groups (NSGs) would be the best option to restrict access to specific subnets.

upvoted 0 times

...

Sang

8 months ago

Haha, you know what would be really funny? If the answer was actually all of the above. Just go full-on security overkill on this SAP landscape. I bet that would confuse the heck out of the exam proctors.

upvoted 0 times

...

Tamie

8 months ago

You know, I was just reading about this in the Azure documentation. I think the answer is C - network security groups (NSGs). That's the way to go to control the traffic between the subnets and ensure only the application and management servers can access the database subnet.

upvoted 0 times

...

Kristel

8 months ago

Azure Key Vault secrets? Really? Come on, that's just silly. How is that going to help us control access to the database subnet? I think you're all overthinking this. Network security groups are the way to go. Simple and effective.

upvoted 0 times

...

Claribel

8 months ago

Ah, this is a tricky one! I'm not sure about the exact solution, but I think it has something to do with network security. Maybe we need to set up some firewall rules or network security groups to control the access?

upvoted 0 times

...

Alishia

8 months ago

Nah, you guys are way off base. It's clearly Azure Application Gateway and firewall rules. That's the best way to control access and secure that database subnet. Plus, you get all sorts of fancy load balancing and stuff with the Application Gateway. Definitely the way to go.

upvoted 0 times

Wai

7 months ago

B) Azure Application Gateway and firewall rules

upvoted 0 times

...

Jackie

7 months ago

C) network security groups (NSGs)

upvoted 0 times

...

Brunilda

7 months ago

B) Azure Application Gateway and firewall rules

upvoted 0 times

...

Ivette

7 months ago

A) Azure Key Vault secrets

upvoted 0 times

...

Hui

8 months ago

C) network security groups (NSGs)

upvoted 0 times

...

German

8 months ago

Hmm, I'm not so sure. What about Azure AD service principals? That could work too, right? We could set up some role-based access controls and restrict access that way. Seems like a more robust solution than just relying on network security groups.

upvoted 0 times

...

Bernardine

8 months ago

Ah, this question is a tricky one! I bet the exam writer had a field day coming up with this one. Let's see, I'm thinking network security groups (NSGs) would be the way to go here. That way, we can control access to the database subnet and only allow the app and management servers to connect. Easy peasy, right?

upvoted 0 times

...