Exam SC-900 topic 1 question 86 discussion

Correct. https://docs.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works

Microsoft Purview Information Barriers (IB) is a compliance solution that allows you to restrict two-way communication and collaboration between groups and users in Microsoft Teams, SharePoint, and OneDrive.

Correct. Ref: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works

NSG = Virtual Network Subnet and Network Interface. As per my understanding, D (Virtual Network) is incorrect because the Azure Firewall is deployed there, while the NSG is for subnets.

A. a virtual network subnet B. a network interface

A. a virtual network subnet B. a network interface

Network security groups (NSGs) let you filter network traffic to and from Azure resources in an Azure virtual network; for example, a virtual machine. An NSG consists of rules that define how the traffic is filtered. YOU CAN ASSOCIATE ONLY ONE NETWORK SECURITY GROUP TO EACH VIRTUAL NETWORK SUBNET AND NETWORK INTERFACE IN A VIRTUAL MACHINE. The same network security group, however, can be associated to as many different subnets and network interfaces as you choose. https://learn.microsoft.com/en-us/training/modules/describe-basic-security-capabilities-azure/6-describe-azure-network-security-groups?ns-enrollment-type=learningpath&ns-enrollment-id=learn.wwl.describe-capabilities-of-microsoft-security-solutions

The two Azure resources that a network security group (NSG) can be associated with are: A. A virtual network subnet: NSGs can be associated with a virtual network subnet to enforce network security rules on the traffic flowing in and out of that specific subnet. By associating an NSG with a subnet, you can control the inbound and outbound traffic to the resources within that subnet. B. A network interface: NSGs can also be associated with a network interface, which is attached to a virtual machine or other Azure resources. By associating an NSG with a network interface, you can define rules to filter network traffic to and from that specific network interface, providing granular security control at the network level.

AB is the answer. https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works You can associate zero, or one, network security group to each virtual network subnet and network interface in a virtual machine. The same network security group can be associated to as many subnets and network interfaces as you choose.

Correct

Subnets and NICs

You can associate zero, or one, network security group to each virtual network subnet and network interface in a virtual machine. How network security groups filter network traffic https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works

B AND D a network interface of VM, and Virtual Network