SC-100 Certification Practice Question #193

Question

You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named contoso.com. Sub1 contains 20 virtual networks named Sub1_VNet1 through Sub1_VNet20.

You have an Azure subscription named Sub2 that is linked to a Microsoft Entra tenant named fabrikam.com. Sub2 contains 20 virtual networks named Sub2_VNet1 through Sub2_VNet20.

You need to deploy an Azure Virtual Network Manager solution that meets the following requirements:
•	Blocks SSH traffic on Sub1_VNet20 and Sub2_VNet20 by using network security groups (NSGs)
•	Blocks SSH traffic on Sub1_VNet1 through Sub1_VNet19 and Sub2_VNet1 through Sub2_VNet19
•	Allows SSH traffic on Sub1_VNet20 and Sub2_VNet20
•	Blocks FTP traffic on all the virtual networks
•	Minimizes administrative effort

What is minimum number of components required for the deployment?

Accepted Answer

Azure Virtual Network Manager is a single centralized service that manages VNets globally across subscriptions and tenants, so only one VNM instance is required despite Sub1 and Sub2 living in different Entra tenants (cross-tenant support uses a two-way connection, not a second instance). That eliminates B and C. The requirements split the VNets into two security profiles — VNet1–19 (block SSH, block FTP) and VNet20 (allow SSH, block FTP) — which need two distinct rule sets, hence 2 rule collections targeting 2 NSGs. Option A's single rule collection cannot satisfy the conflicting SSH allow/deny in one set, so D is the minimum. Confidence is held at 86 (not higher) because the official Suggested Answer and the strongest community vote agree, but MS Learn documents the cross-tenant/scope concept rather than this exact component-counting scenario.

More SC-100 practice questions