In this scenario, the problem involves a Network Security Group (NSG) configuration that determines inbound traffic rules for a virtual machine. The NSG rules for VM2 are evaluated in order of priority, from the lowest number (highest priority) to the highest number (lowest priority).
According to the exhibit, the effective NSG inbound rules for VM2 are:
Priority
Name
Port
Protocol
Source
Destination
Action
100
Allow_131.107.100.50
443
TCP
131.107.100.50
VirtualNetwork
Allow
200
Block_All_Other_443
443
TCP
Any
Any
Deny
65000
AllowVNetInBound
Any
Any
VirtualNetwork
VirtualNetwork
Allow
65001
AllowAzureLoadBalancerInBound
Any
Any
AzureLoadBalancer
Any
Allow
65500
DenyAllInBound
Any
Any
Any
Any
Deny
Root Cause Analysis:
You discovered that connections to App1 from 131.107.100.50 over TCP port 443 fail, even though the Load Balancer and backend pool are configured correctly.
From the rules shown, rule 100 (Allow_131.107.100.50) should theoretically allow that specific IP to connect on port 443. However, note that the Destination for the rule is VirtualNetwork, meaning that the traffic from
131.107.100.50 must be within the same virtual network address space to be permitted.
Since 131.107.100.50 is a public IP address (external source) and not part of the Virtual Network (VNet) address space, the rule does not apply, and the connection fails.
Additionally, the next rule (200 - Block_All_Other_443) explicitly denies any other inbound traffic on TCP
443 from any source. Therefore, the inbound traffic from 131.107.100.50 is blocked.
Evaluation of the Proposed Solution:
The proposed solution suggests creating an inbound security rule:
"Allow any traffic from the AzureLoadBalancer source and set priority to 150." However, the existing NSG already includes a built-in rule (65001 - AllowAzureLoadBalancerInBound) that allows inbound traffic from the Azure Load Balancer. That means traffic originating from the Azure Load Balancer front-end is already allowed by default.
Since the failed connection is coming from an external client (131.107.100.50) - not from the Load Balancer source itself - adding another rule allowing AzureLoadBalancer traffic does not resolve the issue. The correct action would be to modify or create a new rule that:
Allows inbound traffic on port 443
From source 131.107.100.50
With destination = Any
Priority lower than 200 (i.e., higher precedence than the deny rule)
Verified Microsoft Azure Administrator Reference:
From Microsoft Docs - Network security group overview and priority order:
"Azure processes the security rules in priority order, starting from the lowest number. Once a rule matches the traffic, processing stops. Lower-numbered priority rules override higher-numbered ones."
"The built-in rule AllowAzureLoadBalancerInBound allows traffic from Azure Load Balancer but not from external public IPs directly accessing the virtual machine." Correct Resolution:
You need to create a new inbound rule allowing TCP 443 from 131.107.100.50 with Destination: Any, Priority: < 200, for example:
Priority: 150
Source: IP address (131.107.100.50)
Destination: Any
Protocol: TCP
Port: 443
Action: Allow
This will ensure the traffic is allowed before the deny rule at 200 takes effect.
# Final Verified answer:
B). No
The proposed rule allowing traffic from AzureLoadBalancer does not help, because traffic from
131.107.100.50 originates externally, not from the Load Balancer. You must instead create a rule that explicitly allows that IP on port 443 with a higher priority than the existing deny rule.

Explanation:

B: You can gradually roll out Seamless SSO to your users. You start by adding the following Azure AD URL to all or selected users ' Intranet zone settings by using Group Policy in Active Directory: https://autologon.
microsoftazuread-sso.com
E: Seamless SSO works with any method of cloud authentication - Password Hash Synchronization or Pass- through Authentication, and can be enabled via Azure AD Connect.
References:
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso-quick-start
Topic 5, Litware, inc.Overview
Litware, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York.
The Montreal office has 2,000 employees. The Seattle office has 1,000 employees. The New York office has
200 employees.
All the resources used by Litware are hosted on-premises.
Litware creates a new Azure subscription. The Azure Active Directory (Azure AD) tenant uses a domain named Litware.onmicrosoft.com. The tenant uses the P1 pricing tier.
Existing Environment
The network contains an Active Directory forest named Litware.com. All domain controllers are configured as DNS servers and host the Litware.com DNS zone.
Litware has finance, human resources, sales, research, and information technology departments. Each department has an organizational unit (OU) that contains all the accounts of that respective department. All the user accounts have the department attribute set to their respective department. New users are added frequently.
Litware.com contains a user named User1.
All the offices connect by using private links.
Litware has data centers in the Montreal and Seattle offices. Each data center has a firewall that can be configured as a VPN device.
All infrastructure servers are virtualized. The virtualization environment contains the servers in the following table.

Litware uses two web applications named App1 and App2. Each instance on each web application requires
1GB of memory.
The Azure subscription contains the resources in the following table.

The network security team implements several network security groups (NSGs).
Planned Changes
Litware plans to implement the following changes:
* Deploy Azure ExpressRoute to the Montreal office.
* Migrate the virtual machines hosted on Server1 and Server2 to Azure.
* Synchronize on-premises Active Directory to Azure Active Directory (Azure AD).
* Migrate App1 and App2 to two Azure web apps named webApp1 and WebApp2.
Technical requirements
Litware must meet the following technical requirements:
* Ensure that WebApp1 can adjust the number of instances automatically based on the load and can scale up to five instance*.
* Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications servers in the Montreal office.
* Ensure that routing information is exchanged automatically between Azure and the routers in the Montreal office.
* Enable Azure Multi-Factor Authentication (MFA) for the users in the finance department only.
* Ensure that webapp2.azurewebsites.net can be accessed by using the name app2.Litware.com.
* Connect the New Your office to VNet1 over the Internet by using an encrypted connection.
* Create a workflow to send an email message when the settings of VM4 are modified.
* Create a custom Azure role named Role1 that is based on the Reader role.
* Minimize costs whenever possible.

Explanation:
-ResourceGroupName and Complete
The completed command should use -ResourceGroupName RG1 -Mode Complete. The New- AzResourceGroupDeployment cmdlet deploys an ARM template to an existing resource group, and Microsoft' s PowerShell syntax requires the target resource group to be identified by the -ResourceGroupName parameter. Microsoft's deployment guidance also states that, for resource group deployments, the resource group specified in -ResourceGroupName is the deployment target.
The second required value is Complete because the scenario explicitly requires resources in RG1 that are not specified in the template to be deleted. Microsoft defines complete mode as the deployment mode in which Resource Manager deletes resources that exist in the resource group but are not specified in the template. By contrast, incremental mode leaves existing resources unchanged when they are absent from the template, which would fail the deletion requirement.
Therefore, the command logic is:
New-AzResourceGroupDeployment -TemplateUri " https://contoso.com/template1 " -TemplateParameterFile params.json -ResourceGroupName RG1 -Mode Complete This maps to AZ-104 Deploy and manage Azure compute resources , specifically deploying and automating resources by using ARM templates.

Explanation:

https://learn.microsoft.com/en-us/powershell/module/az.resources/new-azresourcegroupdeployment?
view=azps-9.3.0#-resourcegroupname
Specifies the name of the resource group to deploy.
https://learn.microsoft.com/en-us/powershell/module/az.resources/new-azresourcegroupdeployment?
view=azps-9.3.0#-mode
Specifies the deployment mode. The acceptable values for this parameter are:
-Complete: In complete mode, Resource Manager deletes resources that exist in the resource group but are not specified in the template.
- Incremental: In incremental mode, Resource Manager leaves unchanged resources that exist in the resource group but are not specified in the template.