This question tests your understanding of Network Security Groups (NSGs) and how to configure them to control outbound traffic - specifically to block access to the Azure portal while allowing other internet traffic.
# Scenario Summary
You have a subnet (Subnet1) containing Azure virtual machines.
The subnet is associated with NSG1, which currently has only the default rules.
You must prevent access to the Azure portal while allowing other internet access.
The Azure portal is accessed through HTTPS (TCP port 443) at the following URL:
https://portal.azure.com
Azure provides a convenient way to manage outbound/inbound traffic for Microsoft services using Service Tags.
# What are Service Tags?
A Service Tag is a predefined identifier for a specific Microsoft service or group of IP address prefixes managed by Azure.
Examples include AzureCloud, Storage, Sql, AppService, AzurePortal, etc.
When you use a service tag in a network security rule, Azure automatically manages the underlying IP ranges.
This ensures the rule stays up to date even if Microsoft changes IP addresses for that service.
# Applying to the Scenario
To block traffic from your subnet to the Azure portal, you can create an Outbound NSG rule in NSG1 with:
Direction: Outbound
Action: Deny
Protocol: TCP
Port: 443 (HTTPS)
Destination: Service tag = AzurePortal
This ensures that:
All outbound connections to the Azure portal are blocked.
Other outbound HTTPS connections (e.g., general internet browsing, APIs, etc.) remain unaffected, since they do not use the AzurePortal tag.
Using a Service Tag is the correct and Microsoft-recommended method for this configuration because it is specific, automatically maintained, and minimal in administrative effort.
# Why Not the Other Options
Option
Reason for Incorrectness
B). IP addresses
Not recommended because Azure portal IPs change frequently. Managing static IP lists would be error-prone and unscalable.
C). Application security group (ASG)
Used to group VM NICs for intra-subnet traffic control, not for targeting external Azure services.
D). Any
Would block all outbound traffic, not just Azure portal, violating the requirement to "connect to other internet destinations."
# Verified Microsoft Learn Documentation Extract
"Service tags represent a group of IP address prefixes from specific Azure services. You can use service tags in NSG rules to allow or deny traffic for the corresponding Azure service. The tag 'AzurePortal' can be used to control access to the Azure portal." (Source: Microsoft Learn - Use service tags to define network access controls on NSG rules, AZ-104 Exam Guide)
# Final Verified Answer: A. Service tag
Use the Service Tag AzurePortal in the NSG rule's Destination field to block outbound access to the Azure portal while allowing all other internet connections.

Cost analysis: Correct Option
In cost analysis blade of Azure, you can see all the detail for custom time span. You can use this to determine expenditure of last few day, weeks, and month. Below options are available in Cost analysis blade for filtering information by time span: last 7 days, last 30 days, and custom date range. Choosing the first option (last 7 days) auditors can view the costs by time span.
Cost analysis shows data for the current month by default. Use the date selector to switch to common date ranges quickly. Examples include the last seven days, the last month, the current year, or a custom date range.
Pay-as-you-go subscriptions also include date ranges based on your billing period, which isn't bound to the calendar month, like the current billing period or last invoice. Use the <PREVIOUS and NEXT> links at the top of the menu to jump to the previous or next period, respectively. For example, <PREVIOUS will switch from the Last 7 days to 8-14 days ago or 15-21 days ago.

Invoice: Incorrect Option
Invoices can only be used for past billing periods not for current billing period, i.e. if your requirement is to know the last week's cost then that also not filled by invoices because Azure generates invoice at the end of the month. Even though Invoices have custom timespan, but when you put in dates for a week, the pane would be empty. Below is from Microsoft document:

Resource Provider: Incorrect Option
When deploying resources, you frequently need to retrieve information about the resource providers and types. For example, if you want to store keys and secrets, you work with the Microsoft.KeyVault resource provider. This resource provider offers a resource type called vaults for creating the key vault. This is not useful for reviewing all Azure costs from the past week which is required for audit.
Payment method: Incorrect Option
Payment methods is not useful for reviewing all Azure costs from the past week which is required for audit.
Reference:
https://docs.microsoft.com/en-us/azure/cost-management-billing/costs/quick-acm-cost-analysis
https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/download-azure-invoice-daily- usage-date

Explanation:

In Azure App Service, a Web App must be hosted in an App Service Plan (ASP) that meets three key compatibility conditions:
The App Service Plan and the Web App must be in the same region.
The operating system (Windows or Linux) of the App Service Plan must match the Web App type.
The runtime stack of the Web App must be supported on the App Service Plan's OS.
Let's apply these rules to the scenario:
# App Service Plans:
Name
Operating System
Location
ASP1
Windows
West US
ASP2
Windows
Central US
ASP3
Linux
West US
# Web Apps:
Name
Runtime Stack
Location
WebApp1
NET Core 3.0
West US
WebApp2
ASP.NET 4.7
West US
1## WebApp1 (.NET Core 3.0, West US)
Region requirement: Must use an App Service Plan in West US # # ASP1 and ASP3 qualify.
Runtime requirement: .NET Core 3.0 supports both Windows and Linux App Service Plans.
(Microsoft Learn: ".NET Core apps can run on both Windows and Linux App Service plans.")
# Therefore, WebApp1 can use ASP1 (Windows, West US) or ASP3 (Linux, West US).
# Answer: ASP1 and ASP3 only
2## WebApp2 (ASP.NET 4.7, West US)
Region requirement: Must be in West US # # ASP1 and ASP3 qualify.
Runtime requirement: ASP.NET 4.7 is a Windows-only framework; it cannot run on Linux App Service Plans.
(Microsoft Learn: "ASP.NET (non-Core) apps require a Windows-based App Service Plan.")
# Therefore, only ASP1 (Windows, West US) is compatible.
# Answer: ASP1 only
# Final Verified Answers:
Web App
Compatible App Service Plans
WebApp1
ASP1 and ASP3 only
WebApp2
ASP1 only
Microsoft Documentation Extract (Azure App Service):
"App Service plans must be in the same region as the web app."
"Windows App Service plans host ASP.NET, .NET Core, and Node.js apps."
"Linux App Service plans host .NET Core, Node.js, Python, PHP, Java, and custom containers."
".NET Framework (ASP.NET 4.x) applications can only run on Windows-based App Service plans." Hence, the verified and Microsoft-official answer is:
# WebApp1 # ASP1 and ASP3 only
# WebApp2 # ASP1 only

Traffic Analytics analyzes the network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud1. NSG flow logs are a feature of Network Watcher that allows you to view information about ingress and egress IP traffic through an NSG2. To use Traffic Analytics, you need to enable NSG flow logs for the network security groups you want to monitor1.
Diagnostic settings for VM1 or NSG1 are not required for Traffic Analytics. Diagnostic settings are used to stream log data from an Azure resource to different destinations such as Log Analytics workspace, Event Hubs, or Storage account3. Insights for VM1 are also not required for Traffic Analytics. Insights are a feature of Azure Monitor that provide analysis of the performance and health of an Azure resource4.

Explanation:
No
No
No
In the given scenario, the storage account "contoso2023" has Allow storage account key access set to Disabled. This means that access keys and account-level Shared Access Signatures (SAS) cannot be used to authorize requests to the storage account. Only Azure AD authentication and user delegation SAS tokens are supported when key-based access is disabled.
Let's analyze each user according to Azure's documented storage access behavior:
* User1 - User delegation SAS:
* A user delegation SAS is based on Microsoft Entra (Azure AD) credentials and requires blob service (not file service).
* Since the user delegation SAS can only access Blob storage, and the question specifies cont1 (Blob container), this would normally allow access if Azure AD permissions exist. However, if no RBAC permissions are granted, access is denied by default.
* User2 - Service SAS:
* A service SAS uses a storage account key to sign the token.
* When Allow storage account key access is disabled, service SAS becomes invalid, because it relies on the account key.
* Therefore, User2 cannot access blob or file data using a service SAS in this configuration.
* User3 - Account SAS:
* An account SAS is also generated using the storage account key.
* With key access disabled, account SAS tokens are blocked, and any operation using them fails with an authorization error.
* Thus, User3 cannot access the content either in the blob container or the file share.
According to Microsoft Azure Administrator Documentation:
"When you disable storage account key access, requests that use the account access keys for authorization fail. Shared access signatures (SAS) that are signed with an account key or a service SAS become invalid.
Only user delegation SAS tokens, which use Azure AD credentials, are supported." This aligns with the behavior described in Azure Storage security documentation and AZ-104 study guides.