A design uses standard brokered TCP AVD user connections. The managed-network Shortpath listener is disabled. The hosts have NSGs at both subnet and NIC, and egress crosses a security appliance. Which controls support the normal AVD service connection?

✓ Correct answers

• Exclude AVD service traffic from TLS inspection or termination.
• Permit required outbound TCP 443 traffic through both applicable NSG rule sets.

Normal reverse-connect service traffic uses outbound TCP 443 and requires permitted effective rules. Preserve native TLS and allow the complete documented dependency set; ordinary brokered TCP user access does not require public inbound RDP. Option explanations: A. Expose inbound public TCP 3389 to users on each host.: Public inbound TCP 3389 is not required for normal brokered user connections. B. Allow only the WindowsVirtualDesktop FQDN tag and block every other identity, storage, and update dependency.: The AVD tag does not cover every supporting dependency, so this policy would break required services. C. Exclude AVD service traffic from TLS inspection or termination.: AVD service traffic must preserve its native TLS connection. D. Permit required outbound TCP 443 traffic through both applicable NSG rule sets.: Both applicable NSGs must permit the required connection; an allow at only one layer is insufficient. Sources: Use Azure Firewall to protect Azure Virtual Desktop deployments — https://learn.microsoft.com/en-us/azure/firewall/protect-azure-virtual-desktop; Required FQDNs and endpoints for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/required-fqdn-endpoint; RDP Shortpath for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rdp-shortpath

Read the source reference