Examkin

Question

Difficulty: EasyConfigure Network Security Groups (NSGs) and Application Security Groups (ASGs)

A company has an Azure virtual network with two subnets named Subnet-Web and Subnet-DB. A virtual machine named VM-Web is deployed in Subnet-Web and associated with an Application Security Group (ASG) named ASG-Web. A virtual machine named VM-DB is deployed in Subnet-DB and associated with an ASG named ASG-DB.

A Network Security Group (NSG) named NSG-Web is associated with Subnet-Web, and an NSG named NSG-DB is associated with Subnet-DB.

In NSG-DB, the following inbound security rules are configured:
- Rule1: Priority 150, Source: ASG-Web, Destination: ASG-DB, Port: 80, Protocol: TCP, Action: Deny
- Rule2: Priority 250, Source: Any, Destination: Any, Port: 80, Protocol: TCP, Action: Allow

NSG-Web contains a custom outbound rule that allows all traffic on port 80 to ASG-DB.

What is the outcome when VM-Web attempts to establish an HTTP connection on TCP port 80 to VM-DB?

  1. The connection is blocked because NSG-DB evaluates Rule1 (priority 150) before Rule2 (priority 250), which denies the traffic.Answer
  2. B
    The connection is allowed because Rule2 in NSG-DB has a higher priority number (250) than Rule1 (150).
  3. C
    The connection is allowed because NSG-Web allows the outbound traffic, which automatically bypasses the inbound rules of NSG-DB.
  4. D
    The connection is allowed because Application Security Groups bypass inbound Network Security Group rules when VMs are in the same virtual network.

Answer

The connection is blocked because NSG-DB evaluates the rule with the lower priority number (150) first, which denies the traffic.
The connection is blocked because Azure Network Security Groups evaluate rules in ascending order of their priority numbers. Rule1 has a priority of 150, which is lower than Rule2's priority of 250. Because 150 is evaluated first and matches the source and destination ASGs on port 80, the traffic is denied immediately, and Rule2 is never processed.

Step-by-Step Solution

1
Evaluate the outbound path from VM-Web.
The traffic is allowed to leave Subnet-Web because NSG-Web has a custom outbound rule allowing port 80 to ASG-DB.
Traffic must pass outbound NSG rules at the source subnet and interface before reaching the destination.
2
Evaluate the inbound path at NSG-DB in order of rule priority.
Rule1 (priority 150) is compared against Rule2 (priority 250). Since 150 < 250, Rule1 is evaluated first.
Azure processes Network Security Group rules sequentially, starting with the lowest numerical priority value.
3
Match the traffic against the rule criteria in Rule1.
The traffic matches the source (ASG-Web), destination (ASG-DB), port (80), and protocol (TCP). The Deny action is applied.
Since a match is found, further rule evaluation (including Rule2) stops immediately, and the connection is blocked.

Key Concept

Azure NSG rule processing order and priority numbers
Estimated Time:1m 0s
Rate this question

Topics

Configure Network Security Groups (NSGs) and Application Security Groups (ASGs)