A company's Azure environment contains two subnets named Subnet1 and Subnet2. Subnet1 is a… — Microsoft Azure Administrator (AZ-104)

A company's Azure environment contains two subnets named Subnet1 and Subnet2.
Subnet1 is associated with a Network Security Group (NSG) named NSG1.
Subnet1 contains two virtual machines named VM1 and VM2. The network interface of VM1 is associated with an Application Security Group (ASG) named ASG-Web. The network interface of VM2 is associated with an ASG named ASG-App.

NSG1 has the following inbound security rules:
- Rule1: Priority $120$ , Source: Any, Destination: ASG-Web, Port: $80$ , Action: Deny
- Rule2: Priority $180$ , Source: Any, Destination: ASG-Web, Port: $80$ , Action: Allow

You need to allow inbound HTTP traffic on port $80$ from the internet to VM1, while ensuring that security configurations for VM2 are not altered.

Which configuration change should you perform?

Change the priority of Rule2 to $110$ .Answer
B
Change the priority of Rule2 to $150$ .
C
Change the priority of Rule1 to $100$ .
D
Create a new inbound rule with priority $200$ that allows port $80$ traffic to ASG-Web.

Answer

Change the priority of Rule2 to

110

In Azure Network Security Groups, rules are evaluated sequentially based on their priority values, with lower numerical values receiving higher precedence. Currently, the Deny rule (Rule1) has a priority of 120, which is lower than the Allow rule (Rule2) with a priority of 180. As a result, the Deny rule is processed first and blocks the traffic. By changing the priority of the Allow rule (Rule2) to 110, it is evaluated before the Deny rule, allowing the inbound HTTP traffic to reach the destination interface associated with the target application security group.

Step-by-Step Solution

Analyze how Azure Network Security Group (NSG) rules are evaluated.

NSG rules are processed in priority order, where lower numbers have higher precedence.

To determine which rule currently applies to the incoming traffic on port 80.

Evaluate the current rule precedence for traffic targeting VM1 (associated with ASG-Web) on port 80.

Rule1 (Deny, priority 120) takes precedence over Rule2 (Allow, priority 180) because 120 is less than 180. Thus, traffic is blocked.

To identify why the inbound HTTP traffic is currently failing to reach the virtual machine.

Identify the change required to make the Allow rule take precedence over the Deny rule.

The Allow rule must be assigned a priority number lower than 120. Changing Rule2's priority to 110 meets this requirement.

Assigning a lower priority number ensures the Allow rule is processed before the Deny rule.

Key Concept

Azure NSG rule processing order is determined by rule priority numbers, where smaller numbers represent higher precedence.

Estimated Time:45s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics