An administrator is configuring network security for a two-tier application in an Azure su… — Microsoft Azure Administrator (AZ-104)

An administrator is configuring network security for a two-tier application in an Azure subscription. The subscription contains a virtual network named `VNet1` with two subnets: `Subnet-Web` (address space $10.10.1.0/24$ ) and `Subnet-DB` (address space $10.10.2.0/24$ ).

A virtual machine named `VM-Web1` is deployed in `Subnet-Web` and associated with an Application Security Group named `ASG-Web`.
A virtual machine named `VM-DB1` is deployed in `Subnet-DB` and associated with an Application Security Group named `ASG-DB`.

A Network Security Group named `NSG-Web` is associated with `Subnet-Web` and contains the following custom inbound rule:
- Name: `DenyInternetInbound`, Priority: $1500$ , Source: `Internet`, Destination: `Any`, Port: `*`, Protocol: `Any`, Action: Deny

A Network Security Group named `NSG-DB` is associated with `Subnet-DB` and contains the following custom inbound rule:
- Name: `DenyVNetInbound`, Priority: $2000$ , Source: `VirtualNetwork`, Destination: `Any`, Port: `*`, Protocol: `Any`, Action: Deny

No Network Security Groups are associated with the virtual machine network interfaces.

You must configure the NSGs to meet the following requirements:
1. Allow HTTPS traffic (port $443$ ) from the Internet to `VM-Web1` only.
2. Allow PostgreSQL traffic (port $5432$ ) from `VM-Web1` to `VM-DB1` only.
3. Minimize the number of rules and adhere to the principle of least privilege.

Which two security rules should you create to meet the requirements?

In `NSG-Web`, create an inbound rule with Priority $100$ , Source: `Internet`, Destination: `ASG-Web`, Port: $443$ , Action: Allow.Answer
In `NSG-DB`, create an inbound rule with Priority $500$ , Source: `ASG-Web`, Destination: `ASG-DB`, Port: $5432$ , Action: Allow.Answer
C
In `NSG-Web`, create an inbound rule with Priority $1800$ , Source: `Internet`, Destination: `ASG-Web`, Port: $443$ , Action: Allow.
D
In `NSG-DB`, create an inbound rule with Priority $2200$ , Source: `ASG-Web`, Destination: `ASG-DB`, Port: $5432$ , Action: Allow.

Answer

To meet the requirements, you must create an inbound rule in `NSG-Web` to allow HTTPS traffic to `ASG-Web` on port

443

with a priority value lower than

1500

(such as

100

), and create an inbound rule in `NSG-DB` to allow PostgreSQL traffic from `ASG-Web` to `ASG-DB` on port

5432

with a priority value lower than

2000

(such as

500

To allow inbound HTTPS traffic from the Internet to `VM-Web1` (associated with `ASG-Web`), you must add a rule in `NSG-Web` with a priority lower than

1500

(e.g.,

100

) because the existing deny rule is at priority

1500

. Similarly, to allow inbound PostgreSQL traffic on port

5432

from `VM-Web1` (`ASG-Web`) to `VM-DB1` (`ASG-DB`), you must add a rule in `NSG-DB` with a priority lower than

2000

(e.g.,

500

) because the existing VNet deny rule is at priority

2000

Step-by-Step Solution

Analyze the traffic requirements and existing NSG rules for the web tier.

The web tier (`VM-Web1` in `Subnet-Web`) needs to receive inbound HTTPS traffic (port

443

) from the Internet. The existing `NSG-Web` has a custom deny rule with priority

1500

that blocks all inbound internet traffic.

To allow the required HTTPS traffic, a new allow rule must be created with a priority number less than

1500

Analyze the traffic requirements and existing NSG rules for the database tier.

The database tier (`VM-DB1` in `Subnet-DB`) needs to receive PostgreSQL traffic (port

5432

) from `VM-Web1`. The existing `NSG-DB` has a custom deny rule with priority

2000

that blocks all inbound VNet traffic.

To allow the PostgreSQL traffic, a new allow rule must be created with a priority number less than

2000

Determine the correct source and destination security tags for least privilege.

For the web tier, the destination should be limited to the `ASG-Web` group. For the database tier, the source should be `ASG-Web` and the destination should be `ASG-DB`.

Using Application Security Groups (ASGs) ensures that the rules apply specifically to the designated VMs rather than the entire subnet, fulfilling the least privilege requirement.

Key Concept

Application Security Groups (ASGs) allow you to configure network security as a natural extension of an application's structure, grouping virtual machines and defining network security policies based on those groups. Network Security Group (NSG) rules are evaluated by priority, where lower numbers have higher precedence and are processed first. To override a deny rule, the allow rule must have a lower priority number.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics