You have an Azure subscription that contains a virtual network named `VNet1`. `VNet1` cont… — Microsoft Azure Administrator (AZ-104)

You have an Azure subscription that contains a virtual network named `VNet1`. `VNet1` contains two subnets: `SubnetA` ( $10.0.1.0/24$ ) and `SubnetB` ( $10.0.2.0/24$ ).

The virtual machines are configured as follows:
* `VM1` is in `SubnetA` and has a network interface named `NIC1`. `NIC1` is associated with an Application Security Group named `ASG-Web`.
* `VM2` is in `SubnetB` and has a network interface named `NIC2`. `NIC2` is associated with an Application Security Group named `ASG-DB`.
* `VM3` is in `SubnetB` and has a network interface named `NIC3`. `NIC3` is not associated with any Application Security Group.

The Network Security Groups (NSGs) are configured as follows:
* `NSG-SubnetA` is associated with `SubnetA`.
* `NSG-NIC1` is associated with `NIC1`.
* `NSG-NIC2` is associated with `NIC2`.
* `SubnetB` and `NIC3` have no associated NSGs.

The NSGs contain the following custom rules:

NSG-SubnetA Outbound Rules:

Priority	Source	Destination	Port	Protocol	Action
$120$	`ASG-Web`	`ASG-DB`	$1433$	TCP	Allow
$150$	Any	Any	$1433$	TCP	Deny

NSG-NIC1 Outbound Rules:

Priority	Source	Destination	Port	Protocol	Action
$100$	Any	$10.0.2.0/24$	$1433$	TCP	Allow

NSG-NIC2 Inbound Rules:

Priority	Source	Destination	Port	Protocol	Action
$110$	$10.0.1.0/24$	Any	$1433$	TCP	Deny
$130$	`ASG-Web`	`ASG-DB`	$1433$	TCP	Allow

Which of the following statements correctly describe the connectivity when `VM1` attempts to establish a TCP connection to `VM2` and `VM3` on port $1433$ ? (Select TWO.)

Traffic from `VM1` to `VM2` is blocked inbound by the Network Security Group on `VM2`'s network interface because the Deny rule with priority $110$ is evaluated before the Allow rule with priority $130$ .Answer
Traffic from `VM1` to `VM3` is blocked outbound by the Network Security Group on `SubnetA` because it does not match the Allow rule with priority $120$ and matches the Deny rule with priority $150$ .Answer
C
Traffic from `VM1` to `VM2` is allowed because the Allow rule with priority $130$ takes precedence because it specifies a more granular Application Security Group (ASG) mapping than the subnet prefix in the rule with priority $110$ .
D
Traffic from `VM1` to `VM3` is allowed because `VM3` has no Network Security Group associated with its subnet or network interface, bypassing the outbound restrictions of `SubnetA`.

Answer

Traffic from VM1 to VM2 is blocked inbound by the Network Security Group on VM2's network interface because the Deny rule with priority 110 is evaluated before the Allow rule with priority 130. Traffic from VM1 to VM3 is blocked outbound by the Network Security Group on SubnetA because it does not match the Allow rule with priority 120 and is blocked by the Deny rule with priority 150.

The correct statements recognize that NSG rules are evaluated in a specific order: priority numbers are processed sequentially from lowest to highest, and both NIC and Subnet NSGs must allow traffic. Traffic from VM1 to VM2 passes outbound checks but is blocked inbound at VM2's NIC because the Deny rule (priority 110) is evaluated before the Allow rule (priority 130). Traffic from VM1 to VM3 is blocked outbound at SubnetA because VM3 is not part of ASG-DB, meaning the traffic misses the priority 120 Allow rule and matches the priority 150 Deny rule.

Step-by-Step Solution

Evaluate outbound traffic from VM1 to VM2.

NIC-level NSG (NSG-NIC1) allows it via priority 100 rule (destination 10.0.2.0/24). Subnet-level NSG (NSG-SubnetA) allows it via priority 120 rule (source ASG-Web to destination ASG-DB). Outbound traffic successfully leaves SubnetA.

For outbound traffic, the NIC NSG is evaluated first, followed by the Subnet NSG.

Evaluate inbound traffic to VM2.

SubnetB has no NSG. NIC-level NSG (NSG-NIC2) contains two rules matching VM1 (IP 10.0.1.4, member of ASG-Web). The priority 110 rule (Deny from 10.0.1.0/24) takes precedence over the priority 130 rule (Allow from ASG-Web) due to its lower priority number. The traffic is blocked inbound.

NSG rules are processed in priority order (lowest number first), and inbound traffic requires both subnet-level and NIC-level NSGs to allow it (if present).

Evaluate outbound traffic from VM1 to VM3.

NIC-level NSG (NSG-NIC1) allows it (priority 100). Subnet-level NSG (NSG-SubnetA) does not match the priority 120 rule because VM3 is not associated with ASG-DB. The traffic matches the priority 150 rule (Deny) and is blocked outbound.

Since VM3 is not a member of ASG-DB, it fails the destination criteria of the priority 120 rule, falling back to the generic Deny rule at priority 150.

Key Concept

NSG rule evaluation order, ASG membership application, and subnet-level vs. NIC-level NSG enforcement flow.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics