An administrator is configuring network security for an Azure subscription containing a vi… — Microsoft Azure Administrator (AZ-104)

An administrator is configuring network security for an Azure subscription containing a virtual network named `VNet1`. `VNet1` contains two subnets: `Subnet-Web` ( $10.0.1.0/24$ ) and `Subnet-DB` ( $10.0.2.0/24$ ).

* `VM-Web1` is deployed in `Subnet-Web`, and its network interface is associated with an Application Security Group (ASG) named `ASG-Web`.
* `VM-DB1` is deployed in `Subnet-DB`, and its network interface is associated with an ASG named `ASG-DB`.
* A Network Security Group (NSG) named `NSG-Subnet` is associated with both `Subnet-Web` and `Subnet-DB`. `NSG-Subnet` contains a custom inbound rule named `Deny-CrossSubnet` with a priority of $200$ that denies all traffic between the two subnets.
* An NSG named `NSG-NIC` is associated only with the network interface of `VM-DB1`. `NSG-NIC` contains a custom inbound rule named `Deny-SQL` with a priority of $300$ that denies inbound TCP traffic on port $1433$ from any source.

You need to allow `VM-Web1` to establish a database connection to `VM-DB1` on TCP port $1433$ . The solution must follow the principle of least privilege.

Which two security rules should you add to achieve this goal? (Select TWO)

In `NSG-Subnet`, add an inbound rule with a priority of $150$ that allows TCP traffic on port $1433$ from `ASG-Web` to `ASG-DB`.Answer
In `NSG-NIC`, add an inbound rule with a priority of $250$ that allows TCP traffic on port $1433$ from `ASG-Web` to `ASG-DB`.Answer
C
In `NSG-Subnet`, add an inbound rule with a priority of $250$ that allows TCP traffic on port $1433$ from `ASG-Web` to `ASG-DB`.
D
In `NSG-NIC`, add an inbound rule with a priority of $350$ that allows TCP traffic on port $1433$ from `ASG-Web` to `ASG-DB`.
E
In `NSG-Subnet`, add an outbound rule with a priority of $150$ that allows TCP traffic on port $1433$ from `ASG-Web` to `ASG-DB`.
F
In `NSG-NIC`, add an inbound rule with a priority of $250$ that allows TCP traffic on port $1433$ from `ASG-DB` to `ASG-Web`.

Answer

To allow the connection under the principle of least privilege, you must add an inbound rule to `NSG-Subnet` with a priority of

150

allowing TCP port

1433

from `ASG-Web` to `ASG-DB`, and an inbound rule to `NSG-NIC` with a priority of

250

allowing TCP port

1433

from `ASG-Web` to `ASG-DB`.

For inbound traffic to reach a virtual machine associated with both a subnet NSG and a NIC NSG, the traffic must be allowed by both security boundaries. Since custom rules in both the subnet-level NSG (priority 200) and the NIC-level NSG (priority 300) currently deny this traffic, we must add an allow rule in each NSG. To override the existing deny rules, the new rules must have higher precedence (lower priority numbers, such as 150 for NSG-Subnet and 250 for NSG-NIC) and target the correct traffic flow from the web server's ASG to the database server's ASG on TCP port 1433.

Step-by-Step Solution

Analyze the outbound traffic path from VM-Web1.

Outbound traffic from VM-Web1 is evaluated by the outbound rules of NSG-Subnet (since VM-Web1 has no NIC-level NSG). There are no custom outbound deny rules, so the default AllowVNetOutBound rule allows the outbound traffic.

Azure processes security rules sequentially starting with the subnet-level NSG for outbound traffic, then the NIC-level NSG.

Evaluate the inbound traffic path at the subnet level for VM-DB1.

The traffic is blocked by the Deny-CrossSubnet rule (priority 200) in NSG-Subnet.

An inbound security rule with a lower priority number (higher precedence) than 200 must be added to NSG-Subnet to explicitly allow the traffic.

Evaluate the inbound traffic path at the NIC level for VM-DB1.

The traffic is blocked by the Deny-SQL rule (priority 300) in NSG-NIC.

An inbound security rule with a lower priority number (higher precedence) than 300 must be added to NSG-NIC to explicitly allow the traffic.

Key Concept

Azure Network Security Group (NSG) rule processing hierarchy (subnet-level then NIC-level for inbound traffic), rule priority evaluation (lower numbers take precedence), and the use of Application Security Groups (ASGs) to define granular source/destination filters.

Estimated Time:2m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics