A company deploys two virtual machines in the same subnet of an Azure virtual network. The… — Microsoft Azure Administrator (AZ-104)

A company deploys two virtual machines in the same subnet of an Azure virtual network. The network interface of the first virtual machine, named `VM-App`, is associated with an Application Security Group named `ASG-App`. The network interface of the second virtual machine, named `VM-Data`, is associated with an Application Security Group named `ASG-Data`. The subnet is associated with a Network Security Group named `NSG-Subnet` that contains the following inbound security rules:

* Rule1: Priority $150$ , Source: `ASG-App`, Destination: `ASG-Data`, Port: $1433$ , Protocol: TCP, Action: Allow
* Rule2: Priority $200$ , Source: `*`, Destination: `ASG-Data`, Port: $1433$ , Protocol: TCP, Action: Deny

A network interface-level Network Security Group named `NSG-NIC` is associated with the network interface of `VM-Data` and contains the following inbound security rules:

* Rule3: Priority $120$ , Source: `ASG-App`, Destination: `*`, Port: $1433$ , Protocol: TCP, Action: Allow
* Rule4: Priority $220$ , Source: `*`, Destination: `*`, Port: $1433$ , Protocol: TCP, Action: Deny

Which two of the following statements are correct? (Select two.)

Inbound TCP port $1433$ traffic from `VM-App` to `VM-Data` is allowed because both the subnet-level and network interface-level Network Security Groups permit the connection.Answer
Modifying the priority of Rule2 in `NSG-Subnet` to $100$ will block the inbound TCP port $1433$ traffic from `VM-App` to `VM-Data`.Answer
C
Changing the priority of Rule1 in `NSG-Subnet` to $250$ will guarantee that traffic from `VM-App` to `VM-Data` takes precedence and is allowed.
D
Inbound TCP port $1433$ traffic from `VM-App` to `VM-Data` is blocked because Rule2 in `NSG-Subnet` has a higher priority number ( $200$ ) than Rule1 ( $150$ ).

Answer

Inbound TCP port

1433

traffic from VM-App to VM-Data is allowed because both the subnet-level and network interface-level Network Security Groups permit the connection, and modifying the priority of Rule2 in NSG-Subnet to

100

will block the inbound TCP port

1433

traffic from VM-App to VM-Data.

Inbound traffic to an Azure VM network interface is evaluated first by the NSG associated with the subnet, and then by the NSG associated with the network interface. In both NSGs, rules are processed in priority order where lower numbers have higher precedence. The option stating that inbound TCP port

1433

traffic from VM-App to VM-Data is allowed because both levels permit the connection is correct because Rule1 (

150

) beats Rule2 (

200

) in NSG-Subnet, and Rule3 (

120

) beats Rule4 (

220

) in NSG-NIC. The option stating that modifying the priority of Rule2 to

100

blocks the traffic is correct because it gives the Deny rule higher precedence than the Allow rule (

150

Step-by-Step Solution

Evaluate the traffic against NSG-Subnet (subnet-level NSG) rules.

Rule1 (Allow) has a priority of

150

and Rule2 (Deny) has a priority of

200

. Since

150 < 200

, Rule1 has higher precedence. The traffic matches Rule1 and is allowed at the subnet level.

Azure processes inbound security rules in order of priority from lowest numerical value to highest.

Evaluate the traffic against NSG-NIC (NIC-level NSG) rules.

Rule3 (Allow) has a priority of

120

and Rule4 (Deny) has a priority of

220

. Since

120 < 220

, Rule3 has higher precedence. The traffic matches Rule3 and is allowed at the network interface level.

Inbound traffic must clear both the subnet-level NSG and the NIC-level NSG to be allowed.

Determine the impact of changing the priority of Rule2 (Deny) in NSG-Subnet to

100

With a priority of

100

, Rule2 is evaluated before Rule1 (priority

150

). Since Rule2 is a Deny rule, the traffic will be blocked at the subnet layer.

Lower priority numbers represent higher processing precedence.

Key Concept

Azure Network Security Group inbound rules are evaluated sequentially based on priority numbers (lower numbers represent higher precedence). For inbound traffic, the subnet-level NSG is evaluated first, followed by the network interface-level NSG. Traffic must be allowed by both NSGs to reach the destination.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics