Examkin

Question

Difficulty: Very hardConfigure Network Security Groups (NSGs) and Application Security Groups (ASGs)

You have an Azure subscription that contains a virtual network named `VNet1`. `VNet1` contains a single subnet named `Subnet1`.

`Subnet1` contains two virtual machines: `VM1` and `VM2`.
- The network interface of `VM1` is associated with an Application Security Group named `ASG-Web`.
- The network interface of `VM2` is associated with an Application Security Group named `ASG-DB`.

A Network Security Group named `NSG1` is associated with `Subnet1`. No other Network Security Groups are deployed.
`NSG1` contains the rules shown in the following tables:

Inbound Security Rules
PrioritySourceDestinationPortProtocolAction
120120AnyASG-DB14331433TCPDeny
220220ASG-WebASG-DB14331433TCPAllow
Outbound Security Rules
PrioritySourceDestinationPortProtocolAction
130130ASG-WebAny14331433TCPAllow
230230ASG-WebASG-DB14331433TCPDeny

A database application running on `VM2` listens on TCP port 14331433. `VM1` attempts to establish a connection to `VM2` on TCP port 14331433.

What is the result of the connection attempt?

  1. The connection is blocked inbound because the inbound rule at priority 120 takes precedence over the rule at priority 220.Answer
  2. B
    The connection is allowed because the inbound rule at priority 220 has a higher priority number, indicating it has higher precedence.
  3. C
    The connection is blocked outbound because the rule at priority 230 is more specific and overrides the wildcard rule at priority 130.
  4. D
    The connection is allowed because the outbound rule at priority 130 permits the traffic, and inbound rules are bypassed for intra-subnet communication.

Answer

The connection is blocked inbound because the inbound rule at priority 120 takes precedence over the rule at priority 220.
The correct answer is correct because Azure NSGs evaluate rules in order of priority, where lower numbers have higher precedence. For intra-subnet traffic, subnet-level NSG rules are evaluated twice: outbound from the source VM and inbound to the destination VM. Outbound, the rule at priority 130 (Allow) takes precedence over the rule at priority 230 (Deny). Inbound, the rule at priority 120 (Deny) takes precedence over the rule at priority 220 (Allow), resulting in the connection being blocked inbound.

Step-by-Step Solution

1
Determine the traffic path and identify which NSG rules apply to the source and destination virtual machines.
Traffic flows from VM1 (source) to VM2 (destination) within Subnet1. Subnet1 is associated with NSG1. Therefore, NSG1 rules are evaluated for both outbound traffic from VM1 and inbound traffic to VM2.
Since both virtual machines reside in the same subnet and share the same subnet-level NSG, the NSG rules must be evaluated for both outbound and inbound directions of the intra-subnet communication.
2
Evaluate the outbound rules of NSG1 for VM1's outbound traffic.
Rule 130 (Allow, Priority 130) and Rule 230 (Deny, Priority 230) both match the traffic profile (Source: ASG-Web, Destination: Any/ASG-DB, Port: 1433). Rule 130 has a lower priority number (130130 vs 230230) and therefore takes precedence, allowing the traffic outbound.
Azure NSG rules are evaluated in ascending order of priority. Lower numbers have higher precedence, and the first matching rule determines the outcome.
3
Evaluate the inbound rules of NSG1 for VM2's inbound traffic.
Rule 120 (Deny, Priority 120) and Rule 220 (Allow, Priority 220) both match the inbound traffic profile (Source: ASG-Web/Any, Destination: ASG-DB, Port: 1433). Rule 120 has a lower priority number (120120 vs 220220) and therefore takes precedence, denying the traffic inbound.
Lower priority numbers represent higher precedence in Azure NSGs. The Deny rule at priority 120 takes precedence over the Allow rule at priority 220.
4
Combine the outbound and inbound evaluation results to determine the final connection state.
Although the traffic is allowed outbound from VM1, it is blocked inbound at VM2 by the priority 120 inbound rule. The connection attempt fails.
For a network connection to succeed in Azure, traffic must be allowed by both the outbound NSG rules of the source and the inbound NSG rules of the destination.

Key Concept

Subnet-level NSG rule evaluation for intra-subnet traffic and priority-based rule precedence.
Estimated Time:3m 0s
Rate this question

Topics

Configure Network Security Groups (NSGs) and Application Security Groups (ASGs)