You are managing an Azure environment with a single virtual network named `VNet1`. The vir… — Microsoft Azure Administrator (AZ-104)

You are managing an Azure environment with a single virtual network named `VNet1`. The virtual network contains two subnets: `Subnet-Web` and `Subnet-DB`.

The resources are configured as follows:
- A virtual machine named `VM-Web` is deployed in `Subnet-Web` and is associated with an Application Security Group named `ASG-Web`.
- A virtual machine named `VM-DB` is deployed in `Subnet-DB` and is associated with an Application Security Group named `ASG-DB`.
- A Network Security Group named `NSG-Subnet-DB` is associated with `Subnet-DB`.
- A Network Security Group named `NSG-NIC-DB` is associated with the network interface of `VM-DB`.

`NSG-Subnet-DB` contains the following inbound security rules:

Priority	Source	Source Port	Destination	Destination Port	Protocol	Action
$200$	`ASG-Web`	`*`	`ASG-DB`	$5432$	TCP	Allow
$300$	`VirtualNetwork`	`*`	`VirtualNetwork`	$5432$	TCP	Deny

`NSG-NIC-DB` contains the following inbound security rules:

Priority	Source	Source Port	Destination	Destination Port	Protocol	Action
$150$	`VirtualNetwork`	`*`	`ASG-DB`	$5432$	TCP	Deny
$250$	`ASG-Web`	`*`	`ASG-DB`	$5432$	TCP	Allow

`VM-Web` attempts to establish a database connection to `VM-DB` on TCP port $5432$ .

What is the outcome of this connection attempt?

The connection is blocked because the inbound rule with priority $150$ in `NSG-NIC-DB` matches and denies the traffic.Answer
B
The connection is allowed because the inbound rule with priority $200$ in `NSG-Subnet-DB` allows the traffic, which takes precedence over network interface rules.
C
The connection is allowed because the inbound rule with priority $250$ in `NSG-NIC-DB` specifically allows traffic from `ASG-Web` to `ASG-DB`.
D
The connection is blocked because the inbound rule with priority $300$ in `NSG-Subnet-DB` denies the traffic.

Answer

The connection is blocked because the inbound rule with priority

150

in `NSG-NIC-DB` matches and denies the traffic.

For inbound traffic to a VM, Azure first evaluates the NSG associated with the subnet, followed by the NSG associated with the network interface (NIC). At each level, rules are processed sequentially by priority number (lowest value first), and evaluation stops at the first matching rule. In this scenario, the subnet NSG allows the traffic at priority

200

. Then, the NIC NSG evaluates the traffic. The rule with priority

150

(Deny) matches the traffic because the source VM is in the same virtual network (VirtualNetwork) and the destination is the database ASG on port

5432

. Because priority

150

is lower than

250

, the Deny rule matches first, blocking the connection.

Step-by-Step Solution

Evaluate the subnet-level NSG (NSG-Subnet-DB) for the inbound traffic from VM-Web to VM-DB on TCP port 5432.

The traffic is allowed by the rule with priority 200 (Source: ASG-Web, Destination: ASG-DB, Port: 5432, Action: Allow) because rule 200 is processed before rule 300.

For inbound traffic, Azure processes the subnet-level NSG first. Rules within an NSG are processed in priority order (lowest number first), and processing stops on the first match.

Evaluate the network interface-level NSG (NSG-NIC-DB) for the inbound traffic.

The traffic matches the rule with priority 150 (Source: VirtualNetwork, Destination: ASG-DB, Port: 5432, Action: Deny) because VM-Web's IP is within the VirtualNetwork prefix.

If the subnet NSG allows the traffic, the NIC NSG is processed next. Rules are again processed in priority order.

Determine the final state of the traffic connection.

The connection is blocked at the network interface level by the priority 150 rule.

Since the NIC NSG matches a Deny rule (priority 150) before reaching the Allow rule (priority 250), the traffic is dropped.

Key Concept

Inbound NSG traffic evaluation flow and rule priority logic using Application Security Groups (ASGs)

Estimated Time:1m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics