An administrator is configuring network security for an Azure subscription containing a vi… — Microsoft Azure Administrator (AZ-104)

An administrator is configuring network security for an Azure subscription containing a virtual network named `VNet1`. `VNet1` contains two subnets: `Subnet-Web` ( $10.0.1.0/24$ ) and `Subnet-DB` ( $10.0.2.0/24$ ).

The subnets contain the following virtual machines and network configurations:

Subnet	VM Name	Private IP	NIC Name	ASG Association
`Subnet-Web`	`VM-Web1`	` $10.0.1.4$ `	`nic-web1`	`ASG-Web`
`Subnet-Web`	`VM-Web2`	` $10.0.1.5$ `	`nic-web2`	`ASG-Web`
`Subnet-DB`	`VM-DB1`	` $10.0.2.4$ `	`nic-db1`	`ASG-DB`
`Subnet-DB`	`VM-DB2`	` $10.0.2.5$ `	`nic-db2`	None

A Network Security Group named `NSG-DB` is associated with `Subnet-DB`. No other Network Security Groups are associated with the subnets or network interfaces (NICs).

You must configure `NSG-DB` to meet the following requirements:
- Allow inbound SQL Database traffic (TCP port $1433$ ) from `VM-Web1` to `VM-DB1` only.
- Block all other TCP port $1433$ traffic from `Subnet-Web` to `Subnet-DB`.
- Minimize administrative effort and follow the principle of least privilege.

Which two of the following inbound security rules should you add to `NSG-DB` to meet these requirements? (Select two.)

An inbound rule with Priority $120$ , Source: IP Addresses (`10.0.1.4`), Destination: Application security group (`ASG-DB`), Port: 1433, Protocol: TCP, Action: AllowAnswer
An inbound rule with Priority $250$ , Source: Service Tag (`VirtualNetwork`), Destination: Service Tag (`VirtualNetwork`), Port: 1433, Protocol: TCP, Action: DenyAnswer
C
An inbound rule with Priority $120$ , Source: Application security group (`ASG-Web`), Destination: Application security group (`ASG-DB`), Port: 1433, Protocol: TCP, Action: Allow
D
An inbound rule with Priority $250$ , Source: IP Addresses (`10.0.1.4`), Destination: Application security group (`ASG-DB`), Port: 1433, Protocol: TCP, Action: Allow
E
An inbound rule with Priority $120$ , Source: Service Tag (`VirtualNetwork`), Destination: Service Tag (`VirtualNetwork`), Port: 1433, Protocol: TCP, Action: Deny

Answer

Configure an inbound rule in NSG-DB with Priority 120, Source IP 10.0.1.4, Destination ASG-DB, Port 1433, TCP, Allow; and a second inbound rule with Priority 250, Source Service Tag VirtualNetwork, Destination Service Tag VirtualNetwork, Port 1433, TCP, Deny.

The correct configuration consists of: 1) An inbound rule allowing traffic from VM-Web1's IP address (10.0.1.4) to the ASG-DB group with a higher precedence (Priority 120). 2) A broader inbound rule denying all TCP 1433 traffic within the VirtualNetwork service tag scope with a lower precedence (Priority 250). Since NSG rules are evaluated in order of priority (lowest number first), traffic from VM-Web1 to VM-DB1 matches the Allow rule at Priority 120 and is permitted. All other TCP 1433 traffic between Subnet-Web and Subnet-DB bypasses the first rule (due to mismatched source IP or destination ASG) and is blocked by the Deny rule at Priority 250.

Step-by-Step Solution

Determine the source identity for VM-Web1.

Since ASG-Web contains both VM-Web1 and VM-Web2, it cannot be used as the source in the allow rule because that would allow VM-Web2 traffic. Therefore, VM-Web1's IP address (10.0.1.4) must be used as the source to follow the principle of least privilege.

We must only allow VM-Web1, not VM-Web2.

Determine the destination identity for VM-DB1.

VM-DB1's network interface is associated with ASG-DB, whereas VM-DB2 has no ASG association. By using ASG-DB as the destination, we target only VM-DB1.

We must allow traffic to VM-DB1 while ensuring VM-DB2 remains blocked.

Select the correct action and priority for the allow rule.

An inbound Allow rule with a lower priority number (120) must be created to permit TCP port 1433 traffic from 10.0.1.4 to ASG-DB.

Lower priority numbers have higher precedence in NSG rule evaluation, ensuring the allow rule is processed before any generic block rules.

Design the block rule to restrict other SQL traffic.

An inbound Deny rule with a higher priority number (250) using the VirtualNetwork service tag for both source and destination must be created.

This blocks all other inter-subnet SQL traffic (VM-Web2 to VM-DB1, VM-Web1 to VM-DB2, and VM-Web2 to VM-DB2) while allowing the specific VM-Web1 to VM-DB1 traffic allowed by the higher precedence rule.

Key Concept

NSG rules are processed in priority order (lowest numbers first). Once a match is found, no further rules are processed. Application Security Groups allow grouping network interfaces for rule application, but if an ASG contains multiple hosts, individual IP address rules must be used to enforce granular access control.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics