You have an Azure subscription that contains a virtual network named `VNet1`. `VNet1` cont… — Microsoft Azure Administrator (AZ-104)

You have an Azure subscription that contains a virtual network named `VNet1`. `VNet1` contains two subnets:
- `Subnet-Web` ( $10.0.1.0/24$ )
- `Subnet-DB` ( $10.0.2.0/24$ )

The following virtual machines are deployed in `VNet1`:
- `VM-Web1` is in `Subnet-Web` and its network interface is associated with an Application Security Group named `ASG-Web`.
- `VM-DB1` is in `Subnet-DB` and its network interface is associated with an Application Security Group named `ASG-DB`.

The following Network Security Groups (NSGs) are configured and associated:
- `NSG-Subnet` is associated with `Subnet-Web` and contains the following outbound security rule:
- Priority: $150$
- Source: `*`
- Destination: $10.0.2.0/24$
- Port: `*`
- Protocol: `Any`
- Action: `Deny`
- `NSG-NIC-DB` is associated with the network interface of `VM-DB1` and contains the following inbound security rule:
- Priority: $200$
- Source: $10.0.1.0/24$
- Destination: `*`
- Port: `*`
- Protocol: `Any`
- Action: `Deny`

All other NSG settings and rules are at their default values.

You need to allow SSH (TCP port $22$ ) and HTTPS (TCP port $443$ ) connections from `VM-Web1` to `VM-DB1`. The solution must follow the principle of least privilege.

Which two actions should you perform? (Select two.)

In `NSG-Subnet`, add an outbound security rule with a priority of $120$ that allows TCP ports $22$ and $443$ from `ASG-Web` to `ASG-DB`.Answer
In `NSG-NIC-DB`, add an inbound security rule with a priority of $180$ that allows TCP ports $22$ and $443$ from `ASG-Web` to `ASG-DB`.Answer
C
In `NSG-Subnet`, add an outbound security rule with a priority of $180$ that allows TCP ports $22$ and $443$ from `ASG-Web` to `ASG-DB`.
D
In `NSG-NIC-DB`, add an inbound security rule with a priority of $220$ that allows TCP ports $22$ and $443$ from `ASG-Web` to `ASG-DB`.
E
In `NSG-Subnet`, add an inbound security rule with a priority of $120$ that allows TCP ports $22$ and $443$ from `ASG-Web` to `ASG-DB`.

Answer

To allow SSH and HTTPS connections from VM-Web1 to VM-DB1 while maintaining the principle of least privilege, you must add an outbound security rule in NSG-Subnet with a priority of 120 that allows TCP ports 22 and 443 from ASG-Web to ASG-DB, and add an inbound security rule in NSG-NIC-DB with a priority of 180 that allows TCP ports 22 and 443 from ASG-Web to ASG-DB.

For the traffic to succeed, it must pass both the outbound evaluation at the source subnet level and the inbound evaluation at the destination NIC level. In `NSG-Subnet`, adding an outbound Allow rule with a priority of

120

successfully overrides the Deny rule at priority

150

. In `NSG-NIC-DB`, adding an inbound Allow rule with a priority of

180

successfully overrides the Deny rule at priority

200

. Both rules target `ASG-Web` as the source and `ASG-DB` as the destination for ports

22

and

443

, which maintains the principle of least privilege.

Step-by-Step Solution

Analyze the outbound path from `VM-Web1`.

Outbound traffic from `VM-Web1` is processed by the subnet NSG `NSG-Subnet`.

Before leaving the subnet, traffic is evaluated against outbound rules. The existing rule has a priority of

150

and blocks all outbound traffic to `Subnet-DB` (

10.0.2.0/24

Resolve the outbound block in `NSG-Subnet`.

An outbound rule with a priority lower than

150

(such as

120

) must be added.

Azure processes rules in order of priority (lower numbers first). To allow SSH (

22

) and HTTPS (

443

) traffic from `ASG-Web` to `ASG-DB` before the Deny rule is processed, the new rule must have a priority number less than

150

Analyze the inbound path to `VM-DB1`.

Inbound traffic is evaluated by the network interface NSG `NSG-NIC-DB`.

Since `Subnet-DB` has no subnet-level NSG, the traffic is evaluated directly at the NIC-level NSG. The existing rule has a priority of

200

and blocks all inbound traffic from `Subnet-Web` (

10.0.1.0/24

Resolve the inbound block in `NSG-NIC-DB`.

An inbound rule with a priority lower than

200

(such as

180

) must be added.

To allow the traffic to pass the NIC-level NSG, an inbound Allow rule for TCP ports

22

and

443

targeting `ASG-Web` to `ASG-DB` must be processed before the Deny rule at priority

200

Key Concept

Azure NSGs evaluate rules sequentially using priority numbers where lower numbers have higher precedence. When traffic flows across subnets, outbound rules on the source subnet/NIC are evaluated first, followed by inbound rules on the destination subnet/NIC.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics