Examkin

Question

Difficulty: HardConfigure Network Security Groups (NSGs) and Application Security Groups (ASGs)

An administrator configures the virtual network components in an Azure subscription as shown in the tables below:

Virtual Machines and Subnet Associations:

Virtual MachinePrivate IPSubnetNetwork Security Group (NSG)Application Security Group (ASG)
VM110.1.1.4Subnet1NSG-NIC1 (NIC-level)ASG-App
VM210.1.2.4Subnet2NoneASG-DB

* `Subnet1` is associated with `NSG-Subnet1`.
* `Subnet2` is not associated with any subnet-level NSG.
* `VM2` does not have any NIC-level NSG.

NSG-Subnet1 Inbound Rules:

PriorityPortProtocolSourceDestinationAction
1101433TCP10.1.2.0/24ASG-AppAllow
1201433TCPAnyAnyDeny

NSG-Subnet1 Outbound Rules:

PriorityPortProtocolSourceDestinationAction
1101433TCPASG-App10.1.2.0/24Deny
1201433TCPAnyAnyAllow

NSG-NIC1 Inbound Rules:

PriorityPortProtocolSourceDestinationAction
1501433TCP10.1.2.4AnyDeny
1601433TCPAnyAnyAllow

NSG-NIC1 Outbound Rules:

PriorityPortProtocolSourceDestinationAction
1501433TCPAnyASG-DBAllow
1601433TCPAnyAnyDeny

Which of the following describes the status of the connection attempts on TCP port 1433?

  1. A
    The connection from VM2 to VM1 is allowed, and the connection from VM1 to VM2 is allowed.
  2. B
    The connection from VM2 to VM1 is allowed, and the connection from VM1 to VM2 is denied.
  3. C
    The connection from VM2 to VM1 is denied, and the connection from VM1 to VM2 is allowed.
  4. The connection from VM2 to VM1 is denied, and the connection from VM1 to VM2 is denied.Answer

Answer

The connection from VM2 to VM1 is denied, and the connection from VM1 to VM2 is denied.
The correct option is that both connections are denied. For the inbound connection from VM2 to VM1, the subnet-level NSG (NSG-Subnet1) allows it, but the NIC-level NSG (NSG-NIC1) denies it. For the outbound connection from VM1 to VM2, the NIC-level NSG allows it, but the subnet-level NSG denies it. Since a connection must be allowed at both the subnet and NIC levels to succeed, both connection attempts fail.

Step-by-Step Solution

1
Analyze the inbound connection attempt from VM2 (10.1.2.4) to VM1 (10.1.1.4) on TCP port 1433.
For inbound traffic to VM1, the subnet-level NSG (NSG-Subnet1) is processed first, followed by the NIC-level NSG (NSG-NIC1).
Azure evaluates inbound security rules first at the subnet level and then at the network interface (NIC) level.
2
Evaluate the rules in NSG-Subnet1 and NSG-NIC1 for the inbound connection from VM2 to VM1.
In NSG-Subnet1, Rule 110 allows traffic from 10.1.2.0/24 to ASG-App (VM1). The traffic passes to the NIC level. In NSG-NIC1, Rule 150 denies traffic from 10.1.2.4 to Any. The traffic is blocked.
Since both NSGs are evaluated and NSG-NIC1 denies the traffic, the inbound connection from VM2 to VM1 is denied.
3
Analyze the outbound connection attempt from VM1 (10.1.1.4) to VM2 (10.1.2.4) on TCP port 1433.
For outbound traffic from VM1, the NIC-level NSG (NSG-NIC1) is processed first, followed by the subnet-level NSG (NSG-Subnet1).
Azure evaluates outbound security rules first at the NIC level and then at the subnet level.
4
Evaluate the rules in NSG-NIC1 and NSG-Subnet1 for the outbound connection from VM1 to VM2.
In NSG-NIC1, Rule 150 allows outbound traffic from Any to ASG-DB (VM2). The traffic passes to the subnet level. In NSG-Subnet1, Rule 110 denies outbound traffic from ASG-App (VM1) to 10.1.2.0/24. The traffic is blocked.
Since both NSGs are evaluated and NSG-Subnet1 denies the traffic, the outbound connection from VM1 to VM2 is denied.

Key Concept

Subnet-level and NIC-level NSG evaluation sequence for inbound and outbound traffic.
Rate this question

Topics

Configure Network Security Groups (NSGs) and Application Security Groups (ASGs)