Your company has an Azure subscription containing a virtual network named `VNet1`. `VNet1`… — Microsoft Azure Administrator (AZ-104)

Your company has an Azure subscription containing a virtual network named `VNet1`. `VNet1` contains two subnets named `Subnet-Web` and `Subnet-App`.

You have the following resource configuration:
- A virtual machine named `VM-Web1` in `Subnet-Web`. The network interface of `VM-Web1` is associated with an Application Security Group (ASG) named `ASG-Web`.
- A virtual machine named `VM-App1` in `Subnet-App`. The network interface of `VM-App1` is associated with an ASG named `ASG-App` and a Network Security Group (NSG) named `NSG-NIC-App1`.
- An NSG named `NSG-Subnet-App` is associated with `Subnet-App`.

`NSG-Subnet-App` contains the following inbound security rule:
- `Rule1`: Priority $200$ , Source `ASG-Web`, Destination `ASG-App`, Port $80$ , Protocol `TCP`, Action `Allow`

`NSG-NIC-App1` contains the following inbound security rules:
- `Rule2`: Priority $150$ , Source `ASG-Web`, Destination `ASG-App`, Port $80$ , Protocol `TCP`, Action `Deny`
- `Rule3`: Priority $250$ , Source `ASG-Web`, Destination `ASG-App`, Port $80$ , Protocol `TCP`, Action `Allow`

You need to allow HTTP traffic on port $80$ from `VM-Web1` to `VM-App1` using the ASGs. The solution must use the principle of least privilege.

Which two of the following actions can you perform to achieve the goal? (Select two.)

Delete Rule2 from NSG-NIC-App1.Answer
Change the priority of Rule3 in NSG-NIC-App1 to $120$ .Answer
C
Delete Rule1 from NSG-Subnet-App.
D
Change the priority of Rule2 in NSG-NIC-App1 to $100$ .

Answer

To allow the HTTP traffic, you must ensure that both the subnet-level and NIC-level NSGs allow the traffic. Since the subnet NSG already allows it, you must resolve the block at the NIC level by either deleting the Deny rule (Rule2) or changing the priority of the Allow rule (Rule3) to a value lower than the Deny rule (such as 120).

Deleting Rule2 from the NIC-level NSG leaves Rule3 as the active rule allowing port 80 traffic. Alternatively, changing the priority of Rule3 to 120 makes it process before Rule2 (priority 150), allowing the HTTP traffic to be accepted at the NIC level. Inbound traffic must be allowed by both the subnet-level and NIC-level NSGs, and since the subnet NSG already permits it, resolving the NIC-level block is sufficient.

Step-by-Step Solution

Analyze the inbound traffic flow path in Azure virtual networks.

Inbound traffic is evaluated first by the subnet-level NSG (NSG-Subnet-App) and second by the NIC-level NSG (NSG-NIC-App1).

Both NSGs must allow the traffic for the connection to succeed.

Evaluate the subnet-level NSG rules.

NSG-Subnet-App has Rule1 with priority 200 that allows port 80 traffic from ASG-Web to ASG-App.

This confirms that the subnet-level configuration is already correct.

Evaluate the NIC-level NSG rules and identify the blocking rule.

NSG-NIC-App1 has Rule2 (Deny, priority 150) and Rule3 (Allow, priority 250). Since lower priority numbers have higher precedence, Rule2 is processed first and blocks the traffic.

To allow the traffic, the blocking rule must be bypassed or removed.

Determine the valid administrative actions to allow the traffic.

Deleting Rule2 allows the lower precedence Rule3 (Allow) to be applied. Alternatively, changing the priority of Rule3 to a value lower than 150 (such as 120) makes the Allow rule process before the Deny rule.

These actions modify the NSG evaluation order or ruleset to permit the connection.

Key Concept

NSG inbound rules are processed in priority order (lower numbers first), and inbound traffic is evaluated at the subnet level NSG before the network interface (NIC) level NSG.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics