Examkin

Question

Difficulty: MediumConfigure Network Security Groups (NSGs) and Application Security Groups (ASGs)

Your company has an Azure subscription containing a virtual network named `VNet1`. `VNet1` contains two subnets named `Subnet-Web` and `Subnet-App`.

The virtual machines in the subnets are configured as follows:

Virtual MachineSubnetApplication Security Group (ASG)NIC-level NSG
`VM-Web1``Subnet-Web``ASG-Web`None
`VM-Web2``Subnet-Web``ASG-Web`None
`VM-App1``Subnet-App``ASG-App``NSG-App-NIC`

`Subnet-Web` is associated with a Network Security Group (NSG) named `NSG-Web-Subnet`. `Subnet-App` is associated with an NSG named `NSG-App-Subnet`.

The NSGs have the following custom inbound rules:
- `NSG-Web-Subnet`: Only default rules.
- `NSG-App-Subnet`: A rule with Priority 1000, Source: `VirtualNetwork`, Destination: `VirtualNetwork`, Port: `Any`, Protocol: `Any`, Action: `Deny`.
- `NSG-App-NIC`: A rule with Priority 1000, Source: `VirtualNetwork`, Destination: `VirtualNetwork`, Port: `Any`, Protocol: `Any`, Action: `Deny`.

You need to allow `VM-Web1` and `VM-Web2` to connect to `VM-App1` on TCP port 8443. All other traffic from `Subnet-Web` to `Subnet-App` must remain blocked.

Which two security rules should you configure? (Select two.)

  1. In NSG-App-Subnet, add an inbound rule: Priority 500, Source: ASG-Web, Destination: ASG-App, Port: 8443, Protocol: TCP, Action: AllowAnswer
  2. B
    In NSG-App-Subnet, add an inbound rule: Priority 1500, Source: ASG-Web, Destination: ASG-App, Port: 8443, Protocol: TCP, Action: Allow
  3. In NSG-App-NIC, add an inbound rule: Priority 500, Source: ASG-Web, Destination: ASG-App, Port: 8443, Protocol: TCP, Action: AllowAnswer
  4. D
    In NSG-App-NIC, add an inbound rule: Priority 1500, Source: ASG-Web, Destination: ASG-App, Port: 8443, Protocol: TCP, Action: Allow
  5. E
    In NSG-Web-Subnet, add an outbound rule: Priority 500, Source: ASG-Web, Destination: ASG-App, Port: 8443, Protocol: TCP, Action: Allow

Answer

In NSG-App-Subnet, add an inbound rule with Priority 500, Source: ASG-Web, Destination: ASG-App, Port: 8443, Protocol: TCP, Action: Allow; and in NSG-App-NIC, add an inbound rule with Priority 500, Source: ASG-Web, Destination: ASG-App, Port: 8443, Protocol: TCP, Action: Allow.
To allow inbound traffic to VM-App1, the traffic must pass through both the subnet-level NSG (NSG-App-Subnet) and the NIC-level NSG (NSG-App-NIC). Since both NSGs currently block VNet traffic via custom rules with Priority 1000, you must add an Allow rule to both NSGs. These new rules must have a priority value lower than 1000 (such as 500) to be evaluated first and allow the traffic before the deny rules are reached.

Step-by-Step Solution

1
Analyze the network traffic direction and evaluation flow.
Traffic flows from Subnet-Web (source VMs in ASG-Web) to Subnet-App (destination VM-App1 in ASG-App) on TCP port 8443. For inbound traffic, Azure evaluates the subnet-level NSG (NSG-App-Subnet) first, followed by the NIC-level NSG (NSG-App-NIC). Both must allow the traffic.
Understanding the sequential evaluation of subnet-level and NIC-level NSGs is required to determine where to place the allow rules.
2
Determine the required rule priority.
The existing deny rules in both NSGs have a priority of 1000. To override these deny rules, the new allow rules must have a priority lower than 1000 (e.g., 500). Rules with a priority higher than 1000 (e.g., 1500) will be processed after the deny rule and will not take effect.
NSG rules are processed in priority order (lower numbers have higher precedence), so the allow rules must have a lower priority number than the deny rules.
3
Formulate the rules using Application Security Groups (ASGs).
The allow rules should target ASG-Web as the source and ASG-App as the destination. This allows specific VMs associated with those ASGs to communicate while blocking other traffic.
Using ASGs is the recommended approach to apply network security rules to groups of virtual machines without managing individual IP addresses.

Key Concept

Inbound NSG evaluation order (subnet-level then NIC-level) and rule priority precedence (lower numbers represent higher priority).
Rate this question

Topics

Configure Network Security Groups (NSGs) and Application Security Groups (ASGs)