Examkin

Question

Difficulty: MediumConfigure Network Security Groups (NSGs) and Application Security Groups (ASGs)

An administrator is configuring network security for a database application in Microsoft Azure. The environment contains the following resources:

* A virtual network named `VNet-Production` with a subnet named `Subnet-Data` (10.50.2.0/2410.50.2.0/24).
* A virtual machine named `VM-Database` with a network interface named `nic-db-01` connected to `Subnet-Data` and associated with an Application Security Group named `ASG-Database`.
* A virtual machine named `VM-WebFrontend` associated with an Application Security Group named `ASG-WebFrontend`.

A Network Security Group named `NSG-Subnet` is associated with `Subnet-Data` and contains the following inbound rules:

PriorityNameSourceDestinationPortProtocolAction
100Allow-Web-to-DB-SubnetASG-WebFrontendASG-Database1433TCPAllow
1000Deny-All-Inbound-SubnetAnyAny**Deny

A Network Security Group named `NSG-NIC` is associated with `nic-db-01` and contains the following inbound rules:

PriorityNameSourceDestinationPortProtocolAction
150Deny-Web-to-DB-NICASG-WebFrontendASG-Database1433TCPDeny
200Allow-Web-to-DB-NICASG-WebFrontendASG-Database1433TCPAllow

You need to ensure that `VM-WebFrontend` can establish a database connection to `VM-Database` on TCP port 1433. The solution must minimize security risks and administrative effort.

Which of the following actions should you perform?

  1. Change the priority of the Allow-Web-to-DB-NIC rule in NSG-NIC to 120.Answer
  2. B
    Change the priority of the Allow-Web-to-DB-Subnet rule in NSG-Subnet to 250.
  3. C
    Change the priority of the Deny-Web-to-DB-NIC rule in NSG-NIC to 100.
  4. D
    Remove the association between NSG-Subnet and the Subnet-Data subnet.

Answer

Change the priority of the Allow-Web-to-DB-NIC rule in NSG-NIC to 120.
The correct action is to change the priority of the Allow-Web-to-DB-NIC rule in NSG-NIC to 120. In Azure, Network Security Group (NSG) rules are processed in priority order: lower numbers have higher precedence. Currently, the Deny rule has a priority of 150 and the Allow rule has a priority of 200. Since 150 is lower than 200, the Deny rule is evaluated first and blocks the traffic. Changing the Allow rule's priority to 120 makes it take precedence over the Deny rule (120 < 150), allowing the traffic to pass the NIC-level NSG.

Step-by-Step Solution

1
Analyze how inbound NSG rules are evaluated when both subnet and network interface (NIC) associations exist.
Inbound traffic is first evaluated by the subnet-level NSG (NSG-Subnet) and then by the NIC-level NSG (NSG-NIC). Both NSGs must allow the traffic for the connection to succeed.
This determines which NSG is currently blocking the connection.
2
Evaluate the rules in NSG-Subnet.
The Allow-Web-to-DB-Subnet rule (Priority 100) matches traffic from ASG-WebFrontend to ASG-Database on port 1433 TCP and permits it. The traffic successfully passes the subnet layer.
To verify if the subnet layer is blocking the traffic.
3
Evaluate the rules in NSG-NIC.
NSG-NIC has two rules for the same traffic: Deny-Web-to-DB-NIC (Priority 150) and Allow-Web-to-DB-NIC (Priority 200). Since 150 is lower than 200, the Deny rule has higher precedence and is processed first, blocking the traffic.
To identify why the traffic is blocked at the NIC layer.
4
Select the correct action to allow the traffic.
Changing the priority of the Allow rule in NSG-NIC to 120 places it before the Deny rule (Priority 150) in processing order. Thus, the traffic is allowed at the NIC layer.
This resolves the conflict by making the Allow rule take precedence over the Deny rule.

Key Concept

Inbound Network Security Group (NSG) rule processing order and priority evaluation across subnet and network interface levels.
Rate this question

Topics

Configure Network Security Groups (NSGs) and Application Security Groups (ASGs)