Your company has an Azure subscription containing a virtual network named `VNet1`. `VNet1`… — Microsoft Azure Administrator (AZ-104)

Your company has an Azure subscription containing a virtual network named `VNet1`. `VNet1` has two subnets: `Subnet-Web` ( $10.10.1.0/24$ ) and `Subnet-DB` ( $10.10.2.0/24$ ).

The web servers are deployed in `Subnet-Web` and associated with an Application Security Group (ASG) named `ASG-Web`. The database servers are deployed in `Subnet-DB` and associated with an ASG named `ASG-DB`.

A Network Security Group (NSG) named `NSG-Web` is associated with `Subnet-Web`. An NSG named `NSG-DB` is associated with `Subnet-DB`. `NSG-DB` contains the following custom inbound security rule:
- Priority: $150$
- Source: `VirtualNetwork`
- Destination: `Any`
- Port: `*`
- Protocol: `Any`
- Action: `Deny`

You need to configure the NSGs to meet the following requirements:
1. Allow HTTPS traffic (TCP port $443$ ) from the Internet to the web servers.
2. Allow SQL Server traffic (TCP port $1433$ ) from the web servers to the database servers.
3. Adhere to the principle of least privilege.

Which two inbound security rules should you configure? (Select two.)

In `NSG-Web`, create a rule with Priority: $100$ , Source: `Internet`, Port: $443$ , Destination: `ASG-Web`, Action: `Allow`.Answer
In `NSG-DB`, create a rule with Priority: $120$ , Source: `ASG-Web`, Port: $1433$ , Destination: `ASG-DB`, Action: `Allow`.Answer
C
In `NSG-DB`, create a rule with Priority: $180$ , Source: `ASG-Web`, Port: $1433$ , Destination: `ASG-DB`, Action: `Allow`.
D
In `NSG-Web`, create a rule with Priority: $100$ , Source: `Internet`, Port: $443$ , Destination: `Any`, Action: `Allow`.

Answer

The correct configurations are: in `NSG-Web`, create an inbound rule with Priority:

100

, Source: `Internet`, Port:

443

, Destination: `ASG-Web`, Action: `Allow`; and in `NSG-DB`, create an inbound rule with Priority:

120

, Source: `ASG-Web`, Port:

1433

, Destination: `ASG-DB`, Action: `Allow`.

To allow inbound HTTPS traffic from the Internet to only the web servers while adhering to the principle of least privilege, the rule must be created in the web subnet's NSG (`NSG-Web`) with `ASG-Web` as the destination. To allow SQL Server traffic from the web servers to the database servers, the rule must be created in `NSG-DB`. Since there is an existing custom deny rule at priority

150

in `NSG-DB`, the new allow rule must have a lower priority number (higher precedence), such as

120

, to be evaluated first.

Step-by-Step Solution

Analyze the requirement for HTTPS traffic.

Inbound HTTPS (port

443

) from the Internet must reach the web servers in `Subnet-Web`. The NSG associated with the subnet (`NSG-Web`) must have an inbound rule to allow this.

By default, inbound traffic from the Internet is blocked by the default DenyAllInbound rule.

Apply the principle of least privilege to the HTTPS rule.

Specify the destination as `ASG-Web` instead of `Any`.

This limits the allowed traffic strictly to the virtual machines associated with the web application security group, rather than the entire subnet.

Analyze the requirement for SQL Server traffic and the existing rule in `NSG-DB`.

SQL Server traffic (port

1433

) from `ASG-Web` to `ASG-DB` must pass through `NSG-DB`. `NSG-DB` has a custom rule at priority

150

that denies all inbound virtual network traffic.

NSG rules are processed in priority order (lower numbers evaluated first). Any allow rule must have a priority lower than

150

to take precedence over the deny rule.

Select the correct priority and scopes for the database rule.

Create a rule in `NSG-DB` with priority

120

, source `ASG-Web`, and destination `ASG-DB`.

Priority

120

is processed before

150

, allowing the traffic to bypass the deny rule, while using ASGs targets only the relevant servers.

Key Concept

Azure Network Security Group (NSG) rule evaluation order (where lower priority numbers have higher precedence) and Application Security Group (ASG) integration to group VMs for granular security policies.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics