Your company has an Azure subscription containing a virtual network named `VNet1`. `VNet1`… — Microsoft Azure Administrator (AZ-104)

Your company has an Azure subscription containing a virtual network named `VNet1`. `VNet1` contains two subnets named `Subnet-Front` and `Subnet-Back`.

You deploy two virtual machines:
* `VM-Web` in `Subnet-Front`
* `VM-DB` in `Subnet-Back`

The network interface of `VM-Web` is associated with an Application Security Group (ASG) named `ASG-Web`.
The network interface of `VM-DB` is associated with an ASG named `ASG-DB` and a Network Security Group (NSG) named `NSG-NIC-DB`.
`Subnet-Front` is associated with an NSG named `NSG-Front`.
`Subnet-Back` is associated with an NSG named `NSG-Back`.

`NSG-Front` contains the following custom inbound rule:
* Priority: $150$
* Source: Any
* Port: Any
* Destination: Any
* Action: Deny

`NSG-Back` contains the following custom inbound rule:
* Priority: $250$
* Source: Any
* Port: Any
* Destination: Any
* Action: Deny

`NSG-NIC-DB` contains only default rules.

You must configure network security to meet the following requirements:
* Allow HTTPS traffic (TCP port $443$ ) from the Internet to `VM-Web`.
* Allow `VM-Web` to connect to `VM-DB` on TCP port $1433$ .
* Minimize the number of rules and use ASGs where possible.
* Maintain the principle of least privilege.

Which two of the following rules must you add to meet the requirements?

In `NSG-Front`, add an inbound rule with priority $100$ that allows TCP port $443$ from Source: Internet to Destination: `ASG-Web`.Answer
In `NSG-Back`, add an inbound rule with priority $200$ that allows TCP port $1433$ from Source: `ASG-Web` to Destination: `ASG-DB`.Answer
C
In `NSG-Front`, add an inbound rule with priority $300$ that allows TCP port $443$ from Source: Internet to Destination: `ASG-Web`.
D
In `NSG-NIC-DB`, add an inbound rule with priority $100$ that allows TCP port $1433$ from Source: `ASG-Web` to Destination: `ASG-DB`.

Answer

Add an inbound rule in NSG-Front with priority 100 to allow port 443 from Internet to ASG-Web, and add an inbound rule in NSG-Back with priority 200 to allow port 1433 from ASG-Web to ASG-DB.

To satisfy the requirements, two rules must be added. First, a rule in the front-end subnet security group must allow inbound TCP port 443 from the Internet to the web application security group. Because of an existing custom deny rule at priority 150, the new allow rule must have a priority lower than 150 (such as 100) to take precedence. Second, a rule in the back-end subnet security group must allow inbound TCP port 1433 from the web application security group to the database application security group. Because the back-end subnet security group contains a custom deny rule at priority 250, this rule must have a priority lower than 250 (such as 200). Modifying the network interface security group is not required because its default rules already allow virtual network traffic.

Step-by-Step Solution

Determine the rule needed to allow inbound HTTPS traffic from the Internet to the web virtual machine.

Since Subnet-Front is associated with NSG-Front, which has a custom Deny rule at priority 150, any new Allow rule must have a priority lower than 150 (e.g., 100). The destination must target ASG-Web.

This ensures the HTTPS traffic is allowed at the subnet level before the custom Deny rule blocks it.

Determine the rule needed to allow the web virtual machine to connect to the database virtual machine on port 1433.

The traffic traverses from Subnet-Front to Subnet-Back. Outbound rules allow this by default, but inbound traffic to Subnet-Back is blocked by a custom Deny rule at priority 250 in NSG-Back. Therefore, an inbound rule must be added to NSG-Back with a priority lower than 250 (e.g., 200) that allows traffic from ASG-Web to ASG-DB.

This overrides the subnet-level Deny rule on the destination subnet, permitting the SQL traffic.

Evaluate whether any rules need to be added to the network interface security group NSG-NIC-DB.

NSG-NIC-DB only has default rules, which include the AllowVnetInbound rule (priority 65000). Since both subnets belong to the same virtual network, this rule automatically allows the traffic at the NIC level once it passes the subnet NSG.

No additional configuration is required at the NIC level because the default rules already permit intra-VNet communication.

Key Concept

Azure Network Security Group (NSG) rule evaluation order (subnet-level rules before network interface-level rules for inbound traffic) and rule precedence based on priority numbers.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics