An organization has an Azure virtual network named `VNet-Prod` containing two subnets: `Su… — Microsoft Azure Administrator (AZ-104)

An organization has an Azure virtual network named `VNet-Prod` containing two subnets: `Subnet-Web` ( $10.50.1.0/24$ ) and `Subnet-DB` ( $10.50.2.0/24$ ). A virtual machine named `VM-Web` is deployed in `Subnet-Web` and is associated with an Application Security Group (ASG) named `ASG-Web`. A virtual machine named `VM-DB` is deployed in `Subnet-DB` and is associated with an ASG named `ASG-DB`.

The network security groups (NSGs) are configured as follows:
- `NSG-Web` is associated with `Subnet-Web`.
- `NSG-DB` is associated with `Subnet-DB`.

`NSG-DB` contains the following inbound security rules:
- Rule1: Priority $120$ , Source: `VirtualNetwork`, Port: `Any`, Destination: `Any`, Protocol: `Any`, Action: `Deny`
- Rule2: Priority $210$ , Source: `ASG-Web`, Port: `1433`, Destination: `ASG-DB`, Protocol: `TCP`, Action: `Allow`

When testing, TCP port $1433$ traffic from `VM-Web` to `VM-DB` is blocked. Which change should you make to `NSG-DB` to allow TCP port $1433$ traffic from `VM-Web` to `VM-DB`?

Change the priority of Rule2 to 100.Answer
B
Change the priority of Rule1 to 100.
C
Add an inbound rule to NSG-Web with priority 100 that allows TCP port 1433 traffic from ASG-Web to ASG-DB.
D
Change the Destination of Rule2 to the subnet range 10.50.2.0/24.

Answer

Change the priority of Rule2 to 100.

The correct action is to change the priority of Rule2 to a number lower than 120 (such as 100). In Azure, Network Security Group (NSG) rules are processed in order of priority, where lower numbers have higher precedence. Currently, Rule1 has a priority of 120 and Rule2 has a priority of 210. Because Rule1 has a lower priority number, it is evaluated first. Since VM-Web is part of the virtual network, its traffic falls under the 'VirtualNetwork' source tag, matching Rule1's criteria, and is therefore denied. Lowering the priority number of Rule2 to 100 ensures that the allow rule is evaluated first, allowing the SQL traffic to pass through to the database virtual machine.

Step-by-Step Solution

Analyze the current NSG rule execution order for inbound traffic on NSG-DB.

Rule1 (priority 120) is processed before Rule2 (priority 210) because lower priority numbers have higher precedence in Azure NSGs.

We need to determine why the SQL traffic is currently blocked despite the presence of Rule2.

Identify the rule that matches the incoming TCP port 1433 traffic from VM-Web.

The traffic matches Rule1 first (Source: VirtualNetwork, Destination: Any, Action: Deny), causing it to be blocked.

Since both subnets are part of the same virtual network, VM-Web's IP address is within the VirtualNetwork service tag range.

Determine the configuration change required to process the Allow rule (Rule2) before the Deny rule (Rule1).

Assign Rule2 a priority value lower than 120, such as 100.

This ensures that the specific Allow rule for TCP port 1433 is matched and applied before the generic Deny rule is evaluated.

Key Concept

Azure NSG rules are processed in priority order from lowest number to highest number. Once a match is found, no further rules are processed.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics