Examkin

Question

Difficulty: EasyConfigure Network Security Groups (NSGs) and Application Security Groups (ASGs)

You have a Network Security Group (NSG) associated with an Azure subnet. The NSG contains the following two inbound security rules:

* `Rule1`: Priority 200200, Source: `Internet`, Destination: `*`, Port: 33893389, Protocol: `TCP`, Action: `Deny`
* `Rule2`: Priority 150150, Source: `Internet`, Destination: `*`, Port: 33893389, Protocol: `TCP`, Action: `Allow`

A user attempts to establish a Remote Desktop Protocol (RDP) connection from the Internet to a virtual machine in the subnet. Which of the following describes the outcome of this connection attempt?

  1. A
    Blocked, because Deny rules always override Allow rules in Network Security Groups
  2. Allowed, because the rule with priority 150150 is processed before the rule with priority 200200Answer
  3. C
    Blocked, because the rule with priority 200200 is processed before the rule with priority 150150
  4. D
    Allowed, because default inbound rules permit RDP traffic from the Internet

Answer

The connection is allowed because the rule with priority 150150 is evaluated before the rule with priority 200200, and it permits the traffic.
In Azure Network Security Groups (NSGs), security rules are processed in priority order, where lower numbers have higher precedence. When traffic matches a rule, processing stops. Because the rule with priority 150150 (Allow) is lower than the rule with priority 200200 (Deny), the Allow rule is evaluated first and the traffic is permitted.

Step-by-Step Solution

1
Identify the priority numbers of the matching rules.
Rule 1 has a priority of 200200, and Rule 2 has a priority of 150150.
NSG rules are evaluated in order of priority.
2
Determine which rule takes precedence based on the priority numbers.
Rule 2 (priority 150150) takes precedence over Rule 1 (priority 200200) because a lower number indicates higher priority.
In Azure NSGs, lower priority numbers have higher precedence.
3
Apply the action of the rule with the highest precedence.
The traffic is allowed because Rule 2's action is Allow.
Once a rule matches the traffic, that rule is applied and subsequent rules are not evaluated.

Key Concept

Azure NSG rule processing order is based on priority numbers, where smaller numbers have higher priority.
Rate this question

Topics

Configure Network Security Groups (NSGs) and Application Security Groups (ASGs)