An administrator is configuring network security for a virtual network named VNet1 in an A… — Microsoft Azure Administrator (AZ-104)

An administrator is configuring network security for a virtual network named VNet1 in an Azure subscription. VNet1 contains two subnets:
- Subnet-Client (IP address space: $10.100.1.0/24$ )
- Subnet-Service (IP address space: $10.100.2.0/24$ )

Subnet-Client contains VM-Client1 and VM-Client2.
Subnet-Service contains VM-App1 and VM-App2.

You create and configure the following Application Security Groups (ASGs):
- ASG-TrustedClient: Associated with the network interface of VM-Client1.
- ASG-App: Associated with the network interfaces of VM-App1 and VM-App2.

You associate a Network Security Group (NSG) named NSG-Service with Subnet-Service.

You need to configure NSG-Service to meet the following requirements:
1. Allow VM-Client1 to access VM-App1 and VM-App2 using HTTPS (TCP port $443$ ).
2. Deny all other network traffic from Subnet-Client to Subnet-Service.
3. Minimize administrative effort and adhere to the principle of least privilege.

Which of the following inbound security rules should you configure in NSG-Service? (Select two.)

An inbound rule with Priority: $100$ , Source: ASG-TrustedClient, Destination: ASG-App, Port: $443$ , Protocol: TCP, Action: AllowAnswer
An inbound rule with Priority: $200$ , Source: $10.100.1.0/24$ , Destination: $10.100.2.0/24$ , Port: *, Protocol: Any, Action: DenyAnswer
C
An inbound rule with Priority: $50$ , Source: $10.100.1.0/24$ , Destination: $10.100.2.0/24$ , Port: *, Protocol: Any, Action: Deny
D
An inbound rule with Priority: $300$ , Source: ASG-TrustedClient, Destination: ASG-App, Port: $443$ , Protocol: TCP, Action: Allow

Answer

Configure an inbound rule allowing TCP port

443

traffic from ASG-TrustedClient to ASG-App with a priority of

100

, and configure an inbound rule denying all traffic from the client subnet (

10.100.1.0/24

) to the service subnet (

10.100.2.0/24

) with a priority of

200

To allow HTTPS traffic from VM-Client1 to VM-App1/VM-App2 while blocking all other traffic from the client subnet, the allow rule must be evaluated before the deny rule. Azure NSG rules are processed in priority order, where lower numbers have higher precedence. Creating an allow rule for ASG-TrustedClient to ASG-App on port

443

with a priority of

100

, combined with a deny rule for the entire client subnet to the service subnet with a priority of

200

, ensures HTTPS traffic is allowed first and all other traffic is subsequently blocked.

Step-by-Step Solution

Identify the traffic flow and target security groups.

The target source VM-Client1 is associated with ASG-TrustedClient, and the destination VMs (VM-App1 and VM-App2) are associated with ASG-App. Inbound HTTPS traffic uses TCP port

443

This allows using Application Security Groups (ASGs) instead of explicit IP addresses, simplifying management and following security best practices.

Define the rule allowing the required traffic.

Create an inbound rule allowing TCP port

443

traffic from ASG-TrustedClient to ASG-App, assigned with a lower priority number (e.g.,

100

Lower priority numbers have higher precedence in Azure NSG evaluation, ensuring the allow rule is evaluated first.

Define the rule blocking all other traffic from the source subnet.

Create an inbound rule denying all traffic from the source subnet (

10.100.1.0/24

) to the destination subnet (

10.100.2.0/24

) on all ports (*), assigned with a higher priority number (e.g.,

200

This blocks all remaining traffic from Subnet-Client to Subnet-Service while allowing the HTTPS traffic to pass because the allow rule is evaluated first.

Key Concept

Azure Network Security Group (NSG) rule evaluation order is based on priority numbers (lower numbers have higher precedence). Application Security Groups (ASGs) allow grouping virtual machines to simplify security rule management.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics