An administrator is configuring network security for a multi-tier application in an Azure … — Microsoft Azure Administrator (AZ-104)

An administrator is configuring network security for a multi-tier application in an Azure subscription. The environment contains a virtual network named `VNet1` ( $10.1.0.0/16$ ) with two subnets: `Subnet-Web` ( $10.1.1.0/24$ ) and `Subnet-App` ( $10.1.2.0/24$ ).

- `Subnet-Web` is associated with a Network Security Group (NSG) named `NSG-Subnet-Web`.
- `Subnet-Web` contains a virtual machine named `VM-Web`. The network interface of `VM-Web` is associated with an Application Security Group (ASG) named `ASG-Web-Servers` and an NSG named `NSG-NIC-Web`.
- `Subnet-App` is associated with an NSG named `NSG-Subnet-App` that contains only default rules.
- `Subnet-App` contains a virtual machine named `VM-App` ( $10.1.2.4$ ). The network interface of `VM-App` is associated with an ASG named `ASG-App-Servers`.

The inbound security rules for the NSGs are configured as follows:

NSG-Subnet-Web Inbound Rules:

Priority	Source	Source Port	Destination	Destination Port	Protocol	Action
110	10.1.2.0/24	*	*	443	TCP	Allow
140	ASG-App-Servers	*	ASG-Web-Servers	443	TCP	Deny

NSG-NIC-Web Inbound Rules:

Priority	Source	Source Port	Destination	Destination Port	Protocol	Action
120	ASG-App-Servers	*	ASG-Web-Servers	443	TCP	Deny
150	10.1.2.0/24	*	*	443	TCP	Allow

A user attempts to establish an HTTPS connection from `VM-App` to `VM-Web`.

What is the result of the connection attempt?

The connection is blocked at the network interface level (NSG-NIC-Web) because the rule with priority 120 takes precedence over the rule with priority 150.Answer
B
The connection is blocked at the subnet level (NSG-Subnet-Web) because the rule with priority 140 takes precedence over the rule with priority 110.
C
The connection is blocked at the subnet level (NSG-Subnet-Web) because security rules referencing Application Security Groups (ASGs) always override IP address range rules.
D
The connection is allowed because the rule with priority 110 at the subnet level and the rule with priority 150 at the network interface level both allow the traffic.

Answer

The connection is blocked at the network interface level (NSG-NIC-Web) because the rule with priority 120 takes precedence over the rule with priority 150.

For inbound traffic, Azure processes the subnet-level NSG rules first, followed by the network interface (NIC)-level NSG rules. At the subnet level, the rule with priority 110 (Allow) takes precedence over the rule with priority 140 (Deny) because lower priority numbers have higher precedence. Thus, the traffic is allowed through the subnet. At the NIC level, the rule with priority 120 (Deny) takes precedence over the rule with priority 150 (Allow). Since the source VM-App is associated with the Application Security Group ASG-App-Servers, the rule with priority 120 blocks the connection at the NIC level. Because both levels must allow the traffic, the connection is blocked at the NIC level.

Step-by-Step Solution

Evaluate the inbound traffic at the subnet level using NSG-Subnet-Web rules.

Traffic is allowed through the subnet.

The incoming packet has a source IP of 10.1.2.4 (which matches 10.1.2.0/24) and is destined for VM-Web on port 443. NSG-Subnet-Web has two matching rules: priority 110 (Allow) and priority 140 (Deny). Since 110 is a lower number, it has higher precedence and the traffic is allowed at the subnet level.

Evaluate the inbound traffic at the network interface (NIC) level using NSG-NIC-Web rules.

Traffic is blocked at the NIC level.

NSG-NIC-Web has two matching rules: priority 120 (Deny) and priority 150 (Allow). The source VM-App is associated with the Application Security Group ASG-App-Servers, which matches the priority 120 rule. Since 120 is lower than 150, the Deny rule takes precedence and blocks the traffic.

Determine the final connection outcome.

The connection attempt fails.

For inbound traffic to be successfully established, the network traffic must be allowed by both the subnet-level NSG and the network interface-level NSG. Because the traffic was blocked at the NIC level, the connection attempt is denied.

Key Concept

Inbound NSG rule processing order and priority evaluation.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics