Examkin

Question

Difficulty: HardConfigure Azure Application Gateway

An administrator is configuring an Azure Application Gateway v2 named `AppGW1` in a dedicated subnet named `Subnet-GW` within `VNet-Hub`. To comply with security policies, the administrator associates a Network Security Group (NSG) named `NSG-GW` to `Subnet-GW`. The NSG contains a custom inbound rule (Rule1) with a priority of 300 that denies all inbound traffic from any source. To allow client HTTPS traffic, the administrator creates another inbound rule (Rule2) with a priority of 200 that allows traffic from the `Internet` service tag to destination port 443. After applying these rules, the backend health status of all backend pools shows as 'Unknown' and client communication fails. Which configuration change should the administrator implement on `NSG-GW` to restore backend health monitoring and allow the Application Gateway to function?

  1. Add an inbound security rule with a priority of 250 that allows traffic from the `GatewayManager` service tag to destination ports 65200-65535.Answer
  2. B
    Add an inbound security rule with a priority of 350 that allows traffic from the `GatewayManager` service tag to destination ports 65200-65535.
  3. C
    Create a route table associated with `Subnet-GW` and add a user-defined route for 0.0.0.0/0 with a next hop type of Virtual Network Gateway.
  4. D
    Enable gateway transit on the virtual network peering between `VNet-Hub` and the spoke virtual network containing the backend servers.

Answer

Add an inbound security rule with a priority of 250 that allows traffic from the `GatewayManager` service tag to destination ports 65200-65535.
The correct configuration change is to add an inbound rule allowing traffic from the `GatewayManager` service tag on ports 65200-65535 with a priority value less than 300 (such as 250). Azure Application Gateway v2 requires this communication for internal management and health probes. Since the custom deny rule is at priority 300, any allow rule must be assigned a lower priority value to be evaluated first.

Step-by-Step Solution

1
Identify the cause of the 'Unknown' backend health state, which is the blocking of management traffic from the Gateway Manager service.
The Azure Application Gateway infrastructure requires inbound connectivity from the `GatewayManager` service tag on ports 65200-65535 for health probes and management.
By default, Azure allows this traffic, but the custom rule (priority 300) denying all inbound traffic overrides the default rules.
2
Determine the required priority for the new allow rule.
Since the custom deny rule has a priority of 300, the new allow rule must have a priority number lower than 300 (e.g., 250) to take precedence.
Azure Network Security Groups process rules in order of priority, where lower numbers have higher precedence.

Key Concept

Azure Application Gateway v2 requires inbound traffic from the `GatewayManager` service tag on ports 65200-65535. Any custom NSG rules blocking inbound traffic must have a higher priority number (lower precedence) than the rule allowing this management traffic.
Rate this question

Topics

Configure Azure Application Gateway

More questions from this topic