An administrator is managing an Azure subscription with a virtual network named `VNet1`. T… — Microsoft Azure Administrator (AZ-104)

An administrator is managing an Azure subscription with a virtual network named `VNet1`. The virtual network contains two subnets: `Subnet-Web` ( $10.200.1.0/24$ ) and `Subnet-DB` ( $10.200.2.0/24$ ).

`Subnet-Web` is associated with a Network Security Group (NSG) named `NSG-Subnet-Web`.
`Subnet-DB` is associated with an NSG named `NSG-Subnet-DB`.

Two virtual machines are deployed in `Subnet-Web`:
- `VM-Web1` ( $10.200.1.4$ ), whose network interface is associated with an Application Security Group (ASG) named `ASG-Web`.
- `VM-Web2` ( $10.200.1.5$ ), whose network interface has no ASG association.

One virtual machine is deployed in `Subnet-DB`:
- `VM-DB1` ( $10.200.2.4$ ), whose network interface is associated with an ASG named `ASG-Database` and an NSG named `NSG-NIC-DB`.

The Network Security Groups have the following security rules configured:

NSG-Subnet-Web (Outbound Rules):
- Priority 100: Port TCP 1433, Source: `*`, Destination: `ASG-Database`, Action: Allow

NSG-Subnet-DB (Inbound Rules):
- Priority 110: Port TCP 1433, Source: `ASG-Web`, Destination: `*`, Action: Allow
- Priority 120: Port TCP 1433, Source: `10.200.1.0/24`, Destination: `*`, Action: Deny

NSG-NIC-DB (Inbound Rules):
- Priority 130: Port TCP 1433, Source: `10.200.1.0/24`, Destination: `*`, Action: Allow
- Priority 140: Port TCP 1433, Source: `ASG-Web`, Destination: `*`, Action: Deny

Default rules apply to all NSGs.

An application on `VM-Web1` and an application on `VM-Web2` both attempt to establish a connection to a database running on `VM-DB1` over TCP port 1433.

Which statement correctly describes the outcome of these connection attempts?

The connection from VM-Web1 is allowed, and the connection from VM-Web2 is blocked by the subnet-level NSG (NSG-Subnet-DB).Answer
B
Both connection attempts are blocked. The connection from VM-Web1 is blocked by the NIC-level NSG (NSG-NIC-DB), and the connection from VM-Web2 is blocked by the subnet-level NSG (NSG-Subnet-DB).
C
Both connection attempts are allowed because the NIC-level NSG (NSG-NIC-DB) allows all inbound traffic on port 1433 from the 10.200.1.0/24 subnet.
D
The connection from VM-Web1 is blocked by the NIC-level NSG (NSG-NIC-DB), and the connection from VM-Web2 is allowed.

Answer

The connection from VM-Web1 is allowed, and the connection from VM-Web2 is blocked by the subnet-level NSG (NSG-Subnet-DB).

The connection from VM-Web1 is successfully established because it satisfies all outbound and inbound security rule checks. For outbound traffic from VM-Web1, the subnet-level NSG allows TCP 1433 to the destination ASG-Database, and default NIC-level rules allow the traffic. For inbound traffic to VM-DB1, the subnet-level NSG evaluates Rule 110 (priority 110) first, matching VM-Web1's ASG membership and allowing it. Then, the NIC-level NSG evaluates Rule 130 (priority 130) first, matching VM-Web1's IP address range and allowing the connection. The priority 140 deny rule is ignored since Rule 130 already matched. The connection from VM-Web2 is blocked because it is not in the ASG-Web group, meaning Rule 110 in the subnet-level NSG does not apply. Instead, it matches the priority 120 deny rule for the subnet CIDR block, blocking the connection at the subnet level.

Step-by-Step Solution

Evaluate the outbound traffic flow from the source virtual machines in Subnet-Web.

Both VM-Web1 and VM-Web2 have their outbound TCP 1433 traffic allowed.

NSG-Subnet-Web has a rule with priority 100 allowing TCP 1433 traffic to ASG-Database (which includes VM-DB1). Since neither source VM has a NIC-level NSG, default outbound rules permit the traffic within the VNet.

Evaluate the inbound traffic flow for VM-Web1 at the subnet level of the destination (Subnet-DB).

The traffic from VM-Web1 is allowed by NSG-Subnet-DB.

For inbound traffic, the subnet-level NSG is evaluated first. NSG-Subnet-DB has Rule 110 (priority 110) allowing traffic from ASG-Web. Since VM-Web1's network interface is in ASG-Web, it matches this rule. Evaluation terminates here, allowing the traffic past the subnet level.

Evaluate the inbound traffic flow for VM-Web1 at the NIC level of the destination (VM-DB1).

The traffic from VM-Web1 is allowed by NSG-NIC-DB.

Next, the NIC-level NSG is evaluated. NSG-NIC-DB has Rule 130 (priority 130) allowing traffic from the source subnet CIDR block (10.200.1.0/24). Since VM-Web1's IP is 10.200.1.4, it matches this rule and is allowed. The priority 140 deny rule for ASG-Web is not evaluated because rule 130 has a lower priority number (higher precedence).

Evaluate the inbound traffic flow for VM-Web2 at the subnet level of the destination (Subnet-DB).

The traffic from VM-Web2 is blocked by NSG-Subnet-DB.

VM-Web2 is not associated with ASG-Web, so Rule 110 does not match. Rule 120 (priority 120) denies traffic from 10.200.1.0/24. Since VM-Web2's IP is 10.200.1.5, it matches Rule 120 and is blocked. Inbound evaluation terminates here, preventing the traffic from reaching the VM's network interface.

Key Concept

Azure Network Security Group rules are evaluated sequentially by priority number (lower values have higher precedence). For inbound traffic, subnet-level NSGs are evaluated first, followed by NIC-level NSGs, and both levels must permit the traffic.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics