An administrator is configuring security rules for an Azure virtual network named `VNet1`.… — Microsoft Azure Administrator (AZ-104)

An administrator is configuring security rules for an Azure virtual network named `VNet1`. The virtual network contains two subnets: `Subnet-Web` ( $10.10.1.0/24$ ) and `Subnet-Data` ( $10.10.2.0/24$ ).

The environment contains the following resources:
- `VM-Web1`: Located in `Subnet-Web` and associated with the Application Security Group `ASG-Web`.
- `VM-Data1`: Located in `Subnet-Data` and associated with the Application Security Group `ASG-Data`.
- `NSG-SubnetWeb`: A Network Security Group associated with `Subnet-Web`.
- `NSG-SubnetData`: A Network Security Group associated with `Subnet-Data`.
- `NSG-NicData`: A Network Security Group associated with the network interface of `VM-Data1`.

Currently, database traffic on TCP port $1433$ from `VM-Web1` to `VM-Data1` is blocked. The security groups contain the custom rules shown in the following tables:

NSG-SubnetWeb (Outbound Rules)

Priority	Source	Destination	Port	Protocol	Action
500	`ASG-Web`	`ASG-Data`	Any	Any	Deny

NSG-SubnetData (Inbound Rules)

Priority	Source	Destination	Port	Protocol	Action
600	`10.10.1.0/24`	`ASG-Data`	1433	TCP	Deny

NSG-NicData (Inbound Rules)
- Only default rules are active.

You need to allow SQL Server database traffic on TCP port $1433$ from `VM-Web1` to `VM-Data1` while maintaining the principle of least privilege.

Which two configuration changes should you perform?

Add an outbound rule to `NSG-SubnetWeb` with a priority of 400 that allows outbound TCP traffic on port 1433 from `ASG-Web` to `ASG-Data`.Answer
Add an inbound rule to `NSG-SubnetData` with a priority of 500 that allows inbound TCP traffic on port 1433 from `ASG-Web` to `ASG-Data`.Answer
C
Add an outbound rule to `NSG-SubnetWeb` with a priority of 600 that allows outbound TCP traffic on port 1433 from `ASG-Web` to `ASG-Data`.
D
Add an inbound rule to `NSG-SubnetData` with a priority of 700 that allows inbound TCP traffic on port 1433 from `ASG-Web` to `ASG-Data`.
E
Add an inbound rule to `NSG-NicData` with a priority of 400 that allows inbound TCP traffic on port 1433 from `ASG-Web` to `ASG-Data`.

Answer

Add an outbound rule to `NSG-SubnetWeb` with a priority of 400 that allows outbound TCP traffic on port 1433 from `ASG-Web` to `ASG-Data`, and add an inbound rule to `NSG-SubnetData` with a priority of 500 that allows inbound TCP traffic on port 1433 from `ASG-Web` to `ASG-Data`.

To allow SQL Server traffic from the Web subnet to the Data subnet, rules must permit the traffic both outbound at the source and inbound at the destination. The custom outbound rule at priority 500 in the subnet NSG of the source blocks all traffic to the target ASG, requiring a custom allow rule with a priority number less than 500 (such as 400). Similarly, the custom inbound rule at priority 600 in the subnet NSG of the destination blocks TCP port 1433 traffic from the source subnet, requiring a custom allow rule with a priority number less than 600 (such as 500). No configuration changes are needed at the destination NIC level because the default AllowVnetInbound rule (priority 65000) already allows traffic from within the VNet.

Step-by-Step Solution

Evaluate the outbound path from VM-Web1

Outbound traffic from VM-Web1 must pass through the subnet-level NSG (NSG-SubnetWeb). Currently, NSG-SubnetWeb contains Rule 500, which denies all traffic from ASG-Web to ASG-Data. To allow SQL Server traffic, we must create a custom outbound rule with a priority value less than 500 (such as priority 400).

Lower priority numbers represent higher evaluation precedence in Azure Network Security Groups.

Evaluate the inbound path to VM-Data1 at the subnet level

Inbound traffic must pass through the subnet-level NSG (NSG-SubnetData). NSG-SubnetData currently contains Rule 600, which denies TCP 1433 traffic from the Web subnet (10.10.1.0/24) to ASG-Data. To allow the SQL Server traffic, we must create a custom inbound rule in NSG-SubnetData with a priority value less than 600 (such as priority 500).

Traffic must pass through the subnet-level NSG before it reaches the network interface (NIC) level NSG.

Evaluate the inbound path to VM-Data1 at the NIC level

Inbound traffic must also pass through the NIC-level NSG (NSG-NicData). Since NSG-NicData has only default rules, the default rule AllowVnetInbound (priority 65000) permits VNet-internal traffic. Because VM-Web1 and VM-Data1 are within the same virtual network, the default rule allows the traffic at this stage.

No additional custom rules are required on NSG-NicData because the default inbound rules do not block this internal VNet traffic.

Key Concept

Azure Network Security Group rules are processed sequentially in priority order (lower numbers having higher precedence). For cross-subnet traffic, outbound rules are evaluated first at the NIC and then the subnet of the source, followed by inbound rules evaluated first at the subnet and then the NIC of the destination. Default rules apply if no custom rules match, and Application Security Groups can be used to define security policies across subnet boundaries.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics