Examkin

Question

Difficulty: MediumConfigure Network Security Groups (NSGs) and Application Security Groups (ASGs)

An administrator is configuring network security for a two-tier application in an Azure subscription. The subscription contains a virtual network named VNet1VNet1 with two subnets: Subnet−WebSubnet-Web and Subnet−DatabaseSubnet-Database.

- VM−WebVM-Web is deployed in Subnet−WebSubnet-Web and has its network interface associated with an Application Security Group named ASG−WebASG-Web.
- VM−DatabaseVM-Database is deployed in Subnet−DatabaseSubnet-Database and has its network interface associated with an Application Security Group named ASG−DatabaseASG-Database.
- A Network Security Group named NSG−SubnetNSG-Subnet is associated with Subnet−DatabaseSubnet-Database.
- A Network Security Group named NSG−NICNSG-NIC is associated with the network interface of VM−DatabaseVM-Database.

You need to allow database traffic on TCP port 14331433 from VM−WebVM-Web to VM−DatabaseVM-Database while maintaining the principle of least privilege.

Which of the following actions should you perform? (Select two.)

  1. In NSG-Subnet, create an inbound security rule that allows TCP port 1433 traffic from source ASG-Web to destination ASG-Database.Answer
  2. In NSG-NIC, create an inbound security rule that allows TCP port 1433 traffic from source ASG-Web to destination ASG-Database.Answer
  3. C
    In NSG-Subnet, create an outbound security rule that allows TCP port 1433 traffic from source ASG-Web to destination ASG-Database.
  4. D
    In NSG-NIC, create an outbound security rule that allows TCP port 1433 traffic from source ASG-Web to destination ASG-Database.
  5. E
    Associate ASG-Web with Subnet-Web.

Answer

In NSG-Subnet, create an inbound security rule that allows TCP port 1433 traffic from source ASG-Web to destination ASG-Database; and in NSG-NIC, create an inbound security rule that allows TCP port 1433 traffic from source ASG-Web to destination ASG-Database.
For inbound traffic to a VM in a subnet that has a subnet-level NSG and whose NIC has a NIC-level NSG, the traffic is evaluated by the subnet NSG first, followed by the NIC NSG. To permit the connection, both NSGs must have an inbound rule allowing the traffic. Specifying ASG-Web as the source and ASG-Database as the destination on TCP port 1433 maintains the principle of least privilege.

Step-by-Step Solution

1
Analyze the network security group evaluation flow for inbound traffic.
Inbound traffic destined for a virtual machine is evaluated first by any Network Security Group (NSG) associated with the subnet, and then by any NSG associated with the network interface (NIC).
This establishes that both NSG-Subnet and NSG-NIC must explicitly permit the traffic.
2
Identify the source and destination resources using Application Security Groups (ASGs).
The source is VM-Web (represented by ASG-Web) and the destination is VM-Database (represented by ASG-Database) on TCP port 1433.
This ensures the rules use the most specific targets to maintain the principle of least privilege.
3
Formulate the required rules for both NSGs.
Create an inbound rule in NSG-Subnet allowing TCP 1433 from ASG-Web to ASG-Database, and create an identical inbound rule in NSG-NIC.
This allows the traffic through both evaluation points.

Key Concept

Inbound traffic to an Azure virtual machine with NSGs associated at both the subnet and NIC levels must pass through rules in both NSGs. Using Application Security Groups allows grouping network interfaces to simplify security policies.
Rate this question

Topics

Configure Network Security Groups (NSGs) and Application Security Groups (ASGs)

More questions from this topic