Examkin

Question

Difficulty: MediumConfigure Network Security Groups (NSGs) and Application Security Groups (ASGs)

Your company has an Azure subscription containing a virtual network named `VNet1`. `VNet1` contains two subnets named `Subnet1` and `Subnet2`.

You have the following virtual machines and network configurations:
* `VM1` is in `Subnet1`. Its network interface `NIC1` is associated with an Application Security Group named `ASG-Web`.
* `VM2` is in `Subnet2`. Its network interface `NIC2` is associated with an Application Security Group named `ASG-Database`.
* A Network Security Group named `NSG-Subnet1` is associated with `Subnet1`.
* A Network Security Group named `NSG-NIC1` is associated with `NIC1`.
* A Network Security Group named `NSG-Subnet2` is associated with `Subnet2`.
* A Network Security Group named `NSG-NIC2` is associated with `NIC2`.

The Network Security Groups are configured with the following custom inbound rules:

NSG-Subnet1 Inbound Rules
PriorityPortProtocolSourceDestinationAction
10080TCPAnyASG-WebAllow
NSG-NIC1 Inbound Rules
PriorityPortProtocolSourceDestinationAction
11080TCPAnyAnyDeny
12080TCPAnyASG-WebAllow
NSG-Subnet2 Inbound Rules
PriorityPortProtocolSourceDestinationAction
1301433TCPASG-WebASG-DatabaseAllow
NSG-NIC2 Inbound Rules
PriorityPortProtocolSourceDestinationAction
1401433TCPAnyAnyDeny
1501433TCPASG-WebASG-DatabaseAllow

All other settings are at their default configurations.

A user on the internet attempts to establish an HTTP connection to `VM1` on TCP port 80. Simultaneously, `VM1` attempts to establish a SQL Server connection to `VM2` on TCP port 1433.

Which of the following describes the outcome of these connection attempts?

  1. Both the HTTP connection to VM1 and the SQL Server connection to VM2 are blocked.Answer
  2. B
    Both the HTTP connection to VM1 and the SQL Server connection to VM2 are allowed.
  3. C
    The HTTP connection to VM1 is allowed, but the SQL Server connection to VM2 is blocked.
  4. D
    The HTTP connection to VM1 is blocked, but the SQL Server connection to VM2 is allowed.

Answer

Both the HTTP connection to VM1 and the SQL Server connection to VM2 are blocked.
For the HTTP connection to VM1, the inbound traffic is first allowed by the subnet-level NSG (NSG-Subnet1) via priority 100, but then evaluated by the NIC-level NSG (NSG-NIC1) where the Deny rule (priority 110) takes precedence over the Allow rule (priority 120). For the SQL Server connection to VM2, the outbound traffic from VM1 is allowed by default. However, when the traffic reaches VM2, the subnet-level NSG (NSG-Subnet2) allows it via priority 130, but the NIC-level NSG (NSG-NIC2) blocks it because the Deny rule (priority 140) takes precedence over the Allow rule (priority 150).

Step-by-Step Solution

1
Analyze the HTTP inbound traffic flow to VM1 on TCP port 80.
The traffic is first evaluated by the subnet-level NSG (NSG-Subnet1), where Rule 100 allows it because the destination matches ASG-Web. It then reaches the NIC-level NSG (NSG-NIC1), where the Deny rule (priority 110) is evaluated before the Allow rule (priority 120) because 110 is a lower priority number. The traffic is blocked at the NIC.
Inbound traffic is processed first by the subnet NSG and then by the NIC NSG. Within each NSG, rules are processed in order of priority (lowest number first).
2
Analyze the SQL Server outbound traffic flow from VM1.
The traffic is evaluated by the NIC-level NSG and subnet-level NSG outbound rules. Since no custom outbound rules are defined, the default outbound rules apply, which permit all virtual network traffic (AllowVnetOutbound).
Traffic between subnets in the same virtual network is allowed by default at the outbound level.
3
Analyze the SQL Server inbound traffic flow to VM2 on TCP port 1433.
The inbound traffic is first evaluated by the subnet-level NSG (NSG-Subnet2), where Rule 130 allows it because the source is ASG-Web and destination is ASG-Database. It then reaches the NIC-level NSG (NSG-NIC2), where the Deny rule (priority 140) is processed before the Allow rule (priority 150). The traffic is blocked at the NIC.
Inbound traffic to VM2 must pass both NSG-Subnet2 and NSG-NIC2. The NIC-level NSG blocks the traffic due to the priority order.

Key Concept

Network Security Group rule evaluation logic and precedence for inbound traffic using Application Security Groups.
Rate this question

Topics

Configure Network Security Groups (NSGs) and Application Security Groups (ASGs)