An administrator manages an Azure subscription containing a virtual network named `VNet1`.… — Microsoft Azure Administrator (AZ-104)

An administrator manages an Azure subscription containing a virtual network named `VNet1`. `VNet1` contains two subnets: `Subnet-Web` ( $10.0.1.0/24$ ) and `Subnet-App` ( $10.0.2.0/24$ ).

A virtual machine named `VM-Web` is deployed in `Subnet-Web` and has a network interface named `NIC-Web`. A Network Security Group (NSG) named `NSG-Subnet` is associated with `Subnet-Web`. A second NSG named `NSG-NIC` is associated with `NIC-Web`.

`NSG-Subnet` contains the following inbound security rule:
* Priority: $110$ , Source: $10.0.2.0/24$ , Port: $80$ , Protocol: TCP, Action: Allow

`NSG-NIC` contains the following inbound security rules:
* Priority: $120$ , Source: Any, Port: $80$ , Protocol: TCP, Action: Deny
* Priority: $130$ , Source: $10.0.2.4$ , Port: $80$ , Protocol: TCP, Action: Allow

A virtual machine named `VM-App` is deployed in `Subnet-App` with the IP address $10.0.2.4$ .

If `VM-App` attempts to establish an HTTP connection to `VM-Web` on TCP port $80$ , what is the outcome of this connection attempt?

A
The connection is successful because the subnet-level rule in `NSG-Subnet` has a lower priority number ( $110$ ) than the deny rule in `NSG-NIC` ( $120$ ), causing it to override the NIC-level block.
B
The connection is successful because `NSG-Subnet` allows the traffic and the Allow rule with priority $130$ in `NSG-NIC` matches the source IP address.
The connection is blocked by `NSG-NIC` because the Deny rule with priority $120$ takes precedence over the Allow rule with priority $130$ .Answer
D
The connection is blocked by `NSG-Subnet` because inbound traffic to a virtual machine is evaluated first at the network interface level before the subnet level.

Answer

The connection is blocked by `NSG-NIC` because the Deny rule with priority

120

takes precedence over the Allow rule with priority

130

For inbound traffic, Azure processes the subnet-level NSG first, followed by the NIC-level NSG. The traffic successfully passes the subnet NSG because of the rule at priority

110

. However, when the traffic reaches the NIC NSG, it is matched against the rule with priority

120

(Deny) before the rule with priority

130

(Allow) because lower priority numbers have higher precedence. As a result, the connection is blocked at the network interface level.

Step-by-Step Solution

Determine the evaluation order for inbound traffic to the destination virtual machine.

Inbound traffic is evaluated first by the Network Security Group associated with the subnet (`NSG-Subnet`), and then by the Network Security Group associated with the network interface (`NSG-NIC`).

Azure processes security rules sequentially from the subnet boundary to the network interface boundary for inbound flows.

Evaluate the traffic against the rules in `NSG-Subnet`.

The rule with priority

110

allows TCP traffic on port

80

from the source range

10.0.2.0/24

. Since `VM-App` has the IP address

10.0.2.4

, the traffic matches this rule and is allowed past the subnet layer.

The source IP falls within the CIDR block defined in the rule.

Evaluate the traffic against the rules in `NSG-NIC` by priority order.

The rule with priority

120

(Deny, Source: Any, Port:

80

) is evaluated before the rule with priority

130

(Allow, Source:

10.0.2.4

, Port:

80

). The priority

120

rule matches the traffic and applies the Deny action, blocking the connection.

Within a single NSG, rules are evaluated in order of ascending priority numbers (lower numbers represent higher precedence). Once a matching rule is found, subsequent rules are not processed.

Key Concept

Azure Network Security Group (NSG) inbound traffic evaluation order (subnet-level before NIC-level) and internal rule precedence based on priority numbers.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics