You manage an Azure environment containing a virtual network named `VNet-Prod`. The virtua… — Microsoft Azure Administrator (AZ-104)

You manage an Azure environment containing a virtual network named `VNet-Prod`. The virtual network has a subnet named `Subnet-App` ( $10.0.1.0/24$ ).

`Subnet-App` is associated with a Network Security Group (NSG) named `NSG-Subnet`.

A virtual machine named `VM-App1` is deployed in `Subnet-App` and has a network interface named `NIC-App1`. `NIC-App1` is associated with an NSG named `NSG-NIC`.

An Application Security Group (ASG) named `ASG-App` is created, and `NIC-App1` is associated with `ASG-App`.

`NSG-Subnet` contains the following inbound security rules:
* `Rule-Sub1`: Priority $120$ , Source: `Internet`, Destination: `ASG-App`, Destination Port: $443$ , Protocol: `TCP`, Action: `Allow`
* `Rule-Sub2`: Priority $150$ , Source: `Any`, Destination: `Any`, Destination Port: `Any`, Protocol: `Any`, Action: `Deny`

`NSG-NIC` contains the following inbound security rules:
* `Rule-Nic1`: Priority $110$ , Source: `203.0.113.50/32`, Destination: `Any`, Destination Port: $443$ , Protocol: `TCP`, Action: `Deny`
* `Rule-Nic2`: Priority $200$ , Source: `Internet`, Destination: `Any`, Destination Port: $443$ , Protocol: `TCP`, Action: `Allow`

A user attempts to establish an HTTPS connection from a client device on the internet with the public IP address $203.0.113.50$ to `VM-App1`.

What is the status of the connection attempt, and why?

The connection is blocked at the network interface level because the rule with priority 110 has precedence over the rule with priority 200, resulting in a deny action.Answer
B
The connection is successful because the subnet-level NSG allows the traffic through the rule with priority 120, and the NIC-level NSG allows it through the rule with priority 200 since both apply to the Internet source.
C
The connection is blocked at the subnet level because the rule with priority 120 uses an Application Security Group as the destination, which is not supported in subnet-associated NSGs.
D
The connection is blocked at the network interface level because the rule with priority 200 is ignored, as the Application Security Group is not specified as a destination in the NIC-level NSG rules.

Answer

The connection is blocked at the network interface level because the rule with priority 110 has precedence over the rule with priority 200, resulting in a deny action.

For inbound traffic to an Azure virtual machine, the subnet-level NSG is evaluated first. The traffic is allowed by the rule with priority 120 because the source is 'Internet' (covering the client's public IP address) and the destination is the ASG associated with the virtual machine's NIC. Next, the NIC-level NSG is evaluated. In this NSG, the rule with priority 110 (Deny) is processed before the rule with priority 200 (Allow) because lower numbers have higher precedence. Since the client's IP matches the source IP of the priority 110 rule, the traffic is denied and blocked at the NIC level.

Step-by-Step Solution

Evaluate the inbound traffic at the subnet level (NSG-Subnet).

The traffic matches the rule with priority 120 (Rule-Sub1) because the source is 'Internet' (which includes the public IP address), the destination is the ASG associated with the virtual machine, and the port is 443. The action is 'Allow'.

For inbound traffic, subnet-level NSGs are evaluated before NIC-level NSGs. Traffic must be allowed by both levels.

Evaluate the inbound traffic at the network interface level (NSG-NIC).

The traffic is matched against rules in ascending order of priority. The rule with priority 110 (Rule-Nic1) is evaluated first because 110 is less than 200. The source IP matches the rule's specific source IP, the destination is 'Any', and the port is 443.

Azure NSG rules are processed in priority order; lower numbers have higher precedence. Once a match is found, further rule processing stops.

Determine the final connection state based on the evaluations.

The rule with priority 110 specifies a 'Deny' action. Consequently, the traffic is blocked at the NIC level.

Even though the subnet-level NSG allowed the traffic, the NIC-level NSG blocked it, preventing the connection from completing.

Key Concept

Azure Network Security Group inbound evaluation flow and rule priority precedence.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics