Examkin

Question

Difficulty: EasyConfigure Network Security Groups (NSGs) and Application Security Groups (ASGs)

You need to allow external HTTP traffic (port 8080) from the internet to a web server VM (`VM-Web`) and allow database traffic (port 14331433) from `VM-Web` to a database server VM (`VM-DB`). You associate `VM-Web` with an Application Security Group named `ASG-Web`, and `VM-DB` with an Application Security Group named `ASG-DB`. Which of the following inbound security rules must be added to the Network Security Group (NSG) to allow this traffic while maintaining the principle of least privilege? (Select two).

  1. An inbound rule with Source: `Internet`, Destination: `ASG-Web`, Destination Port: 8080, and Action: `Allow`Answer
  2. An inbound rule with Source: `ASG-Web`, Destination: `ASG-DB`, Destination Port: 14331433, and Action: `Allow`Answer
  3. C
    An inbound rule with Source: `ASG-DB`, Destination: `ASG-Web`, Destination Port: 14331433, and Action: `Allow`
  4. D
    An inbound rule with Source: `ASG-Web`, Destination: `Internet`, Destination Port: 8080, and Action: `Allow`

Answer

An inbound rule with Source: Internet, Destination: ASG-Web, Destination Port: 80, and Action: Allow; and An inbound rule with Source: ASG-Web, Destination: ASG-DB, Destination Port: 1433, and Action: Allow
To establish connectivity, we need to allow inbound HTTP traffic on port 8080 from the internet to the web servers (associated with the web Application Security Group) and allow SQL Server traffic on port 14331433 from the web servers to the database servers (associated with the database Application Security Group). Thus, the correct rules specify the internet as the source for the HTTP rule and the web Application Security Group as the source for the database rule.

Step-by-Step Solution

1
Identify the source and destination for the external HTTP traffic.
The traffic originates from the internet and targets the web servers. The rule must have Source: `Internet` and Destination: `ASG-Web` on port 8080.
This allows external web clients to access the web servers.
2
Identify the source and destination for the internal database traffic.
The traffic originates from the web servers and targets the database servers. The rule must have Source: `ASG-Web` and Destination: `ASG-DB` on port 14331433.
This allows the web application to query the SQL database.

Key Concept

Configuring inbound NSG rules targeting Application Security Groups (ASGs) to control multi-tier traffic.
Rate this question

Topics

Configure Network Security Groups (NSGs) and Application Security Groups (ASGs)