You have an Azure virtual network named `VNet1` that contains a subnet named `Subnet1`. A … — Microsoft Azure Administrator (AZ-104)

You have an Azure virtual network named `VNet1` that contains a subnet named `Subnet1`. A virtual machine named `VM1` is deployed to `Subnet1`. The network interface (NIC) of `VM1` is associated with a Network Security Group (NSG) named `NSG-NIC`. `Subnet1` is associated with an NSG named `NSG-Subnet`.

`NSG-Subnet` contains the following inbound security rule:

Rule Name	Priority	Source	Destination	Port	Action
Deny-Internet	$150$	Internet	Any	*	Deny

`NSG-NIC` contains the following inbound security rule:

Rule Name	Priority	Source	Destination	Port	Action
Deny-All-Internet	$200$	Internet	Any	*	Deny

You need to allow HTTP traffic (port $80$ ) from the Internet to `VM1`.

Which two rules should you add? (Choose two.)

A rule in `NSG-Subnet` with a priority of $100$ that allows inbound traffic from the Internet to any destination on port $80$ .Answer
A rule in `NSG-NIC` with a priority of $100$ that allows inbound traffic from the Internet to any destination on port $80$ .Answer
C
A rule in `NSG-Subnet` with a priority of $200$ that allows inbound traffic from the Internet to any destination on port $80$ .
D
A rule in `NSG-NIC` with a priority of $300$ that allows inbound traffic from the Internet to any destination on port $80$ .
E
A rule in `NSG-Subnet` with a priority of $100$ that allows outbound traffic to the Internet on port $80$ .

Answer

Configure a rule in NSG-Subnet with a priority of 100 that allows inbound traffic from the Internet to any destination on port 80, and configure a rule in NSG-NIC with a priority of 100 that allows inbound traffic from the Internet to any destination on port 80.

Inbound traffic from the Internet destined for a virtual machine is evaluated sequentially by the subnet-level NSG first, and then by the NIC-level NSG. Since both NSG-Subnet and NSG-NIC contain explicit rules that deny all inbound Internet traffic, an allow rule must be added to both NSGs. In Azure NSGs, rules with lower priority numbers are processed first. Therefore, the rule in NSG-Subnet must have a priority lower than 150 (such as 100), and the rule in NSG-NIC must have a priority lower than 200 (such as 100) to override the existing deny rules.

Step-by-Step Solution

Analyze the evaluation order of Network Security Groups for inbound traffic to virtual machines.

Inbound traffic from the Internet must first pass through the subnet-level NSG (NSG-Subnet) and then through the NIC-level NSG (NSG-NIC). Traffic must be allowed at both levels.

Azure evaluates inbound traffic against subnet-associated NSGs first, and then against NIC-associated NSGs. If either NSG blocks the traffic, it will not reach the destination VM.

Evaluate the priority requirements for NSG-Subnet.

An inbound rule with a priority value lower than 150 (such as 100) must be created to allow port 80 traffic.

NSG-Subnet has an existing inbound rule that denies all Internet traffic at priority 150. Since lower priority numbers represent higher precedence, any allow rule must have a priority number lower than 150.

Evaluate the priority requirements for NSG-NIC.

An inbound rule with a priority value lower than 200 (such as 100) must be created to allow port 80 traffic.

NSG-NIC has an existing inbound rule that denies all Internet traffic at priority 200. The allow rule must have a priority number lower than 200 to override this deny behavior.

Key Concept

Azure Network Security Group dual-level evaluation and rule priority mechanics.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics