Examkin

Question

Difficulty: MediumConfigure Network Security Groups (NSGs) and Application Security Groups (ASGs)

A virtual machine named `VM-Web1` is associated with an Application Security Group named `ASG-ProdWeb` within an Azure environment. The subnet hosting `VM-Web1` uses a Network Security Group named `NSG-Subnet`. The network interface of `VM-Web1` uses a Network Security Group named `NSG-NIC`.

`NSG-Subnet` contains the following inbound security rule:

PriorityPortProtocolSourceDestinationAction
150443TCPInternetAnyAllow

`NSG-NIC` contains the following inbound security rules:

PriorityPortProtocolSourceDestinationAction
110443TCPAny`ASG-ProdWeb`Deny
120443TCPInternetAnyAllow

A user attempts to establish an HTTPS (TCP port 443) connection from the Internet to `VM-Web1`.

Which of the following describes the final status of this connection attempt?

  1. A
    Traffic is permitted to reach the virtual machine because the subnet security group rule is evaluated first and grants access.
  2. Traffic is blocked at the network interface level by the security rule with priority 110.Answer
  3. C
    Traffic is permitted to reach the virtual machine because the allow rule with priority 120 overrides the deny rule with priority 110.
  4. D
    Traffic is blocked at the subnet level because subnet-level rules always take precedence over network interface-level rules.

Answer

Traffic is blocked at the network interface level by the security rule with priority 110.
Inbound traffic to an Azure virtual machine is evaluated first by the subnet-level NSG and then by the network interface-level NSG. In this scenario, the subnet NSG allows the traffic (priority 150). Next, the network interface NSG evaluates the traffic. Within the network interface NSG, rules are processed by priority from lowest number to highest. The rule with priority 110 (Deny to the Application Security Group) is evaluated before the rule with priority 120 (Allow). Since the destination virtual machine is a member of that Application Security Group, the deny rule matches first and blocks the traffic.

Step-by-Step Solution

1
Evaluate the inbound traffic against the subnet-level Network Security Group (`NSG-Subnet`).
The traffic is permitted because the rule with priority 150 matches the inbound HTTPS traffic from the Internet and allows it.
For inbound traffic, Azure evaluates the subnet-level NSG before the network interface-level NSG.
2
Evaluate the inbound traffic against the network interface-level Network Security Group (`NSG-NIC`) starting with the rule that has the lowest priority number.
The rule with priority 110 is evaluated first because 110 is less than 120.
Azure processes NSG rules in order of priority, where lower numbers have higher precedence (higher logical priority).
3
Determine if the rule with priority 110 matches the inbound traffic to `VM-Web1`.
The traffic matches because the destination is `VM-Web1` (associated with the network interface in `ASG-ProdWeb`) and the port is 443, resulting in the traffic being denied.
Application Security Groups (ASGs) allow grouping network interfaces to apply security rules, and since `VM-Web1`'s network interface is associated with `ASG-ProdWeb`, this rule is matched.

Key Concept

Evaluation order of subnet-level and network interface-level Network Security Groups (NSGs), and rule precedence based on priority numbers.
Rate this question

Topics

Configure Network Security Groups (NSGs) and Application Security Groups (ASGs)