Examkin

Question

Difficulty: MediumConfigure Network Security Groups (NSGs) and Application Security Groups (ASGs)

Your Azure subscription contains a virtual network named `VNet1` that has two subnets: `Subnet-Web` and `Subnet-App`.

The network contains the following virtual machines and security configurations:
* `VM-Web1` is in `Subnet-Web` and is associated with an Application Security Group (ASG) named `ASG-Web-Front`.
* `VM-App1` is in `Subnet-App` and is associated with an ASG named `ASG-App-Logic`.
* `Subnet-Web` is associated with a Network Security Group (NSG) named `NSG-Subnet-Web`.
* `Subnet-App` is associated with an NSG named `NSG-Subnet-App`.
* The network interface (NIC) of `VM-App1` is associated with an NSG named `NSG-NIC-App1`.

Currently, the NSGs have the following custom rules:

NSG-Subnet-Web (Outbound Rules)
PrioritySourceSource PortDestinationDestination PortProtocolAction
100ASG-Web-Front*ASG-App-Logic80TCPDeny
200*****Allow
NSG-Subnet-App (Inbound Rules)
PrioritySourceSource PortDestinationDestination PortProtocolAction
150***80TCPDeny
250ASG-Web-Front*ASG-App-Logic80TCPAllow
NSG-NIC-App1 (Inbound Rules)
PrioritySourceSource PortDestinationDestination PortProtocolAction
110ASG-Web-Front*ASG-App-Logic80TCPAllow
120VirtualNetwork*Any**Deny

You need to allow `VM-Web1` to initiate outbound HTTP connections to `VM-App1` on port 80. Which two modifications should you perform to establish this connectivity?

  1. In `NSG-Subnet-Web`, create an outbound rule with a priority of 90 that allows TCP traffic on port 80 from `ASG-Web-Front` to `ASG-App-Logic`.Answer
  2. B
    In `NSG-Subnet-App`, change the priority of the inbound rule that allows traffic from `ASG-Web-Front` to 300.
  3. In `NSG-Subnet-App`, change the priority of the inbound rule that allows traffic from `ASG-Web-Front` to 120.Answer
  4. D
    In `NSG-NIC-App1`, change the priority of the inbound rule that denies traffic from `VirtualNetwork` to 105.
  5. E
    In `NSG-NIC-App1`, delete the inbound rule with a priority of 120.

Answer

To allow the HTTP traffic, you must create a higher priority (lower number) outbound allow rule in `NSG-Subnet-Web` (priority 90) and adjust the priority of the inbound allow rule in `NSG-Subnet-App` to be lower than the inbound deny rule (priority 120).
To allow the HTTP traffic, it must be permitted at all security boundaries. First, the outbound traffic from `VM-Web1` is blocked by the outbound deny rule at priority 100 in `NSG-Subnet-Web`. Creating an outbound allow rule with a priority of 90 overrides this deny rule. Second, the inbound traffic to `VM-App1` is blocked at the subnet level by the inbound deny rule at priority 150 in `NSG-Subnet-App`. Changing the inbound allow rule's priority to 120 ensures it is evaluated first. Third, at the NIC level, the inbound traffic is already permitted because the allow rule at priority 110 takes precedence over the deny rule at priority 120.

Step-by-Step Solution

1
Analyze the outbound traffic flow from `VM-Web1` at the subnet level.
The traffic is blocked by the custom rule with priority 100 in `NSG-Subnet-Web`. To resolve this, create an outbound allow rule with a priority number less than 100 (such as 90) to take precedence.
Lower priority numbers have higher evaluation precedence.
2
Analyze the inbound traffic flow to `VM-App1` at the subnet level.
The traffic is blocked by the custom deny rule with priority 150 in `NSG-Subnet-App`, because it is evaluated before the allow rule at priority 250. To resolve this, change the allow rule priority number to be less than 150 (such as 120).
The allow rule must be evaluated before the deny rule to permit the traffic.
3
Analyze the inbound traffic flow to `VM-App1` at the network interface (NIC) level.
The traffic is allowed by the custom rule with priority 110 in `NSG-NIC-App1`, which takes precedence over the deny rule at priority 120. No changes are required here.
Traffic is already permitted through the NIC-level NSG.

Key Concept

NSG rule evaluation order and priority ranking across subnet and network interface scopes
Rate this question

Topics

Configure Network Security Groups (NSGs) and Application Security Groups (ASGs)