Examkin

Question

Difficulty: EasyConfigure Network Security Groups (NSGs) and Application Security Groups (ASGs)

An administrator configures a Network Security Group (NSG) with the following inbound security rules:

Rule NamePriorityDestinationPortAction
Rule1150ASG-Web80Deny
Rule2250ASG-Web80Allow

Which two statements correctly describe how inbound HTTP traffic (port 80) to the virtual machines associated with ASG-Web is processed? (Select two.)

  1. Inbound HTTP traffic is denied because the rule with the lower priority number is processed first.Answer
  2. The rule allowing HTTP traffic is not applied because a matching rule with a higher precedence has already processed the traffic.Answer
  3. C
    Inbound HTTP traffic is allowed because the rule with the higher priority number has precedence.
  4. D
    The rule with priority 250 is evaluated before the rule with priority 150 because rules are evaluated in descending order.

Answer

Inbound HTTP traffic is denied because the rule with the lower priority number (Rule1, priority 150) is processed first, and the rule with the higher priority number (Rule2, priority 250) is not applied because processing stops after the first match.
In Azure Network Security Groups, rules are processed in ascending order of their priority numbers, meaning a lower priority number has higher precedence. Since the rule denying HTTP traffic has a priority of 150, it is evaluated and applied before the rule allowing it (priority 250). Once a match is found, further rule evaluation stops, which prevents the second rule from being applied.

Step-by-Step Solution

1
Identify the priority numbers of the rules targeting the incoming traffic.
Rule1 has a priority of 150, and Rule2 has a priority of 250.
Azure NSGs process rules in order of priority, starting with the lowest number.
2
Determine which rule is evaluated first based on the priority numbers.
Rule1 (priority 150) is evaluated first because 150 is less than 250.
Lower priority numbers represent higher precedence in Azure security rule evaluation.
3
Apply the action of the first matching rule and stop further rule evaluation.
The traffic matches Rule1 and is denied. Rule2 is not evaluated.
Once a rule matches the traffic, NSG rule processing terminates immediately.

Key Concept

NSG rule priority evaluation order
Rate this question

Topics

Configure Network Security Groups (NSGs) and Application Security Groups (ASGs)