An organization has an Azure subscription containing two subnets named Subnet-Web (10.1.1.… — Microsoft Azure Administrator (AZ-104)

An organization has an Azure subscription containing two subnets named Subnet-Web ( $10.1.1.0/24$ ) and Subnet-App ( $10.1.2.0/24$ ). A virtual machine named VM-Web is deployed in Subnet-Web, and its network interface is associated with an Application Security Group named ASG-Web. A virtual machine named VM-App is deployed in Subnet-App, and its network interface is associated with an Application Security Group named ASG-App.

A network security group named NSG-Subnet is associated with Subnet-App and contains the following inbound security rules:
* Priority $110$ : Source: ASG-Web, Destination: ASG-App, Port: $443$ , Protocol: TCP, Action: Deny
* Priority $120$ : Source: $10.1.1.0/24$ , Destination: Any, Port: $443$ , Protocol: TCP, Action: Allow

A network security group named NSG-NIC is associated with the network interface of VM-App and contains the following inbound security rule:
* Priority $100$ : Source: ASG-Web, Destination: ASG-App, Port: $443$ , Protocol: TCP, Action: Allow

What is the outcome when VM-Web attempts to connect to VM-App on TCP port $443$ ?

A
The connection is allowed because the rule with priority $100$ in NSG-NIC has a higher precedence (lower priority number) than the deny rule in NSG-Subnet.
The connection is blocked because NSG-Subnet is evaluated first for inbound traffic, and its rule with priority $110$ matches and denies the traffic.Answer
C
The connection is allowed because the rule with priority $120$ in NSG-Subnet matches the source IP address range of VM-Web and overrides the rule with priority $110$ .
D
The connection is blocked because NSG-NIC is evaluated first for inbound traffic, and the rule with priority $100$ is overridden by the subnet-level rules.

Answer

The connection is blocked because NSG-Subnet is evaluated first for inbound traffic, and its rule with priority 110 matches and denies the traffic.

For inbound traffic, Azure processes the network security group (NSG) associated with the subnet first, followed by the NSG associated with the network interface (NIC). Within each NSG, rules are evaluated in order of priority, where lower priority numbers take precedence. In NSG-Subnet, the rule with priority 110 matches the connection request from the Application Security Group (ASG) associated with VM-Web (ASG-Web) to the ASG associated with VM-App (ASG-App) on port 443, resulting in a Deny action. Because the traffic is blocked at the subnet level, evaluation stops, and the NIC-level NSG (NSG-NIC) is not processed.

Step-by-Step Solution

Determine the direction of the network traffic and the NSG evaluation sequence.

The traffic is inbound to VM-App. For inbound traffic, Azure first evaluates the network security group associated with the subnet (NSG-Subnet) and then evaluates the network security group associated with the network interface (NSG-NIC).

Understanding the order of NSG evaluation is critical since inbound traffic must pass both subnet and NIC-level NSGs to be allowed.

Evaluate the rules in the subnet-level NSG (NSG-Subnet) in order of priority.

The rule with priority

110

(Deny from ASG-Web to ASG-App on port

443

) has a lower number than the rule with priority

120

. It is evaluated first. Since the source VM-Web is in ASG-Web and destination VM-App is in ASG-App, the rule matches and the traffic is denied.

Rules within an NSG are processed sequentially starting from the lowest priority number. The first matching rule determines the outcome, and subsequent rules are ignored.

Determine the final outcome of the connection attempt.

Since the traffic is denied at the subnet level, the evaluation stops immediately. The NIC-level NSG (NSG-NIC) is not evaluated, and the connection is blocked.

If traffic is blocked at the subnet level for inbound connections, it is dropped immediately and does not reach the NIC-level NSG.

Key Concept

Azure Network Security Group inbound evaluation order and rule priority processing

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics