An administrator is configuring network security for an Azure virtual network named VNet-C… — Microsoft Azure Administrator (AZ-104)

An administrator is configuring network security for an Azure virtual network named $VNet-Corp$ . The virtual network contains a single subnet named $Subnet-App$ that is associated with a Network Security Group (NSG) named $NSG-App$ .

Three virtual machines are deployed in $Subnet-App$ :
- $VM-Client$ is associated with an Application Security Group (ASG) named $ASG-Client$ .
- $VM-Logic$ is associated with an Application Security Group (ASG) named $ASG-Logic$ .
- $VM-Database$ is not associated with any ASG.

You need to configure $NSG-App$ to meet the following requirements:
- Allow $VM-Client$ to establish connections to the application logic service running on $VM-Logic$ over TCP port $8080$ .
- Prevent $VM-Database$ and all other sources within the virtual network from connecting to $VM-Logic$ on TCP port $8080$ .
- Follow the principle of least privilege and use the minimum number of security rules.

Which two inbound security rules should you add to $NSG-App$ ? (Select two.)

A rule that allows TCP port 8080 traffic with a Source of ASG-Client, a Destination of ASG-Logic, and a Priority of 120Answer
A rule that denies TCP port 8080 traffic with a Source of Any, a Destination of ASG-Logic, and a Priority of 150Answer
C
A rule that allows TCP port 8080 traffic with a Source of ASG-Client, a Destination of ASG-Logic, and a Priority of 180
D
A rule that denies TCP port 8080 traffic with a Source of ASG-Client, a Destination of ASG-Logic, and a Priority of 100

Answer

To meet the requirements, you must add an inbound rule allowing TCP port 8080 traffic from the client Application Security Group to the logic Application Security Group with a priority of 120, and another inbound rule denying TCP port 8080 traffic from any source to the logic Application Security Group with a priority of 150.

The correct configuration consists of an inbound allow rule with a priority of 120 and a deny rule with a priority of 150. NSG rules are evaluated in order of priority (lower numerical values first). When traffic from the client VM (associated with the client Application Security Group) arrives, it matches the allow rule at priority 120 and is permitted; evaluation then stops. Traffic from the database VM or other sources does not match the allow rule, so it continues to the deny rule at priority 150, where it is blocked. This successfully restricts access to the logic VM on port 8080 to only the client VM.

Step-by-Step Solution

Determine how to target the source and destination VMs.

Identify that the source VM-Client is in the client Application Security Group, and the destination VM-Logic is in the logic Application Security Group.

Using Application Security Groups allows for grouping VMs and applying rules to those groups instead of individual IP addresses, minimizing administrative effort.

Configure the rule to allow the desired traffic flow.

Define an inbound rule allowing TCP port 8080 traffic from the client Application Security Group to the logic Application Security Group with a priority of 120.

This satisfies the requirement to permit VM-Client to connect to VM-Logic on port 8080.

Configure the rule to block all other traffic to the destination.

Define an inbound rule denying TCP port 8080 traffic from any source to the logic Application Security Group with a priority of 150.

Since the default rules allow all VNet-to-VNet inbound traffic, this rule is required to block other VMs in the subnet, such as VM-Database, from accessing VM-Logic on port 8080. The priority must be higher (meaning a larger number, like 150) than the allow rule (120) so that the allow rule takes precedence for the client VM.

Key Concept

Azure Network Security Group rules are processed in priority order (lower numbers evaluated first). Application Security Groups can be used as sources or destinations to define security rules based on application structure.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics