An Azure environment contains the following resources: - A virtual network named `VNet1` w… — Microsoft Azure Administrator (AZ-104)

An Azure environment contains the following resources:
- A virtual network named `VNet1` with two subnets: `Subnet-Web` ( $10.0.1.0/24$ ) and `Subnet-DB` ( $10.0.2.0/24$ ).
- A virtual machine named `VM-Web1` in `Subnet-Web` with its network interface associated with an Application Security Group (ASG) named `ASG-Web`.
- A virtual machine named `VM-DB1` in `Subnet-DB` with its network interface associated with an ASG named `ASG-DB`.
- `Subnet-DB` is associated with a Network Security Group (NSG) named `NSG-Subnet`.
- The network interface of `VM-DB1` is associated with an NSG named `NSG-NIC`.

The NSGs contain the following custom inbound security rules:

### NSG-Subnet

Priority	Source	Destination	Port	Protocol	Action
200	10.0.1.0/24	Any	Any	Any	Deny

### NSG-NIC

Priority	Source	Destination	Port	Protocol	Action
300	VirtualNetwork	Any	Any	Any	Deny

You need to allow database traffic from `VM-Web1` to `VM-DB1` on TCP port 1433. All other traffic from `Subnet-Web` to `Subnet-DB` must remain blocked.

Which two security rules should you create to meet these requirements? (Select TWO.)

In `NSG-Subnet`, create an inbound rule with Priority 150, Source: `ASG-Web`, Destination: `ASG-DB`, Port: 1433, Protocol: TCP, Action: Allow.Answer
In `NSG-NIC`, create an inbound rule with Priority 250, Source: `ASG-Web`, Destination: `ASG-DB`, Port: 1433, Protocol: TCP, Action: Allow.Answer
C
In `NSG-Subnet`, create an inbound rule with Priority 250, Source: `ASG-Web`, Destination: `ASG-DB`, Port: 1433, Protocol: TCP, Action: Allow.
D
In `NSG-NIC`, create an inbound rule with Priority 350, Source: `ASG-Web`, Destination: `ASG-DB`, Port: 1433, Protocol: TCP, Action: Allow.

Answer

In NSG-Subnet, create an inbound rule with Priority 150, Source: ASG-Web, Destination: ASG-DB, Port: 1433, Protocol: TCP, Action: Allow; and in NSG-NIC, create an inbound rule with Priority 250, Source: ASG-Web, Destination: ASG-DB, Port: 1433, Protocol: TCP, Action: Allow.

To establish connectivity, the traffic must be allowed by both the subnet-level NSG (NSG-Subnet) and the NIC-level NSG (NSG-NIC). In Azure, NSG rules are processed in priority order where lower numbers have higher precedence. To bypass the deny rule in NSG-Subnet (priority 200), the allow rule must have a priority number lower than 200 (such as 150). To bypass the deny rule in NSG-NIC (priority 300), the allow rule must have a priority number lower than 300 (such as 250). Since both VMs are associated with ASGs in the same virtual network, using ASG-Web and ASG-DB as source and destination is fully supported.

Step-by-Step Solution

Analyze the subnet-level NSG configuration (`NSG-Subnet`).

The existing deny rule at priority 200 blocks traffic from

10.0.1.0/24

(which includes `VM-Web1`). To allow the database traffic, a rule allowing traffic from `ASG-Web` to `ASG-DB` on TCP port 1433 must be created with a priority number lower than 200 (such as 150) so that it is processed first.

Azure NSG rules are processed in priority order (lower numbers have higher precedence).

Analyze the NIC-level NSG configuration (`NSG-NIC`).

The existing deny rule at priority 300 blocks all VirtualNetwork traffic. To allow the database traffic to reach `VM-DB1`, an allow rule must be created in `NSG-NIC` with a priority number lower than 300 (such as 250) so that it is processed first.

Both subnet-level and NIC-level NSGs must allow the traffic for the connection to succeed.

Key Concept

Azure Network Security Groups evaluate rules sequentially based on priority (lower numbers are processed first). Inbound traffic must be permitted by both the subnet-level NSG and the network interface (NIC) level NSG to reach a virtual machine.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics