Examkin

Soru

Zorluk: Çok zorConfigure Network Security Groups (NSGs) and Application Security Groups (ASGs)

You have two peered Azure virtual networks named VNet1 (address space: 10.1.0.0/1610.1.0.0/16) and VNet2 (address space: 10.2.0.0/1610.2.0.0/16) in the same region. VNet1 contains a subnet named Subnet1 (10.1.1.0/2410.1.1.0/24) and a virtual machine named VM1. The network interface of VM1 is associated with an Application Security Group (ASG) named ASG-Web. An NSG named NSG-Subnet1 is associated with Subnet1. VNet2 contains a subnet named Subnet2 (10.2.1.0/2410.2.1.0/24) and a virtual machine named VM2. The network interface of VM2 is associated with an NSG named NSG-NIC2. You need to allow inbound HTTPS traffic (TCP port 443443) to VM2 from VM1. You configure the following security rules:

* In NSG-Subnet1, you add an outbound rule with a priority of 150150 that allows TCP port 443443 outbound from ASG-Web to the private IP address of VM2.
* In NSG-NIC2, you add an inbound rule with a priority of 120120 that allows TCP port 443443 inbound from ASG-Web to the private IP address of VM2.

When you attempt to save the configuration for NSG-NIC2, the deployment fails. What is the cause of this configuration failure?

  1. A
    The outbound rule in NSG-Subnet1 must be configured with a higher priority (lower priority number) than the inbound rule in NSG-NIC2 to allow traffic to cross virtual network boundaries.
  2. B
    Virtual network peering does not support routing of network traffic that is filtered using Application Security Groups.
  3. Application Security Groups can only be referenced in Network Security Group rules where both the Network Security Group and the Application Security Group reside in the same virtual network.Cevap
  4. D
    The Network Security Group NSG-NIC2 must be associated with Subnet2 rather than the network interface of VM2 before referencing Application Security Groups.

Cevap

Application Security Groups can only be referenced in Network Security Group rules where both the Network Security Group and the Application Security Group reside in the same virtual network.
The rule configuration fails because Application Security Groups (ASGs) can only be referenced in Network Security Group (NSG) rules if the NSG and the ASG reside within the same virtual network. Since ASG-Web is in VNet1 and NSG-NIC2 is in VNet2, referencing ASG-Web in NSG-NIC2 is an invalid configuration and fails Azure Resource Manager validation.

Adım Adım Çözüm

1
Identify the virtual network membership of the resources.
VM1 and ASG-Web reside in VNet1. VM2 and NSG-NIC2 reside in VNet2.
This establishes the logical boundaries for network security rule references.
2
Evaluate the configuration of the security rules in both virtual networks.
The outbound rule in NSG-Subnet1 (VNet1) references ASG-Web (VNet1), which is valid. The inbound rule in NSG-NIC2 (VNet2) attempts to reference ASG-Web (VNet1), which spans across the virtual network boundary.
This isolates the specific rule that is causing the validation failure.
3
Apply Azure Application Security Group constraints.
Determine that an Application Security Group can only be referenced by a Network Security Group that is in the same virtual network. Because NSG-NIC2 is in VNet2 and ASG-Web is in VNet1, the deployment fails.
This identifies the root cause of the deployment failure.

Anahtar Kavram

Application Security Group boundaries and Network Security Group cross-VNet constraints.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Configure Network Security Groups (NSGs) and Application Security Groups (ASGs)