An administrator is configuring network security for an Azure virtual network named `VNet1… — Microsoft Azure Administrator (AZ-104)

An administrator is configuring network security for an Azure virtual network named `VNet1`. `VNet1` contains a subnet named `Subnet1`.

The subnet contains two virtual machines: `VM-Web` and `VM-DB`.
- `VM-Web` is associated with an Application Security Group (ASG) named `ASG-Web`.
- `VM-DB` is associated with an ASG named `ASG-DB`.

A Network Security Group (NSG) named `NSG-Subnet` is associated with `Subnet1`.
An NSG named `NSG-NIC-DB` is associated with the network interface of `VM-DB`.

The inbound rules for `NSG-Subnet` are configured as shown in the following table:

Priority	Source	Port	Destination	Port	Protocol	Action
$100$	Internet	Any	`ASG-Web`	$443$	TCP	Allow
$200$	Any	Any	Any	Any	Any	Deny

The inbound rules for `NSG-NIC-DB` are configured as shown in the following table:

Priority	Source	Port	Destination	Port	Protocol	Action
$150$	Any	Any	`ASG-DB`	$1433$	TCP	Deny
$250$	`ASG-Web`	Any	`ASG-DB`	$1433$	TCP	Allow

Currently, SQL database traffic from `VM-Web` to `VM-DB` is blocked.

Which two configuration changes should you perform to allow SQL traffic from `VM-Web` to `VM-DB`? (Select two.)

In `NSG-Subnet`, add an inbound rule with priority $150$ that allows TCP port $1433$ from source `ASG-Web` to destination `ASG-DB`.Cevap
In `NSG-NIC-DB`, change the priority of the rule that allows TCP port $1433$ to $120$ .Cevap
C
In `NSG-NIC-DB`, change the priority of the rule that allows TCP port $1433$ to $300$ .
D
In `NSG-Subnet`, change the priority of the rule with priority $200$ to $50$ .

Cevap

To allow SQL traffic, you must add an inbound rule in `NSG-Subnet` with priority

150

that allows TCP port

1433

from source `ASG-Web` to destination `ASG-DB`, and in `NSG-NIC-DB`, change the priority of the rule that allows TCP port

1433

120

To allow SQL traffic from the web server to the database server, two configuration adjustments are required because inbound traffic is evaluated by both the subnet-level Network Security Group (NSG) and the network interface-level (NIC) NSG. At the subnet level, the custom Deny rule at priority

200

blocks all traffic. To bypass this, an Allow rule for port

1433

with a higher priority (such as

150

) must be added. At the NIC level, the Allow rule for port

1433

has a priority of

250

, which has lower precedence than the Deny rule at priority

150

. Changing the Allow rule's priority to a lower number (such as

120

) ensures it is evaluated first, allowing the SQL traffic.

Adım Adım Çözüm

Analyze the subnet-level NSG (`NSG-Subnet`) inbound traffic evaluation.

The subnet-level NSG has a custom rule at priority

200

that denies all inbound traffic. Since this has a lower number than the default `AllowVnetInbound` rule (priority

65000

), the SQL traffic from `VM-Web` to `VM-DB` is blocked at the subnet level.

Azure NSGs evaluate rules in order of priority (lowest number first). A custom deny-all rule with priority

200

overrides the default VNet-internal allow rules.

Determine the required rule addition for `NSG-Subnet`.

Add an inbound rule to `NSG-Subnet` with priority

150

that allows TCP port

1433

from `ASG-Web` to `ASG-DB`.

Creating an allow rule with a priority number lower than

200

ensures that SQL traffic matches this rule and is allowed before reaching the Deny All rule.

Analyze the NIC-level NSG (`NSG-NIC-DB`) inbound traffic evaluation.

At the NIC level, the deny rule on port

1433

(priority

150

) is evaluated before the allow rule (priority

250

). This causes the SQL traffic to be blocked at the network interface.

The rule with priority

150

takes precedence over the rule with priority

250

because it has a lower priority number.

Determine the required modification for `NSG-NIC-DB`.

Change the priority of the allow rule to a value lower than

150

(such as

120

This reorders the evaluation so the SQL traffic matches the Allow rule first.

Anahtar Kavram

Azure NSG rules are evaluated sequentially by priority number, where lower numbers have higher precedence. Inbound traffic to a VM must be allowed by both the subnet-level NSG and the NIC-level NSG.

Tahmini Süre:1m 30s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular