An administrator manages an Azure subscription with a virtual network named `VNet1`. `VNet… — Microsoft Azure Administrator (AZ-104)

An administrator manages an Azure subscription with a virtual network named `VNet1`. `VNet1` contains two subnets:
- `Subnet-Web` ( $10.0.1.0/24$ ), associated with a Network Security Group (NSG) named `NSG-Web`.
- `Subnet-App` ( $10.0.2.0/24$ ), associated with an NSG named `NSG-App`.

The following virtual machines are deployed:
- `VM-Web1` ( $10.0.1.4$ ) and `VM-Web2` ( $10.0.1.5$ ) in `Subnet-Web`. The network interfaces (NICs) of both VMs are associated with an Application Security Group (ASG) named `ASG-Web`.
- `VM-App1` ( $10.0.2.4$ ) in `Subnet-App`. Its NIC is associated with an ASG named `ASG-App`.
- `VM-App2` ( $10.0.2.5$ ) in `Subnet-App`. Its NIC is associated with a dedicated NSG named `NSG-App2-NIC`.

Currently, the NSGs have the following custom rules:
- `NSG-Web` has no custom rules.
- `NSG-App` has a custom inbound rule named `Deny-Web` with priority $150$ that denies all protocols and ports from the `10.0.1.0/24` source to `Any` destination.
- `NSG-App2-NIC` has a custom inbound rule named `Deny-All-Inbound` with priority $120$ that denies all protocols and ports from `Any` source to `Any` destination.

You need to configure the network security to satisfy the following requirements:
1. Allow HTTPS traffic (TCP port $443$ ) from `VM-Web1` and `VM-Web2` to `VM-App1`.
2. Allow SSH traffic (TCP port $22$ ) from `VM-Web1` to `VM-App2`.
3. Block all other traffic from `Subnet-Web` to `Subnet-App`.

Which three of the following rules should you configure? (Select three.)

In `NSG-App`, add an inbound rule with a priority of $110$ that allows TCP port $22$ traffic from source `10.0.1.4` to destination `10.0.2.5`.Cevap
In `NSG-App2-NIC`, add an inbound rule with a priority of $100$ that allows TCP port $22$ traffic from source `10.0.1.4` to destination `10.0.2.5`.Cevap
In `NSG-App`, add an inbound rule with a priority of $130$ that allows TCP port $443$ traffic from source `ASG-Web` to destination `ASG-App`.Cevap
D
In `NSG-App`, add an inbound rule with a priority of $160$ that allows TCP port $443$ traffic from source `ASG-Web` to destination `ASG-App`.
E
In `NSG-App2-NIC`, add an inbound rule with a priority of $130$ that allows TCP port $22$ traffic from source `10.0.1.4` to destination `10.0.2.5`.
F
In `NSG-App2-NIC`, add an inbound rule with a priority of $100$ that allows TCP port $22$ traffic from source `ASG-Web` to destination `10.0.2.5`.

Cevap

The correct configuration requires adding an inbound rule in NSG-App with a priority of 110 to allow TCP port 22 from 10.0.1.4 to 10.0.2.5, an inbound rule in NSG-App2-NIC with a priority of 100 to allow TCP port 22 from 10.0.1.4 to 10.0.2.5, and an inbound rule in NSG-App with a priority of 130 to allow TCP port 443 from ASG-Web to ASG-App.

To satisfy the requirements, the rules must allow the specified traffic before they hit the deny rules at each evaluation layer. HTTPS traffic must be allowed inbound at the subnet level (NSG-App) with a priority of 130 (which is lower/higher precedence than the deny rule at 150) using ASG-Web and ASG-App. SSH traffic from VM-Web1 must be allowed at both the subnet level (NSG-App with priority 110) and the NIC level (NSG-App2-NIC with priority 100) to bypass the respective deny rules at 150 and 120. These rules must target VM-Web1's specific IP address (10.0.1.4) to avoid permitting VM-Web2 to establish SSH connections.

Adım Adım Çözüm

Evaluate the inbound flow requirements for HTTPS traffic targeting VM-App1.

Outbound traffic from Subnet-Web is allowed by default since NSG-Web has no custom rules. Inbound traffic must pass the subnet-level NSG (NSG-App). Because the Deny-Web rule (priority 150) blocks traffic from 10.0.1.0/24, we must add an inbound rule with a priority lower than 150 (such as 130) allowing TCP 443 from ASG-Web to ASG-App.

This bypasses the Deny-Web rule for the specific web server group and allows them to communicate with VM-App1.

Evaluate the subnet-level inbound requirements for SSH traffic targeting VM-App2.

Traffic must pass NSG-App. Since the Deny-Web rule (priority 150) blocks all traffic from Subnet-Web, we must add an inbound rule with a priority lower than 150 (such as 110) that allows TCP port 22 from VM-Web1's specific IP (10.0.1.4) to VM-App2's IP (10.0.2.5).

This allows VM-Web1's SSH traffic through the subnet boundary, while keeping VM-Web2 blocked by the default Deny-Web rule.

Evaluate the NIC-level inbound requirements for SSH traffic targeting VM-App2.

The traffic must clear the NIC-level NSG (NSG-App2-NIC). The existing Deny-All-Inbound rule (priority 120) blocks all inbound traffic. We must add an inbound rule with a priority lower than 120 (such as 100) allowing TCP port 22 from 10.0.1.4 to 10.0.2.5.

This allows VM-Web1's SSH traffic to reach the VM's network interface, while all other traffic is blocked by the Deny-All-Inbound rule.

Anahtar Kavram

Azure Network Security Groups (NSGs) evaluate rules sequentially using priority numbers, where smaller numbers have higher precedence. Inbound traffic must pass both subnet-level and NIC-level NSGs if both are present. Application Security Groups (ASGs) allow grouping virtual machines to simplify rule definition but cannot bypass priority order or scope evaluation layers.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular