An administrator is configuring network security for an application in an Azure subscripti… — Microsoft Azure Administrator (AZ-104)

An administrator is configuring network security for an application in an Azure subscription. The environment contains the following resources:

* A virtual network named `VNet1` with two subnets: `Subnet-Web` ( $10.1.0.0/24$ ) and `Subnet-App` ( $10.2.0.0/24$ ).
* A virtual machine named `VM1` in `Subnet-Web` that is associated with an Application Security Group (ASG) named `ASG-Web`.
* A virtual machine named `VM2` in `Subnet-App` that is associated with an ASG named `ASG-App` and has the IP address $10.2.0.4$ .
* A Network Security Group (NSG) named `NSG-Subnet` associated with `Subnet-Web`.
* An NSG named `NSG-NIC` associated with the network interface of `VM1`.

`NSG-Subnet` contains the following outbound security rules:
* Priority 150: Deny outbound traffic from `Subnet-Web` to `Subnet-App` on any port, with any protocol.
* Priority 250: Allow outbound traffic from `ASG-Web` to `ASG-App` on TCP port 8080.

`NSG-NIC` contains the following outbound security rules:
* Priority 100: Allow outbound traffic from `ASG-Web` to `ASG-App` on TCP port 8080.

Currently, `VM1` cannot establish a connection to `VM2` on TCP port 8080.

Which of the following modifications resolves the connectivity issue while maintaining the principle of least privilege?

Change the priority of the Allow rule in `NSG-Subnet` to 120.Cevap
B
Change the priority of the Allow rule in `NSG-Subnet` to 300.
C
Change the priority of the Allow rule in `NSG-NIC` to 90.
D
Remove the Deny rule with priority 150 from `NSG-Subnet`.

Cevap

Change the priority of the Allow rule in `NSG-Subnet` to 120.

The correct answer is to change the priority of the Allow rule in the subnet-level NSG (`NSG-Subnet`) to 120. When `VM1` initiates outbound traffic, the NIC-level NSG (`NSG-NIC`) evaluates it first, matching rule 100 and allowing it. The traffic then reaches the subnet-level NSG (`NSG-Subnet`). Here, the traffic matches both the Deny rule (Priority 150) and the Allow rule (Priority 250). Since rules with lower priority numbers have higher precedence, the Deny rule is applied and the traffic is blocked. Setting the Allow rule's priority to 120 ensures that it is evaluated and applied before the Deny rule at priority 150, thereby allowing the port 8080 connection. Because the Deny rule remains at priority 150, all other outbound traffic from the web subnet to the app subnet on other ports is still blocked, preserving the principle of least privilege.

Adım Adım Çözüm

Analyze the outbound traffic flow and NSG evaluation order.

For outbound traffic originating from `VM1`, Azure first evaluates the network interface-level NSG (`NSG-NIC`) and then evaluates the subnet-level NSG (`NSG-Subnet`).

Understanding the sequential flow of NSG rules is required to locate which NSG contains the blocking rule.

Evaluate the rules in `NSG-NIC`.

The traffic matches the rule with Priority 100: Allow outbound traffic from `ASG-Web` to `ASG-App` on TCP port 8080. The traffic is allowed at the network interface level.

This confirms that the network interface-level NSG is not the source of the blocked connection.

Evaluate the rules in `NSG-Subnet`.

The traffic matches both Priority 150 (Deny all outbound from `Subnet-Web` to `Subnet-App`) and Priority 250 (Allow outbound from `ASG-Web` to `ASG-App` on TCP port 8080). Since 150 is a lower priority number than 250, the Deny rule takes precedence, blocking the traffic.

This identifies the subnet-level NSG as the location of the block and shows that the priority of the Allow rule must be lowered below 150 to override the Deny rule.

Select the option that allows port 8080 traffic while maintaining least privilege.

Changing the Allow rule's priority in `NSG-Subnet` to 120 (which is less than 150) allows TCP port 8080 traffic to pass first. Other traffic is still blocked by the Deny rule at priority 150.

This resolves the connectivity issue while preserving the security restrictions on other ports.

Anahtar Kavram

Azure NSG outbound traffic processing order and rule priority evaluation

Tahmini Süre:2m 0s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular