An administrator is configuring security rules for an Azure virtual network named `VNet1`.… — Microsoft Azure Administrator (AZ-104)

An administrator is configuring security rules for an Azure virtual network named `VNet1`. `VNet1` contains two subnets: `Subnet-Front` ( $10.10.1.0/24$ ) and `Subnet-Back` ( $10.10.2.0/24$ ).

The virtual machines are configured as follows:
* `VM-Web` is in `Subnet-Front` and is associated with the Application Security Group (ASG) `ASG-Web`.
* `VM-Admin` is in `Subnet-Front` and is associated with the ASG `ASG-Admin`.
* `VM-App` is in `Subnet-Back` and is associated with the ASG `ASG-App`.

The Network Security Group (NSG) associations are:
* `NSG-Front` is associated with `Subnet-Front`. It contains only default rules.
* `NSG-Back` is associated with `Subnet-Back`.
* `NSG-NIC-App` is associated with the network interface (NIC) of `VM-App`.

The custom inbound security rules for `NSG-Back` are configured as follows:

Priority	Source	Destination	Port	Protocol	Action
100	ASG-Admin	ASG-App	443	TCP	Allow
200	ASG-Web	ASG-App	443	TCP	Deny

The custom inbound security rules for `NSG-NIC-App` are configured as follows:

Priority	Source	Destination	Port	Protocol	Action
150	Any	ASG-App	443	TCP	Allow
250	ASG-Web	ASG-App	443	TCP	Deny

You need to allow HTTPS (TCP port 443) traffic from `VM-Web` to `VM-App`, while explicitly blocking HTTPS traffic from `VM-Admin` to `VM-App`.

Which two changes should you perform? (Choose two.)

In NSG-Back, change the action of the rule with priority 200 to Allow.Cevap
In NSG-Back, change the action of the rule with priority 100 to Deny.Cevap
C
In NSG-NIC-App, change the priority of the rule with priority 250 to 100.
D
In NSG-NIC-App, change the action of the rule with priority 250 to Allow.

Cevap

To allow VM-Web to VM-App traffic and block VM-Admin to VM-App traffic, you should change the action of the rule with priority 200 to Allow in NSG-Back, and change the action of the rule with priority 100 to Deny in NSG-Back.

To establish the required flow, VM-Web traffic must pass both NSGs. Changing the action of the rule with priority 200 in NSG-Back to Allow enables VM-Web traffic to pass the subnet-level NSG. At the NIC level (NSG-NIC-App), VM-Web traffic is allowed by the priority 150 rule (Allow for Any) because it has higher precedence than the priority 250 rule (Deny for ASG-Web). To block VM-Admin traffic, changing the action of the rule with priority 100 in NSG-Back to Deny blocks the traffic at the subnet level.

Adım Adım Çözüm

Analyze the current flow of VM-Web to VM-App traffic.

VM-Web traffic is blocked at the Subnet-Back inbound level by the rule in NSG-Back with priority 200 (Action: Deny).

Before reaching the VM, inbound traffic is first evaluated by the subnet-level NSG, where it matches the specific rule denying ASG-Web.

Determine the change needed to allow VM-Web to VM-App traffic.

Changing the action of the rule with priority 200 in NSG-Back to Allow permits VM-Web traffic to pass the subnet NSG.

At the NIC level (NSG-NIC-App), VM-Web traffic matches the rule with priority 150 (Allow for Any) because 150 has higher precedence than 250, so no changes are needed at the NIC level for VM-Web.

Analyze the current flow of VM-Admin to VM-App traffic and determine how to block it.

Changing the action of the rule with priority 100 in NSG-Back to Deny blocks VM-Admin traffic.

VM-Admin traffic currently passes NSG-Back (priority 100 Allow) and NSG-NIC-App (priority 150 Allow). Changing the priority 100 rule to Deny blocks the traffic at the subnet-level NSG.

Anahtar Kavram

NSG rules are processed in priority order (lower numbers first). When NSGs are applied at both the subnet and network interface (NIC) levels, inbound traffic is evaluated by the subnet NSG first, then the NIC NSG. Both must permit the traffic for it to be allowed.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular