You have an Azure virtual network named `VNet1` that contains two subnets: `Subnet-A` (10.… — Microsoft Azure Administrator (AZ-104)

You have an Azure virtual network named `VNet1` that contains two subnets: `Subnet-A` ( $10.0.1.0/24$ ) and `Subnet-B` ( $10.0.2.0/24$ ).

You deploy three virtual machines with network interfaces (NICs):
* `VM1` is in `Subnet-A` with IP address $10.0.1.4$
* `VM2` is in `Subnet-B` with IP address $10.0.2.4$
* `VM3` is in `Subnet-B` with IP address $10.0.2.5$

You configure two Application Security Groups (ASGs):
* `ASG-App`: Contains the NIC of `VM1` and the NIC of `VM2`
* `ASG-Data`: Contains the NIC of `VM3`

You associate Network Security Groups (NSGs) as follows:
* `NSG-SubnetB` is associated with `Subnet-B`
* `NSG-NIC-VM3` is associated with the NIC of `VM3`

`NSG-SubnetB` contains the following inbound security rules:
* Priority: $120$ , Source: `ASG-App`, Destination: `ASG-Data`, Destination Port: $1433$ , Protocol: TCP, Action: Allow
* Priority: $180$ , Source: $10.0.1.0/24$ , Destination: Any, Destination Port: Any, Protocol: Any, Action: Deny

`NSG-NIC-VM3` contains the following inbound security rules:
* Priority: $110$ , Source: $10.0.1.4$ , Destination: Any, Destination Port: $1433$ , Protocol: TCP, Action: Deny
* Priority: $200$ , Source: VirtualNetwork, Destination: Any, Destination Port: $1433$ , Protocol: TCP, Action: Allow

All other NSGs use default configurations.

What is the outcome when `VM1` and `VM2` attempt to establish a TCP connection to `VM3` on port $1433$ ?

A
Both connections are allowed.
B
Both connections are denied.
The connection from VM1 is denied, and the connection from VM2 is allowed.Cevap
D
The connection from VM1 is allowed, and the connection from VM2 is denied.

Cevap

The connection from VM1 is denied, and the connection from VM2 is allowed.

For the connection from VM1 to VM3: Inbound traffic is first evaluated by the subnet NSG (NSG-SubnetB). Rule 120 (Allow) has higher precedence than Rule 180 (Deny), so the subnet NSG allows the traffic. Next, the NIC NSG (NSG-NIC-VM3) is evaluated. Rule 110 (Deny) has higher precedence than Rule 200 (Allow), so the NIC NSG blocks the traffic. Since the traffic must pass both NSGs, the connection from VM1 is denied. For the connection from VM2 to VM3: The subnet NSG allows the traffic via Rule 120 (VM2 is in ASG-App and VM3 is in ASG-Data), and Rule 180 does not apply as VM2 is not in Subnet-A. The NIC NSG allows the traffic via Rule 200 (Allow VirtualNetwork), as the specific Deny rule (Rule 110) only applies to VM1. Therefore, the connection from VM2 is allowed.

Adım Adım Çözüm

Evaluate the inbound traffic from VM1 (10.0.1.4) to VM3 (10.0.2.5) on port 1433 through the subnet-level NSG (NSG-SubnetB).

The traffic matches the ASG-App to ASG-Data rule (priority 120, Allow) and the Subnet-A IP rule (priority 180, Deny). Since 120 is lower than 180, priority 120 takes precedence and the subnet NSG allows the traffic.

Lower priority numbers in Azure NSG rules represent higher precedence.

Evaluate the inbound traffic from VM1 to VM3 through the NIC-level NSG (NSG-NIC-VM3).

The traffic matches the host-specific rule (priority 110, Deny) and the VirtualNetwork rule (priority 200, Allow). Since 110 is lower than 200, priority 110 takes precedence and the NIC-level NSG denies the traffic. Therefore, the connection from VM1 is blocked.

For inbound traffic to be allowed, both the subnet-level NSG and the NIC-level NSG must permit the traffic.

Evaluate the inbound traffic from VM2 (10.0.2.4) to VM3 (10.0.2.5) on port 1433 through the subnet-level NSG (NSG-SubnetB).

The traffic matches the ASG-App to ASG-Data rule (priority 120, Allow). It does not match the Subnet-A IP rule (priority 180) because VM2 is in Subnet-B. Thus, the subnet NSG allows the traffic.

ASGs can span multiple subnets within the same virtual network, allowing VM2 to be evaluated under the ASG-App source group.

Evaluate the inbound traffic from VM2 to VM3 through the NIC-level NSG (NSG-NIC-VM3).

The traffic matches the VirtualNetwork rule (priority 200, Allow). It does not match the Deny rule (priority 110) because that rule is scoped specifically to VM1's IP address (10.0.1.4). Thus, the NIC NSG allows the traffic. Therefore, the connection from VM2 is allowed.

No other custom rule blocks VM2 at the NIC level, and the priority 200 rule allows VirtualNetwork traffic.

Anahtar Kavram

Azure NSG rule evaluation flow and ASG cross-subnet routing

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular