Examkin

Soru

Zorluk: KolayConfigure Network Security Groups (NSGs) and Application Security Groups (ASGs)

An administrator configures a Network Security Group (NSG) associated with a subnet. The subnet contains two virtual machines: `VM-Web` (associated with Application Security Group `ASG-Web`) and `VM-DB` (associated with `ASG-DB`).

The NSG has the following inbound security rules:

RulePrioritySourceDestinationPortProtocolAction
Rule 1100100ASG-WebASG-DB14331433TCPAllow
Rule 2200200AnyASG-DB14331433TCPDeny

Which two of the following statements correctly describe how traffic is processed by these rules?

  1. TCP traffic on port 14331433 from `VM-Web` to `VM-DB` is allowed.Cevap
  2. TCP traffic on port 14331433 from virtual machines not associated with `ASG-Web` to `VM-DB` is denied.Cevap
  3. C
    TCP traffic on port 14331433 from `VM-Web` to `VM-DB` is denied because Rule 2 has a higher priority number.
  4. D
    TCP traffic on port 14331433 from all virtual machines to `VM-DB` is denied because Rule 2 is evaluated first.

Cevap

TCP traffic on port 14331433 from `VM-Web` to `VM-DB` is allowed, and TCP traffic on port 14331433 from virtual machines not associated with `ASG-Web` to `VM-DB` is denied.
TCP traffic on port 14331433 from `VM-Web` to `VM-DB` is allowed because Rule 1 (priority 100100) is evaluated first and matches the source and destination ASGs. For virtual machines not in `ASG-Web`, Rule 1 does not match, meaning evaluation falls through to Rule 2 (priority 200200), which explicitly denies all inbound TCP traffic on port 14331433 to `ASG-DB`.

Adım Adım Çözüm

1
Determine the evaluation order of the NSG rules based on priority.
Rule 1 (priority 100100) is evaluated before Rule 2 (priority 200200).
Azure NSGs process rules sequentially starting from the lowest priority number.
2
Evaluate traffic originating from `VM-Web` to `VM-DB` on port 14331433.
The traffic matches Rule 1 because the source `VM-Web` is in `ASG-Web` and the destination `VM-DB` is in `ASG-DB`. The action is Allow.
Once a rule matches, no further rules are evaluated for that traffic.
3
Evaluate traffic originating from other virtual machines to `VM-DB` on port 14331433.
The traffic does not match Rule 1. It is then evaluated against Rule 2, which matches the source as Any and denies the traffic.
If a rule does not match, processing continues to the next priority rule.

Anahtar Kavram

Network Security Group rules are evaluated in order of priority (lowest number first). Once a rule matches, evaluation stops. Application Security Groups allow rules to be scoped to specific groups of VMs.
Bu soruyu puanla

Konular

Configure Network Security Groups (NSGs) and Application Security Groups (ASGs)