Your Azure environment has a subnet containing two virtual machines: \text{VM1} and \text{… — Microsoft Azure Administrator (AZ-104)

Your Azure environment has a subnet containing two virtual machines: $\text{VM1}$ and $\text{VM2}$ . $\text{VM1}$ is associated with an Application Security Group (ASG) named $\text{ASG-Web}$ . $\text{VM2}$ is associated with an ASG named $\text{ASG-Database}$ .

The subnet is associated with a Network Security Group (NSG) that has the following inbound security rules:
* Rule 1: Priority $100$ , Source: $\text{ASG-Web}$ , Destination: $\text{ASG-Database}$ , Port: $1433$ , Protocol: TCP, Action: Deny
* Rule 2: Priority $120$ , Source: Any, Destination: $\text{ASG-Database}$ , Port: $1433$ , Protocol: TCP, Action: Allow

A user attempts to establish a SQL database connection over TCP port $1433$ from $\text{VM1}$ to $\text{VM2}$ . Which outcome will occur?

The connection is denied because Rule 1 has a lower priority number, giving it higher precedence than Rule 2.Cevap
B
The connection is allowed because Rule 2 has a higher priority number, giving it higher precedence than Rule 1.
C
The connection is allowed because Rule 2 has 'Any' as the source, which overrides the specific ASG source in Rule 1.
D
The connection is allowed because inbound traffic between virtual machines in the same subnet is always permitted by default rules.

Cevap

The connection is denied because Rule 1 has a lower priority number (100), which gives it higher precedence than Rule 2 (120).

The connection is blocked because when multiple security rules match a specific traffic flow, Azure processes them in order of priority (from the lowest numerical value to the highest). Since the rule stating that traffic from the web group to the database group is denied has a priority of 100, which is lower than the allow rule's priority of 120, it is evaluated first, and its Deny action is applied.

Adım Adım Çözüm

Identify the matching NSG rules for the traffic flow from VM1 to VM2 on TCP port 1433.

Both Rule 1 (source ASG-Web, destination ASG-Database) and Rule 2 (source Any, destination ASG-Database) match the traffic flow.

VM1 belongs to ASG-Web, VM2 belongs to ASG-Database, and the destination port is 1433 over TCP.

Compare the priority numbers of the matching rules to determine which one is evaluated first.

Rule 1 has priority 100, and Rule 2 has priority 120. Rule 1 is evaluated first because 100 is less than 120.

Azure NSG rules are processed in sequential order from lowest priority number to highest priority number.

Apply the action of the rule with the highest precedence (lowest priority number) and stop further evaluation.

The Deny action from Rule 1 is applied, and the connection is blocked.

Once a matching rule is found and applied, no further rules are evaluated for that network flow.

Anahtar Kavram

Azure NSG rule evaluation logic processes rules sequentially based on their priority numbers, where a lower number indicates higher precedence.

Tahmini Süre:45s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular