An administrator is configuring security rules for a virtual network named `VNet1` in an A… — Microsoft Azure Administrator (AZ-104)

An administrator is configuring security rules for a virtual network named `VNet1` in an Azure subscription. `VNet1` contains two subnets: `Subnet-Web` ( $10.0.1.0/24$ ) and `Subnet-App` ( $10.0.2.0/24$ ).

The following virtual machines are deployed:
- `VM-Web1` in `Subnet-Web`
- `VM-App1` and `VM-App2` in `Subnet-App`

An Application Security Group (ASG) named `ASG-App` is created, and the network interface of `VM-App1` (`nic-app1`) is associated with `ASG-App`.

A Network Security Group (NSG) named `NSG-SubnetApp` is associated with `Subnet-App` and contains the following inbound rules:

Priority	Source	Source Port	Destination	Destination Port	Protocol	Action
150	`VirtualNetwork`	`*`	`ASG-App`	443	TCP	Allow
200	`*`	`*`	`*`	`*`	`*`	Deny

Another NSG named `NSG-NICApp2` is associated with the network interface of `VM-App2` (`nic-app2`) and contains the following inbound rule:

Priority	Source	Source Port	Destination	Destination Port	Protocol	Action
110	`10.0.1.0/24`	`*`	`*`	443	TCP	Deny

Currently, HTTPS traffic from `VM-Web1` can reach `VM-App1` on port 443, but cannot reach `VM-App2` on port 443.

Which two actions should you perform to allow HTTPS traffic on port 443 from `VM-Web1` to `VM-App2`?

Associate `nic-app2` with `ASG-App`.Cevap
In `NSG-NICApp2`, add an inbound security rule with a priority of 100 that allows TCP traffic on port 443 from `10.0.1.0/24` to any destination.Cevap
C
In `NSG-NICApp2`, add an inbound security rule with a priority of 120 that allows TCP traffic on port 443 from `10.0.1.0/24` to any destination.
D
In `NSG-SubnetApp`, change the priority of the rule with priority 150 to 250.
E
Associate `nic-app1` with `NSG-NICApp2`.

Cevap

Associate the network interface of the target virtual machine with the Application Security Group, and add an inbound security rule to the network interface's security group with a priority of 100 that allows TCP traffic on port 443 from the source subnet to any destination.

To allow HTTPS traffic to the target virtual machine, traffic must pass both the subnet-level NSG and the network interface (NIC)-level NSG. First, the subnet NSG has an inbound rule that allows HTTPS traffic from the virtual network to the Application Security Group (ASG). Associating the target virtual machine's network interface with this ASG allows the traffic to pass the subnet NSG instead of being blocked by the lower-priority catch-all deny rule. Second, the NIC-level NSG has a rule that explicitly denies port 443 traffic from the source subnet. To permit the traffic, a new inbound rule must be created on this NIC-level NSG with a priority value lower than 110 (such as 100) to override the existing deny rule, as rules with lower priority numbers have higher precedence in Azure NSGs.

Adım Adım Çözüm

Evaluate the subnet-level security rules to identify why traffic is blocked at the subnet boundary.

The subnet-level NSG has a rule at priority 150 allowing port 443 traffic specifically to the Application Security Group (ASG), followed by a deny-all rule at priority 200. Since the target network interface is not associated with the ASG, its traffic is blocked by the priority 200 rule.

Understanding which subnet-level rule is blocking or allowing the traffic is the first step in resolving the connectivity issue.

Associate the target network interface with the Application Security Group.

Traffic destined for the target virtual machine now matches the priority 150 allow rule in the subnet-level NSG and passes the subnet boundary.

This allows the traffic to bypass the subnet-level deny-all rule.

Evaluate the network interface (NIC)-level security rules for the target virtual machine.

The NIC-level NSG contains a rule at priority 110 that explicitly denies port 443 traffic from the source subnet.

Even though traffic passes the subnet-level NSG, it is still blocked at the NIC boundary.

Add a higher-precedence allow rule to the NIC-level NSG.

Creating an allow rule for port 443 traffic with a priority of 100 overrides the deny rule at priority 110.

In Azure NSGs, rules with lower priority numbers have higher precedence. A priority 100 rule is evaluated before priority 110, allowing the connection to succeed.

Anahtar Kavram

Azure NSG rule evaluation logic requires that traffic must be allowed at both the subnet level and the network interface (NIC) level. Within an NSG, rules are processed in priority order (lowest number first) until a match is found.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular