Your Azure subscription contains a virtual network named `VNet1` with two subnets: `Subnet… — Microsoft Azure Administrator (AZ-104)

Your Azure subscription contains a virtual network named `VNet1` with two subnets: `Subnet-Web` and `Subnet-Data`. An NSG named `NSG-Data` is associated with `Subnet-Data`. `NSG-Data` contains the following custom inbound security rule:

* Priority: $150$
* Source: `*`
* Destination: `*`
* Destination Port Range: `*`
* Protocol: Any
* Action: Deny

You have a virtual machine named `VM-Web` in `Subnet-Web` associated with an Application Security Group (ASG) named `ASG-Web`.

You have a virtual machine named `VM-SQL` in `Subnet-Data` associated with an ASG named `ASG-SQL`.

You need to allow database traffic (TCP port $1433$ ) and management traffic (TCP port $443$ ) from `VM-Web` to `VM-SQL`. The solution must enforce the principle of least privilege.

Which two inbound security rules should you add to `NSG-Data`?

A rule with Priority $100$ , Source: `ASG-Web`, Destination: `ASG-SQL`, Destination Port Range: $1433$ , Protocol: TCP, Action: AllowCevap
A rule with Priority $110$ , Source: `ASG-Web`, Destination: `ASG-SQL`, Destination Port Range: $443$ , Protocol: TCP, Action: AllowCevap
C
A rule with Priority $200$ , Source: `ASG-Web`, Destination: `ASG-SQL`, Destination Port Range: $1433$ , Protocol: TCP, Action: Allow
D
A rule with Priority $210$ , Source: `ASG-Web`, Destination: `ASG-SQL`, Destination Port Range: $443$ , Protocol: TCP, Action: Allow

Cevap

Configure two inbound rules with priorities lower than

150

(such as

100

and

110

) using ASG-Web as the source, ASG-SQL as the destination, and TCP ports

1433

and

443

respectively with the Allow action.

To allow the requested traffic while maintaining security, the allow rules must be evaluated before the existing custom deny rule at priority

150

. Because NSG rules are evaluated in ascending order of their priority numbers, the new rules must have priority numbers lower than

150

(such as

100

and

110

). Furthermore, referencing ASG-Web as the source and ASG-SQL as the destination ensures that only the relevant virtual machines can communicate, which adheres to the principle of least privilege.

Adım Adım Çözüm

Analyze the existing NSG rules in the destination subnet.

The existing rule at priority

150

denies all inbound traffic.

Any new rule designed to permit traffic must be assigned a lower priority value than

150

to be evaluated first, since NSG rules are processed in ascending order of their priority numbers.

Specify the source and destination endpoints using the principle of least privilege.

Set the source to ASG-Web and the destination to ASG-SQL.

Using Application Security Groups (ASGs) limits rule application to the specific virtual machines associated with them, rather than opening ports for the entire subnet.

Configure the rules for the required ports.

Create one rule for TCP port

1433

(priority

100

) and a second rule for TCP port

443

(priority

110

This allows the database and management traffic to reach the SQL VM while blocking all other traffic.

Anahtar Kavram

NSG rules are processed sequentially by priority number (lowest first). When a generic deny rule has a specific priority, allow rules must have lower priority numbers (higher precedence) to take effect. Using Application Security Groups (ASGs) simplifies rule configuration by defining security policies based on application workloads instead of IP addresses.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular