An administrator is configuring network security for a database application in Microsoft A… — Microsoft Azure Administrator (AZ-104)

An administrator is configuring network security for a database application in Microsoft Azure. The environment contains the following resources:

* A virtual network named `VNet-Production` with a subnet named `Subnet-Data` ( $10.50.2.0/24$ ).
* A virtual machine named `VM-Database` with a network interface named `nic-db-01` connected to `Subnet-Data` and associated with an Application Security Group named `ASG-Database`.
* A virtual machine named `VM-WebFrontend` associated with an Application Security Group named `ASG-WebFrontend`.

A Network Security Group named `NSG-Subnet` is associated with `Subnet-Data` and contains the following inbound rules:

Priority	Name	Source	Destination	Port	Protocol	Action
100	Allow-Web-to-DB-Subnet	ASG-WebFrontend	ASG-Database	1433	TCP	Allow
1000	Deny-All-Inbound-Subnet	Any	Any	*	*	Deny

A Network Security Group named `NSG-NIC` is associated with `nic-db-01` and contains the following inbound rules:

Priority	Name	Source	Destination	Port	Protocol	Action
150	Deny-Web-to-DB-NIC	ASG-WebFrontend	ASG-Database	1433	TCP	Deny
200	Allow-Web-to-DB-NIC	ASG-WebFrontend	ASG-Database	1433	TCP	Allow

You need to ensure that `VM-WebFrontend` can establish a database connection to `VM-Database` on TCP port 1433. The solution must minimize security risks and administrative effort.

Which of the following actions should you perform?

Change the priority of the Allow-Web-to-DB-NIC rule in NSG-NIC to 120.Cevap
B
Change the priority of the Allow-Web-to-DB-Subnet rule in NSG-Subnet to 250.
C
Change the priority of the Deny-Web-to-DB-NIC rule in NSG-NIC to 100.
D
Remove the association between NSG-Subnet and the Subnet-Data subnet.

Cevap

Change the priority of the Allow-Web-to-DB-NIC rule in NSG-NIC to 120.

The correct action is to change the priority of the Allow-Web-to-DB-NIC rule in NSG-NIC to 120. In Azure, Network Security Group (NSG) rules are processed in priority order: lower numbers have higher precedence. Currently, the Deny rule has a priority of 150 and the Allow rule has a priority of 200. Since 150 is lower than 200, the Deny rule is evaluated first and blocks the traffic. Changing the Allow rule's priority to 120 makes it take precedence over the Deny rule (120 < 150), allowing the traffic to pass the NIC-level NSG.

Adım Adım Çözüm

Analyze how inbound NSG rules are evaluated when both subnet and network interface (NIC) associations exist.

Inbound traffic is first evaluated by the subnet-level NSG (NSG-Subnet) and then by the NIC-level NSG (NSG-NIC). Both NSGs must allow the traffic for the connection to succeed.

This determines which NSG is currently blocking the connection.

Evaluate the rules in NSG-Subnet.

The Allow-Web-to-DB-Subnet rule (Priority 100) matches traffic from ASG-WebFrontend to ASG-Database on port 1433 TCP and permits it. The traffic successfully passes the subnet layer.

To verify if the subnet layer is blocking the traffic.

Evaluate the rules in NSG-NIC.

NSG-NIC has two rules for the same traffic: Deny-Web-to-DB-NIC (Priority 150) and Allow-Web-to-DB-NIC (Priority 200). Since 150 is lower than 200, the Deny rule has higher precedence and is processed first, blocking the traffic.

To identify why the traffic is blocked at the NIC layer.

Select the correct action to allow the traffic.

Changing the priority of the Allow rule in NSG-NIC to 120 places it before the Deny rule (Priority 150) in processing order. Thus, the traffic is allowed at the NIC layer.

This resolves the conflict by making the Allow rule take precedence over the Deny rule.

Anahtar Kavram

Inbound Network Security Group (NSG) rule processing order and priority evaluation across subnet and network interface levels.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular