Examkin

Soru

Zorluk: OrtaConfigure Network Security Groups (NSGs) and Application Security Groups (ASGs)

An administrator manages an Azure subscription containing a virtual network named `VNet1` with a subnet named `Subnet1`.

`Subnet1` is associated with a Network Security Group (NSG) named `NSG-Subnet`. `NSG-Subnet` has the following inbound security rule:
- Priority: 150150
- Source: `ASG-Source`
- Destination: `ASG-Dest`
- Port: 84438443
- Protocol: TCP
- Action: Deny

`Subnet1` contains two virtual machines:
- `VM1` has a network interface associated with the Application Security Group (ASG) named `ASG-Source`.
- `VM2` has a network interface associated with the ASG named `ASG-Dest` and a Network Security Group (NSG) named `NSG-NIC`.

`NSG-NIC` has the following inbound security rule:
- Priority: 110110
- Source: *
- Destination: *
- Port: 84438443
- Protocol: TCP
- Action: Allow

All other custom NSG rules are deleted, and only default rules remain.

A user attempts to establish a TCP connection on port 84438443 from `VM1` to `VM2`.

What is the outcome of the connection attempt?

  1. A
    The connection is allowed because the network interface-level Network Security Group (NSG) is evaluated before the subnet-level Network Security Group (NSG) for inbound traffic.
  2. The connection is blocked because the subnet-level Network Security Group (NSG) is evaluated first and denies the traffic, and a network interface-level Allow rule cannot override a subnet-level Deny rule.Cevap
  3. C
    The connection is allowed because the rule in the network interface-level Network Security Group (NSG) has a higher priority (110110) than the rule in the subnet-level Network Security Group (NSG) (150150).
  4. D
    The connection is blocked because Application Security Groups (ASGs) cannot be applied to rules in a Network Security Group (NSG) that is associated with a subnet.

Cevap

The connection is blocked because the subnet-level Network Security Group (NSG) is evaluated first and denies the traffic, and a network interface-level Allow rule cannot override a subnet-level Deny rule.
For inbound network traffic to an Azure virtual machine, the subnet-level Network Security Group (NSG) is evaluated first. If a rule in the subnet-level NSG denies the traffic, the traffic is dropped immediately, and the network interface-level NSG is not evaluated to override this decision. Both NSGs must allow the traffic for the connection to succeed.

Adım Adım Çözüm

1
Identify the traffic direction and the NSGs involved in the path.
The traffic is inbound from `VM1` to `VM2` on TCP port 84438443. The traffic traverses both the subnet-level NSG (`NSG-Subnet`) and the network interface-level NSG (`NSG-NIC`).
Inbound VM traffic must pass through the subnet-level NSG first and then the network interface-level NSG.
2
Evaluate the rules in the subnet-level NSG (`NSG-Subnet`).
The rule with priority 150150 explicitly denies TCP traffic on port 84438443 from `ASG-Source` (`VM1`) to `ASG-Dest` (`VM2`). This rule matches the traffic, resulting in a Deny decision.
Subnet-level rules are evaluated first. If a match occurs that denies traffic, evaluation stops at this level, and the traffic is blocked.
3
Determine if the network interface-level NSG (`NSG-NIC`) can permit the blocked traffic.
No. The Allow rule with priority 110110 on `NSG-NIC` is not evaluated because the traffic has already been blocked at the subnet level. NSG rule priorities are local to each NSG and cannot override decisions made in other NSGs.
For traffic to be permitted, both the subnet-level NSG and the network interface-level NSG must allow the connection.

Anahtar Kavram

Inbound Network Security Group (NSG) evaluation flow and priority scopes
Bu soruyu puanla

Konular

Configure Network Security Groups (NSGs) and Application Security Groups (ASGs)