To secure outbound communication, a security administrator associates a Network Security Group (NSG) named `NSG-Outbound` with a subnet. The NSG contains the following custom outbound security rules:
* `Deny-Internet-All`: Priority 180, Destination: `Internet`, Port: `Any`, Protocol: `Any`, Action: Deny
* `Allow-Web-Outbound`: Priority 240, Destination: `Internet`, Port: 443, Protocol: TCP, Action: Allow
A virtual machine residing in the subnet attempts to connect to an external web service over port 443.
What is the status of this outbound connection attempt?
- The connection is blocked since the NSG evaluates the rule with priority 180 first, which denies the traffic.Cevap
- BThe connection is allowed since the NSG processes rule 240 before rule 180.
- CThe connection is allowed since specific destination port rules override general deny rules.
- DThe connection is blocked since default Azure security rules prevent all custom outbound traffic.
Cevap
The connection is blocked since the NSG evaluates the rule with priority 180 first, which denies the traffic.
The connection is blocked since the NSG evaluates the rule with priority 180 first, which denies the traffic. Azure NSGs process rules in order of priority (lowest numbers first). Once a match is found, processing stops. Because 180 is lower than 240, the deny rule takes precedence.
Adım Adım Çözüm
Anahtar Kavram
Azure Network Security Group (NSG) rule evaluation order
Tahmini Süre:45s