An organization deploys an Azure virtual network named `VNet1`. `VNet1` contains two subne… — Microsoft Azure Administrator (AZ-104)

An organization deploys an Azure virtual network named `VNet1`. `VNet1` contains two subnets: `Subnet-Web` (address prefix $10.0.1.0/24$ ) and `Subnet-Data` (address prefix $10.0.2.0/24$ ).

`Subnet-Web` hosts the following virtual machines:
* `VM-Web1` and `VM-Web2`, which are associated with an Application Security Group (ASG) named `ASG-Web`.
* `VM-Management`, which is associated with an ASG named `ASG-Admin`.

`Subnet-Data` hosts a virtual machine named `VM-SQL1`, which is associated with an ASG named `ASG-SQL`.

A Network Security Group (NSG) named `NSG-Data` is associated with `Subnet-Data`. There are no other custom security rules in `NSG-Data`.

You need to configure `NSG-Data` to allow incoming database traffic on TCP port $1433$ from `VM-Web1` and `VM-Web2` to `VM-SQL1`. All other traffic from `Subnet-Web` to `VM-SQL1` on TCP port $1433$ must be blocked.

Which two inbound security rules should you configure in `NSG-Data` to meet the requirements while maintaining the principle of least privilege? (Select two.)

An inbound rule with Priority: $120$ , Source: `ASG-Web`, Destination: `ASG-SQL`, Port: $1433$ , Action: AllowCevap
B
An inbound rule with Priority: $220$ , Source: `ASG-Web`, Destination: `ASG-SQL`, Port: $1433$ , Action: Allow
An inbound rule with Priority: $180$ , Source: $10.0.1.0/24$ , Destination: `ASG-SQL`, Port: $1433$ , Action: DenyCevap
D
An inbound rule with Priority: $110$ , Source: $10.0.1.0/24$ , Destination: `ASG-SQL`, Port: $1433$ , Action: Deny

Cevap

To meet the requirements, you must configure two inbound security rules: one rule with priority

120

that allows TCP port

1433

traffic from source `ASG-Web` to destination `ASG-SQL`, and another rule with priority

180

that denies TCP port

1433

traffic from source

10.0.1.0/24

to destination `ASG-SQL`.

To permit database traffic only from the web servers while blocking all other hosts in the same source subnet, you must establish an allow rule with higher precedence (lower priority number) than the fallback deny rule. The rule with priority

120

explicitly allows traffic from the source Application Security Group `ASG-Web` to the destination `ASG-SQL`. The rule with priority

180

denies traffic from the source subnet prefix

10.0.1.0/24

to the destination `ASG-SQL`. Since the allow rule has priority

120

and the deny rule has priority

180

, traffic from the web servers matches the allow rule first and is permitted. Traffic from other virtual machines in the subnet (such as the management server) does not match the allow rule and falls through to be blocked by the deny rule.

Adım Adım Çözüm

Determine rule processing order rules for Network Security Groups.

Rules are processed sequentially in ascending order of their priority numbers. The first rule that matches the traffic properties is applied, and no subsequent rules are evaluated.

This determines how the allow and deny rules will interact with each other.

Select the correct allow rule targeting the web virtual machines.

Identify that the allow rule must target `ASG-Web` as the source and `ASG-SQL` as the destination with priority

120

This allows database traffic specifically from the virtual machines in the web Application Security Group.

Select the correct deny rule targeting the remaining subnet hosts.

Identify that the deny rule must target the subnet prefix

10.0.1.0/24

as the source and `ASG-SQL` as the destination with priority

180

This denies traffic from all other hosts in the web subnet. Because the deny rule has a higher priority number (

180

) than the allow rule (

120

), legitimate traffic matching the allow rule is processed first and permitted, while all other traffic matches the deny rule and is blocked.

Anahtar Kavram

Azure Network Security Group inbound rule processing precedence, where lower priority numbers take precedence over higher priority numbers, combined with the use of Application Security Groups to group virtual machines for security policies.

Tahmini Süre:1m 30s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular