An administrator configures virtual networking in an Azure subscription. A virtual network… — Microsoft Azure Administrator (AZ-104)

An administrator configures virtual networking in an Azure subscription. A virtual network named `VNet-Corp` contains two subnets: `Subnet-Web` ( $10.10.1.0/24$ ) and `Subnet-DB` ( $10.10.2.0/24$ ). A virtual machine named `VM-Web1` is deployed in `Subnet-Web` and has its network interface associated with an Application Security Group (ASG) named `ASG-Web`. A virtual machine named `VM-DB1` is deployed in `Subnet-DB` and has its network interface associated with an ASG named `ASG-DB`.

The subnets and network interfaces are configured with the following Network Security Groups (NSGs):

* `NSG-SubnetDB` is associated with `Subnet-DB` and contains the following inbound rule:
* Priority: $120$ , Source: `ASG-Web`, Port: $1433$ , Destination: Any, Action: Allow
* `NSG-NicDB` is associated with the network interface of `VM-DB1` and contains the following inbound rules:
* Priority: $110$ , Source: `ASG-Web`, Port: $1433$ , Destination: Any, Action: Deny
* Priority: $130$ , Source: Any, Port: $1433$ , Destination: Any, Action: Allow

When `VM-Web1` attempts to establish a database connection to `VM-DB1` on TCP port $1433$ , what is the outcome of the traffic flow?

The connection is blocked by the network security group associated with the network interface (NIC) of VM-DB1.Cevap
B
The connection is allowed because the rule with priority 130 in the NIC-level network security group overrides the Deny rule.
C
The connection is blocked by the network security group associated with Subnet-DB.
D
The connection is allowed because the rule with priority 120 in the subnet-level network security group overrides the NIC-level network security group rules.

Cevap

The connection is blocked by the network security group associated with the network interface (NIC) of VM-DB1.

For inbound network traffic to a virtual machine, Azure evaluates Network Security Groups (NSGs) in a specific order: first, the NSG associated with the subnet is evaluated, and then the NSG associated with the network interface (NIC) is evaluated. The traffic must be allowed by both NSGs to reach the VM. Here, the subnet-level NSG (NSG-SubnetDB) has a rule with priority 120 that allows traffic on port 1433 from ASG-Web, so it passes this stage. However, at the NIC-level NSG (NSG-NicDB), the rule with priority 110 denies traffic on port 1433 from ASG-Web. Because priority 110 is lower than priority 130, the Deny rule takes precedence, and the traffic is blocked at the network interface of VM-DB1.

Adım Adım Çözüm

Evaluate the subnet-level network security group (NSG) for inbound traffic to the destination subnet.

The traffic originating from VM-Web1 (associated with ASG-Web) destined for VM-DB1 on TCP port 1433 matches the inbound rule in NSG-SubnetDB (Priority 120, Action: Allow). The traffic is allowed through the subnet boundary.

Inbound traffic must first pass through the subnet-level NSG associated with the destination subnet.

Evaluate the NIC-level network security group (NSG) for inbound traffic reaching the destination network interface.

The traffic matches two inbound rules in NSG-NicDB: Priority 110 (Action: Deny) and Priority 130 (Action: Allow). Since 110 is a lower number than 130, it has higher precedence. The traffic is denied.

After passing the subnet-level NSG, inbound traffic must pass through the NIC-level NSG associated with the destination network interface.

Combine the evaluations to determine the final traffic outcome.

The traffic is allowed by the subnet NSG but blocked by the NIC NSG, resulting in a blocked connection.

For inbound traffic to succeed, it must be allowed by both the subnet-level NSG and the NIC-level NSG.

Anahtar Kavram

Inbound traffic evaluation order and rule priority in Azure Network Security Groups (NSGs)

Tahmini Süre:1m 30s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular