Examkin

Soru

Zorluk: OrtaConfigure Network Security Groups (NSGs) and Application Security Groups (ASGs)

An administrator manages an Azure subscription containing a virtual network named `VNet1`. `VNet1` contains two subnets: `Subnet-Web` (10.0.1.0/2410.0.1.0/24) and `Subnet-App` (10.0.2.0/2410.0.2.0/24).

A virtual machine named `VM-Web` is deployed in `Subnet-Web` and has a network interface named `NIC-Web`. A Network Security Group (NSG) named `NSG-Subnet` is associated with `Subnet-Web`. A second NSG named `NSG-NIC` is associated with `NIC-Web`.

`NSG-Subnet` contains the following inbound security rule:
* Priority: 110110, Source: 10.0.2.0/2410.0.2.0/24, Port: 8080, Protocol: TCP, Action: Allow

`NSG-NIC` contains the following inbound security rules:
* Priority: 120120, Source: Any, Port: 8080, Protocol: TCP, Action: Deny
* Priority: 130130, Source: 10.0.2.410.0.2.4, Port: 8080, Protocol: TCP, Action: Allow

A virtual machine named `VM-App` is deployed in `Subnet-App` with the IP address 10.0.2.410.0.2.4.

If `VM-App` attempts to establish an HTTP connection to `VM-Web` on TCP port 8080, what is the outcome of this connection attempt?

  1. A
    The connection is successful because the subnet-level rule in `NSG-Subnet` has a lower priority number (110110) than the deny rule in `NSG-NIC` (120120), causing it to override the NIC-level block.
  2. B
    The connection is successful because `NSG-Subnet` allows the traffic and the Allow rule with priority 130130 in `NSG-NIC` matches the source IP address.
  3. The connection is blocked by `NSG-NIC` because the Deny rule with priority 120120 takes precedence over the Allow rule with priority 130130.Cevap
  4. D
    The connection is blocked by `NSG-Subnet` because inbound traffic to a virtual machine is evaluated first at the network interface level before the subnet level.

Cevap

The connection is blocked by `NSG-NIC` because the Deny rule with priority 120120 takes precedence over the Allow rule with priority 130130.
For inbound traffic, Azure processes the subnet-level NSG first, followed by the NIC-level NSG. The traffic successfully passes the subnet NSG because of the rule at priority 110110. However, when the traffic reaches the NIC NSG, it is matched against the rule with priority 120120 (Deny) before the rule with priority 130130 (Allow) because lower priority numbers have higher precedence. As a result, the connection is blocked at the network interface level.

Adım Adım Çözüm

1
Determine the evaluation order for inbound traffic to the destination virtual machine.
Inbound traffic is evaluated first by the Network Security Group associated with the subnet (`NSG-Subnet`), and then by the Network Security Group associated with the network interface (`NSG-NIC`).
Azure processes security rules sequentially from the subnet boundary to the network interface boundary for inbound flows.
2
Evaluate the traffic against the rules in `NSG-Subnet`.
The rule with priority 110110 allows TCP traffic on port 8080 from the source range 10.0.2.0/2410.0.2.0/24. Since `VM-App` has the IP address 10.0.2.410.0.2.4, the traffic matches this rule and is allowed past the subnet layer.
The source IP falls within the CIDR block defined in the rule.
3
Evaluate the traffic against the rules in `NSG-NIC` by priority order.
The rule with priority 120120 (Deny, Source: Any, Port: 8080) is evaluated before the rule with priority 130130 (Allow, Source: 10.0.2.410.0.2.4, Port: 8080). The priority 120120 rule matches the traffic and applies the Deny action, blocking the connection.
Within a single NSG, rules are evaluated in order of ascending priority numbers (lower numbers represent higher precedence). Once a matching rule is found, subsequent rules are not processed.

Anahtar Kavram

Azure Network Security Group (NSG) inbound traffic evaluation order (subnet-level before NIC-level) and internal rule precedence based on priority numbers.
Bu soruyu puanla

Konular

Configure Network Security Groups (NSGs) and Application Security Groups (ASGs)