Examkin

Soru

Zorluk: OrtaConfigure Network Security Groups (NSGs) and Application Security Groups (ASGs)

An organization deploys a two-tier application within a single Azure Virtual Network named VNet-Prod. The virtual network contains two subnets: Subnet-Frontend and Subnet-Backend.

The following resources are configured:
* VM-App is deployed in Subnet-Frontend and its network interface is associated with an Application Security Group (ASG) named ASG-App.
* VM-Data is deployed in Subnet-Backend and its network interface is associated with an ASG named ASG-Data.
* NSG-Subnet-Front is associated with Subnet-Frontend and contains the following outbound security rule:
* Priority: 150, Source: ASG-App, Destination: ASG-Data, Port: 5432, Protocol: TCP, Action: Allow
* NSG-Nic-Data is associated with the network interface of VM-Data and contains the following inbound security rules:
* Rule A: Priority 110, Source: ASG-App, Destination: Any, Port: 5432, Protocol: TCP, Action: Deny
* Rule B: Priority 120, Source: Any, Destination: ASG-Data, Port: 5432, Protocol: TCP, Action: Allow

No other custom network security group (NSG) rules are configured. Subnet-Backend has no associated NSG, and VM-App has no network interface-level NSG.

VM-App attempts to establish a TCP connection to VM-Data on port 5432.

What is the outcome of this connection attempt?

  1. The connection is denied because the inbound Rule A in NSG-Nic-Data has a lower priority number, representing higher precedence, and matches the traffic from VM-App.Cevap
  2. B
    The connection is allowed because the inbound Rule B in NSG-Nic-Data has a higher priority number and specifically targets ASG-Data, overriding the more general Rule A.
  3. C
    The connection is allowed because the outbound rule in NSG-Subnet-Front has a higher priority value than Rule A in NSG-Nic-Data, which overrides the inbound block.
  4. D
    The connection is denied because the default outbound security rules in NSG-Subnet-Front block all cross-subnet traffic within the same virtual network by default.

Cevap

The connection is denied because the inbound Rule A in NSG-Nic-Data has a lower priority number, representing higher precedence, and matches the traffic from VM-App.
The connection attempt is denied at the destination network interface level. When traffic flows from VM-App to VM-Data, it first passes through the subnet-level NSG of the source subnet (NSG-Subnet-Front), where the custom outbound rule allows it. Upon reaching the destination subnet, there is no subnet-level NSG. However, at the destination network interface level, NSG-Nic-Data is evaluated. The rules in NSG-Nic-Data are processed in priority order, where a lower priority number represents higher precedence. Rule A has a priority of 110 and Rule B has a priority of 120. Since Rule A is processed first and matches the inbound traffic (source is VM-App within ASG-App, destination port is 5432), the traffic is denied and rule evaluation stops immediately.

Adım Adım Çözüm

1
Evaluate the outbound traffic from VM-App.
The traffic is allowed outbound.
There is no NIC-level NSG on VM-App. The subnet-level NSG (NSG-Subnet-Front) contains a custom outbound rule with priority 150 that explicitly allows TCP traffic from ASG-App to ASG-Data on port 5432.
2
Evaluate the inbound traffic arriving at VM-Data.
The traffic is evaluated by NSG-Nic-Data.
The destination subnet (Subnet-Backend) has no NSG, so the traffic passes to the network interface of VM-Data, which is associated with NSG-Nic-Data.
3
Determine which rule in NSG-Nic-Data applies to the inbound traffic.
Rule A (Priority 110) is matched and denies the traffic.
Rules are processed in order of priority (lowest number first). Rule A (Priority 110) is evaluated before Rule B (Priority 120). Since VM-App belongs to ASG-App, Rule A matches the incoming traffic and denies it, preventing Rule B from being evaluated.

Anahtar Kavram

Network Security Group (NSG) rule evaluation flow and rule priority processing.
Bu soruyu puanla

Konular

Configure Network Security Groups (NSGs) and Application Security Groups (ASGs)