Examkin

Soru

Zorluk: OrtaConfigure Network Security Groups (NSGs) and Application Security Groups (ASGs)

An administrator configures virtual networking in an Azure subscription. The subscription contains a virtual network named VNet1 with two subnets named Subnet1 and Subnet2. Subnet1 is associated with a network security group (NSG) named NSG-Subnet1. Subnet2 is associated with an NSG named NSG-Subnet2.

A virtual machine named VM1 is deployed in Subnet1 and its network interface (NIC) is associated with an NSG named NSG-NIC1. VM1 is also associated with an Application Security Group (ASG) named ASG-AppServer.

A virtual machine named VM2 is deployed in Subnet2 and is associated with an ASG named ASG-Database.

NSG-NIC1 contains the following outbound security rules:
* Priority 150: Allow outbound TCP port 1433 from ASG-AppServer to ASG-Database.
* Priority 300: Deny outbound TCP port 1433 from Any to Any.

NSG-Subnet1 contains the following outbound security rules:
* Priority 120: Deny outbound TCP port 1433 from Any to Any.
* Priority 220: Allow outbound TCP port 1433 from ASG-AppServer to ASG-Database.

What is the outcome when VM1 attempts to initiate a connection to VM2 on TCP port 1433?

  1. The connection is blocked by the subnet-level NSG (NSG-Subnet1).Cevap
  2. B
    The connection is allowed because the NIC-level NSG outbound rule has a lower priority number than the subnet-level NSG deny rule.
  3. C
    The connection is blocked by the NIC-level NSG (NSG-NIC1).
  4. D
    The connection is allowed because the subnet-level NSG allows traffic targeting the ASG-Database group at priority 220.

Cevap

The connection is blocked by the subnet-level NSG (NSG-Subnet1).
For outbound traffic from VM1, Azure first evaluates the outbound rules of the NIC-level NSG (NSG-NIC1), where the rule with priority 150 matches and allows the connection. Next, Azure evaluates the outbound rules of the subnet-level NSG (NSG-Subnet1). In NSG-Subnet1, the deny rule with priority 120 has a lower priority number than the allow rule with priority 220. Because rules with lower priority numbers are processed first, the connection is blocked at the subnet-level NSG.

Adım Adım Çözüm

1
Evaluate outbound traffic at the NIC-level NSG (NSG-NIC1).
The traffic is allowed by the rule with priority 150 (Allow outbound TCP port 1433 from ASG-AppServer to ASG-Database) because it has a lower priority number (higher precedence) than the deny rule with priority 300.
For outbound traffic, Azure first evaluates network security group rules associated with the network interface (NIC).
2
Evaluate outbound traffic at the subnet-level NSG (NSG-Subnet1).
The traffic is blocked by the rule with priority 120 (Deny outbound TCP port 1433 from Any to Any) because it is processed before the allow rule with priority 220.
After passing the NIC-level NSG, outbound traffic must also pass through the subnet-level NSG rules. Within an NSG, rules are processed in priority order (lower numbers first).

Anahtar Kavram

Azure evaluates outbound traffic by first checking NIC-level NSGs and then subnet-level NSGs. Within each NSG, rules are evaluated sequentially in ascending order of their priority numbers, where smaller numbers have higher precedence.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Configure Network Security Groups (NSGs) and Application Security Groups (ASGs)