An administrator is configuring network security in an Azure subscription. A virtual netwo… — Microsoft Azure Administrator (AZ-104)

An administrator is configuring network security in an Azure subscription. A virtual network named `VNet1` contains two subnets: `Subnet1` ( $10.200.1.0/24$ ) and `Subnet2` ( $10.200.2.0/24$ ).

* `VM1` (IP address $10.200.1.10$ ) is deployed in `Subnet1`. Its network interface is associated with an Application Security Group named `ASG-App` and a Network Security Group named `NSG-VM1`.
* `VM2` (IP address $10.200.2.20$ ) is deployed in `Subnet2`. Its network interface is associated with an Application Security Group named `ASG-DB` and a Network Security Group named `NSG-VM2`.
* `Subnet1` is associated with a Network Security Group named `NSG-Subnet1`.
* `Subnet2` is associated with a Network Security Group named `NSG-Subnet2`.

The NSG rules are configured as shown in the following tables:

### NSG-VM1 (Outbound Rules)

Priority	Source	Destination	Port	Protocol	Action
$250$	`ASG-App`	`ASG-DB`	$1433$	TCP	Allow

### NSG-Subnet1 (Outbound Rules)

Priority	Source	Destination	Port	Protocol	Action
$200$	`*`	`ASG-DB`	$1433$	TCP	Allow
$300$	`*`	$10.200.2.0/24$	$1433$	TCP	Deny

### NSG-Subnet2 (Inbound Rules)

Priority	Source	Destination	Port	Protocol	Action
$150$	$10.200.1.0/24$	`*`	$1433$	TCP	Deny
$250$	`ASG-App`	`ASG-DB`	$1433$	TCP	Allow

### NSG-VM2 (Inbound Rules)

Priority	Source	Destination	Port	Protocol	Action
$100$	`ASG-App`	`ASG-DB`	$1433$	TCP	Allow

An administrator attempts to establish a TCP connection from `VM1` to `VM2` on port $1433$ .

What is the outcome of this connection attempt?

A
The connection is blocked by `NSG-Subnet1` because the outbound subnet-level NSG is evaluated before the NIC-level NSG, and the Deny rule with priority $300$ takes precedence over the Allow rule in `NSG-VM1`.
B
The connection is successful because the Allow rule in `NSG-VM2` with priority $100$ is evaluated first and overrides the Deny rule in `NSG-Subnet2`.
The connection is blocked by `NSG-Subnet2` because the inbound subnet-level NSG is evaluated before the NIC-level NSG, and the Deny rule with priority $150$ takes precedence over the Allow rule with priority $250$ .Cevap
D
The connection is successful because the outbound Allow rule in `NSG-Subnet1` (priority $200$ ) and the inbound Allow rule in `NSG-VM2` (priority $100$ ) override all Deny rules.

Cevap

The connection is blocked by the subnet-level NSG associated with the destination subnet (`NSG-Subnet2`) because inbound traffic is processed at the subnet layer first, where a matching Deny rule (priority

150

) has higher precedence than the matching Allow rule (priority

250

For inbound traffic, Azure evaluates the subnet-level NSG (`NSG-Subnet2`) before the NIC-level NSG (`NSG-VM2`). Within `NSG-Subnet2`, the inbound rules are processed by priority. The rule with priority

150

(Deny) matches the source IP prefix of `VM1` (

10.200.1.10

) and is evaluated before the rule with priority

250

(Allow). Consequently, the traffic is blocked at the subnet layer and never reaches `VM2`.

Adım Adım Çözüm

Evaluate the outbound connection from `VM1` at the network interface (NIC) level.

The traffic is allowed by the NIC-level NSG (`NSG-VM1`) because the outbound rule with priority

250

explicitly matches the source group `ASG-App` and the destination group `ASG-DB` on port

1433

For outbound traffic, Azure evaluates the NIC-level NSG before evaluating the subnet-level NSG.

Evaluate the outbound connection from `VM1` at the subnet level.

The traffic is allowed by the subnet-level NSG (`NSG-Subnet1`) because the outbound rule with priority

200

matches first and allows port

1433

traffic to `ASG-DB`. The lower-priority rule (priority

300

, Deny) is not processed.

Rules are evaluated in order of priority (lower numbers first). Once a match is found, further rules are not processed.

Evaluate the inbound connection to `VM2` at the subnet level.

The traffic is blocked by the subnet-level NSG (`NSG-Subnet2`). The rule with priority

150

matches the source IP range

10.200.1.0/24

on port

1433

and denies the traffic. The rule with priority

250

(Allow) is not evaluated.

For inbound traffic, Azure evaluates the subnet-level NSG first. Since the priority

150

Deny rule has a lower priority number (higher precedence) than the priority

250

Allow rule, the traffic is dropped.

Anahtar Kavram

Understanding the sequential evaluation order of Network Security Groups (NIC-level vs. Subnet-level) and the significance of rule priority numbers (where lower numbers have higher precedence) for both inbound and outbound traffic flows.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular