AZ-800 - Microsoft Azure Networking Solutions Network Security Group Rules Questions and Answers — Questions and Answers
Question 1: A virtual machine's network interface has an NSG with an inbound rule at priority 200 to allow TCP port 3389. The subnet containing the VM has an NSG with an inbound rule at priority 300 to deny TCP port 3389. What is the effective result for inbound RDP traffic to the virtual machine?
- Traffic is allowed because the NIC-level rule is processed after the subnet-level rule.
- Traffic is denied because the subnet-level NSG rule is processed first for inbound traffic. (Correct answer)
- Traffic is allowed because the rule with the lower priority number (200) takes precedence over the higher number (300).
- Traffic is denied because deny rules always take precedence over allow rules, regardless of priority or location.
Correct answer: Traffic is denied because the subnet-level NSG rule is processed first for inbound traffic.
For inbound traffic, Azure processes the rules in the NSG associated with the subnet first. If a matching rule is found (in this case, deny at priority 300), processing stops, and that action is taken. The NSG on the network interface is never evaluated for that traffic.
Question 2: An administrator creates a new virtual network and a new Network Security Group (NSG) with no custom rules. The NSG is then associated with a subnet. By default, which statement accurately describes the connectivity between two VMs placed in that subnet?
- All traffic between the VMs is denied by the 'DenyAllInBound' default rule.
- All traffic between the VMs is allowed by the 'AllowVnetInBound' default rule. (Correct answer)
- Only outbound traffic from the VMs to the internet is allowed by default.
- Communication is denied because no explicit 'allow' rules have been created.
Correct answer: All traffic between the VMs is allowed by the 'AllowVnetInBound' default rule.
Every NSG includes a set of default rules. The 'AllowVnetInBound' rule, with priority 65000, explicitly permits any traffic originating from within the same virtual network. This allows VMs within the same VNet (and in this case, the same subnet) to communicate freely by default.
Question 3: You are managing a three-tier application with multiple VMs in the web tier. You need to create a single NSG rule that allows inbound traffic on port 443 from the internet to all web-tier VMs, even as you add or remove VMs from that tier. Which feature should you use as the destination in your NSG rule?
- A Service Tag
- An Application Security Group (ASG) (Correct answer)
- A list of the private IP addresses of the web-tier VMs
- A custom Route Table
Correct answer: An Application Security Group (ASG)
Application Security Groups (ASGs) allow you to group virtual machines and define network security policies based on those groups. By assigning the web-tier VMs' network interfaces to an ASG, you can then use that ASG as the destination in an NSG rule, simplifying management as the group of VMs changes.
Question 4: An administrator needs to create an NSG rule that allows a virtual machine to make outbound connections to Azure Storage services in the same region. To ensure the rule is maintainable and automatically updated if Microsoft changes the service IP addresses, which of the following should be used as the destination?
- The public IP address range for the specific Azure region.
- The 'Internet' service tag.
- The 'Storage' service tag. (Correct answer)
- The FQDN of the storage account.
Correct answer: The 'Storage' service tag.
A Service Tag represents a group of IP address prefixes for a given Azure service. Using the 'Storage' service tag as the destination ensures that the rule allows traffic to all Azure Storage public endpoints, and Microsoft automatically manages the underlying IP addresses associated with the tag.
Question 5: A network administrator is creating a custom inbound security rule with a priority of 250 to deny traffic from a known malicious IP address range. Which rule will be processed first by the Network Security Group?
- A custom rule with priority 4000
- The default 'DenyAllInbound' rule with priority 65500
- The new custom rule with priority 250 (Correct answer)
- A custom rule with priority 300
Correct answer: The new custom rule with priority 250
NSG rules are processed in priority order, with lower numbers having higher priority. A rule with priority 250 will be evaluated before rules with higher numbers like 300, 4000, and the default rules (which start at 65000).
Question 6: When defining a Network Security Group rule, which of the following is NOT a valid configurable property for the source or destination?
- IP Addresses
- Service Tag
- Application Security Group
- Virtual Network Name (Correct answer)
Correct answer: Virtual Network Name
The source or destination of an NSG rule can be specified using 'Any', 'IP Addresses' (or CIDR blocks), a 'Service Tag', or an 'Application Security Group'. A 'Virtual Network Name' is not a valid object to use directly as a source or destination; you would typically use the 'VirtualNetwork' service tag to represent the VNet's address space.
AZ-800 - Microsoft Azure Networking Solutions Network Security Group Rules Questions and Answers
A virtual machine's network interface has an NSG with an inbound rule at priority 200 to allow TCP port 3389.
The subnet containing the VM has an NSG with an inbound rule at priority 300 to deny TCP port 3389.
What is the effective result for inbound RDP traffic to the virtual machine?