AZ-800 - Microsoft Azure Networking Solutions Network Security Group Rules Questions and Answers

Question 1

A virtual machine's network interface has an NSG with an inbound rule at priority 200 to allow TCP port 3389.
The subnet containing the VM has an NSG with an inbound rule at priority 300 to deny TCP port 3389.
What is the effective result for inbound RDP traffic to the virtual machine?

Accepted Answer

Traffic is denied because the subnet-level NSG rule is processed first for inbound traffic.

Answer

Traffic is allowed because the NIC-level rule is processed after the subnet-level rule.

Answer

Traffic is allowed because the rule with the lower priority number (200) takes precedence over the higher number (300).

Answer

Traffic is denied because deny rules always take precedence over allow rules, regardless of priority or location.

Question 2

An administrator creates a new virtual network and a new Network Security Group (NSG) with no custom rules. The NSG is then associated with a subnet. By default, which statement accurately describes the connectivity between two VMs placed in that subnet?

Accepted Answer

All traffic between the VMs is allowed by the 'AllowVnetInBound' default rule.

Answer

All traffic between the VMs is denied by the 'DenyAllInBound' default rule.

Answer

Only outbound traffic from the VMs to the internet is allowed by default.

Answer

Communication is denied because no explicit 'allow' rules have been created.

Question 3

You are managing a three-tier application with multiple VMs in the web tier. You need to create a single NSG rule that allows inbound traffic on port 443 from the internet to all web-tier VMs, even as you add or remove VMs from that tier. Which feature should you use as the destination in your NSG rule?

Accepted Answer

An Application Security Group (ASG)

Answer

A Service Tag

Answer

A list of the private IP addresses of the web-tier VMs

Answer

A custom Route Table

Question 4

An administrator needs to create an NSG rule that allows a virtual machine to make outbound connections to Azure Storage services in the same region. To ensure the rule is maintainable and automatically updated if Microsoft changes the service IP addresses, which of the following should be used as the destination?

Accepted Answer

The 'Storage' service tag.

Answer

The public IP address range for the specific Azure region.

Answer

The 'Internet' service tag.

Answer

The FQDN of the storage account.

Question 5

A network administrator is creating a custom inbound security rule with a priority of 250 to deny traffic from a known malicious IP address range. Which rule will be processed first by the Network Security Group?

Accepted Answer

The new custom rule with priority 250

Answer

A custom rule with priority 4000

Answer

The default 'DenyAllInbound' rule with priority 65500

Answer

A custom rule with priority 300

Question 6

When defining a Network Security Group rule, which of the following is NOT a valid configurable property for the source or destination?

Accepted Answer

Virtual Network Name

Answer

IP Addresses

Answer

Service Tag

Answer

Application Security Group