AZ-800 - Microsoft Azure Networking Solutions Network Security Group Rules Questions and Answers

Question 1

A virtual machine's network interface has an NSG with an inbound rule at priority 200 to allow TCP port 3389. The subnet containing the VM has an NSG with an inbound rule at priority 300 to deny TCP port 3389. What is the effective result for inbound RDP traffic to the virtual machine?

Accepted Answer

Traffic is denied because the subnet-level NSG rule is processed first for inbound traffic.

Answer

For inbound traffic, Azure processes the rules in the NSG associated with the subnet first. If a matching rule is found (in this case, deny at priority 300), processing stops, and that action is taken. The NSG on the network interface is never evaluated for that traffic.

Question 2

An administrator creates a new virtual network and a new Network Security Group (NSG) with no custom rules. The NSG is then associated with a subnet. By default, which statement accurately describes the connectivity between two VMs placed in that subnet?

Accepted Answer

All traffic between the VMs is allowed by the 'AllowVnetInBound' default rule.

Answer

Every NSG includes a set of default rules. The 'AllowVnetInBound' rule, with priority 65000, explicitly permits any traffic originating from within the same virtual network. This allows VMs within the same VNet (and in this case, the same subnet) to communicate freely by default.

Question 3

You are managing a three-tier application with multiple VMs in the web tier. You need to create a single NSG rule that allows inbound traffic on port 443 from the internet to all web-tier VMs, even as you add or remove VMs from that tier. Which feature should you use as the destination in your NSG rule?

Accepted Answer

An Application Security Group (ASG)

Answer

Application Security Groups (ASGs) allow you to group virtual machines and define network security policies based on those groups. By assigning the web-tier VMs' network interfaces to an ASG, you can then use that ASG as the destination in an NSG rule, simplifying management as the group of VMs changes.

Question 4

An administrator needs to create an NSG rule that allows a virtual machine to make outbound connections to Azure Storage services in the same region. To ensure the rule is maintainable and automatically updated if Microsoft changes the service IP addresses, which of the following should be used as the destination?

Accepted Answer

The 'Storage' service tag.

Answer

A Service Tag represents a group of IP address prefixes for a given Azure service. Using the 'Storage' service tag as the destination ensures that the rule allows traffic to all Azure Storage public endpoints, and Microsoft automatically manages the underlying IP addresses associated with the tag.

Question 5

A network administrator is creating a custom inbound security rule with a priority of 250 to deny traffic from a known malicious IP address range. Which rule will be processed first by the Network Security Group?

Accepted Answer

The new custom rule with priority 250

Answer

NSG rules are processed in priority order, with lower numbers having higher priority. A rule with priority 250 will be evaluated before rules with higher numbers like 300, 4000, and the default rules (which start at 65000).

AZ-800 - Microsoft Azure Networking Solutions Practice Test

AZ-800 - Microsoft Azure Networking Solutions Practice Test

AZ-800 - Microsoft Azure Networking Solutions Network Security Group Rules Questions and Answers