AZ-800 Network Security Group Rules 2 — Questions and Answers
Question 1: An NSG rule has priority 200 with action Allow and another has priority 300 with action Deny for the same traffic. What happens?
- The Deny rule wins because security takes precedence
- The Allow rule wins because lower priority numbers are processed first (Correct answer)
- Both rules are applied and traffic is blocked
- Azure returns an error for conflicting rules
Correct answer: The Allow rule wins because lower priority numbers are processed first
NSG rules are processed in ascending priority order (100 is before 200), so the rule with the lowest number wins when traffic matches.
Question 2: Which default NSG inbound rule allows all traffic within the same virtual network?
- AllowInternetInBound
- AllowAzureLoadBalancerInBound
- AllowVnetInBound (Correct answer)
- DenyAllInBound
Correct answer: AllowVnetInBound
The AllowVnetInBound default rule (priority 65000) permits all inbound traffic from the VirtualNetwork service tag.
Question 3: You associate an NSG to both a subnet and a NIC on a VM within that subnet. Traffic inbound to the VM is evaluated how?
- NIC NSG first, then subnet NSG
- Subnet NSG first, then NIC NSG (Correct answer)
- Only the NIC NSG is evaluated
- Rules are merged and evaluated as one policy
Correct answer: Subnet NSG first, then NIC NSG
For inbound traffic, Azure evaluates the subnet NSG first, and if traffic passes, it then evaluates the NIC NSG.
Question 4: What is the maximum number of NSG rules (inbound + outbound combined) per NSG?
- 250
- 500
- 1000 (Correct answer)
- 4096
Correct answer: 1000
Each NSG supports up to 1,000 custom security rules (inbound and outbound combined).
Question 5: An NSG rule specifies destination port range '8080-8090'. A packet arrives on port 8085. What happens?
- The rule does not match because ranges require exact ports
- The rule matches and the specified action is applied (Correct answer)
- Azure splits the range into individual rules automatically
- The rule is ignored and the next rule is evaluated
Correct answer: The rule matches and the specified action is applied
NSG port ranges are inclusive, so port 8085 falls within 8080-8090 and the rule matches.
Question 6: Which service tag should you use in an NSG rule to allow traffic from Azure Monitor's diagnostic endpoints?
- AzureCloud
- AzureMonitor (Correct answer)
- AzureTrafficManager
- AzurePlatformLKM
Correct answer: AzureMonitor
The AzureMonitor service tag represents the IP address ranges used by Azure Monitor, including Log Analytics and Application Insights.
Question 7: You need to deny all outbound internet traffic from a subnet except for Windows Update traffic. What is the best approach?
- Delete the AllowInternetOutBound default rule
- Create a Deny rule for the Internet service tag at priority 100, then allow required Microsoft Update URLs at priority 50 (Correct answer)
- Associate an Azure Firewall to filter traffic before the NSG
- Set the NSG outbound default action to Deny
Correct answer: Create a Deny rule for the Internet service tag at priority 100, then allow required Microsoft Update URLs at priority 50
Creating a lower-priority Allow rule for the WindowsUpdate service tag before a higher-priority Deny Internet rule ensures update traffic passes while blocking other internet access.
AZ-800 Network Security Group Rules 2
An NSG rule has priority 200 with action Allow and another has priority 300 with action Deny for the same traffic.
What happens?