AZ-800 Network Security Group Rules 2

Question 1

An NSG rule has priority 200 with action Allow and another has priority 300 with action Deny for the same traffic. What happens?

Accepted Answer

The Allow rule wins because lower priority numbers are processed first

Answer

NSG rules are processed in ascending priority order (100 is before 200), so the rule with the lowest number wins when traffic matches.

Question 2

Which default NSG inbound rule allows all traffic within the same virtual network?

Accepted Answer

AllowVnetInBound

Answer

The AllowVnetInBound default rule (priority 65000) permits all inbound traffic from the VirtualNetwork service tag.

Question 3

You associate an NSG to both a subnet and a NIC on a VM within that subnet. Traffic inbound to the VM is evaluated how?

Accepted Answer

Subnet NSG first, then NIC NSG

Answer

For inbound traffic, Azure evaluates the subnet NSG first, and if traffic passes, it then evaluates the NIC NSG.

Question 4

What is the maximum number of NSG rules (inbound + outbound combined) per NSG?

Accepted Answer

1000

Answer

Each NSG supports up to 1,000 custom security rules (inbound and outbound combined).

Question 5

An NSG rule specifies destination port range '8080-8090'. A packet arrives on port 8085. What happens?

Accepted Answer

The rule matches and the specified action is applied

Answer

NSG port ranges are inclusive, so port 8085 falls within 8080-8090 and the rule matches.

AZ-800 - Microsoft Azure Networking Solutions Practice Test