AZ-800 Network Security Group Rules 3 — Questions and Answers
Question 1: What does the wildcard '*' represent when used in an NSG rule's port field?
- Only well-known ports 0-1023
- All ports from 0 to 65535 (Correct answer)
- Only dynamic/ephemeral ports
- Any port above 1024
Correct answer: All ports from 0 to 65535
An asterisk (*) in the port field of an NSG rule matches all ports from 0 to 65535.
Question 2: An NSG is associated with a subnet but no NIC. A VM in the subnet sends outbound traffic. How is it evaluated?
- Only the subnet NSG outbound rules are evaluated (Correct answer)
- No evaluation occurs since there is no NIC NSG
- Azure applies global default deny on all outbound
- The traffic bypasses the NSG entirely
Correct answer: Only the subnet NSG outbound rules are evaluated
When an NSG is only on the subnet, outbound traffic from VMs in that subnet is evaluated against the subnet NSG's outbound rules.
Question 3: Which priority range is reserved for Azure default NSG rules and cannot be used for custom rules?
- 65000-65500
- 65001-65499
- 65000-65535 (Correct answer)
- 64000-65535
Correct answer: 65000-65535
Azure default NSG rules use priorities 65000, 65001, and 65500, and the range 65000-65535 is reserved for these system defaults.
Question 4: You want to allow SSH access to a VM only from a corporate IP range 203.0.113.0/24. Which NSG rule configuration achieves this?
- Source: Any, Destination: VM IP, Port: 22, Action: Allow
- Source: 203.0.113.0/24, Destination: Any, Port: 22, Action: Allow
- Source: 203.0.113.0/24, Destination: VirtualNetwork, Port: 22, Action: Allow
- Source: 203.0.113.0/24, Destination: VM private IP, Port: 22, Action: Allow (Correct answer)
Correct answer: Source: 203.0.113.0/24, Destination: VM private IP, Port: 22, Action: Allow
Specifying the source CIDR and the VM's private IP as destination with port 22 restricts SSH access to only the corporate range targeting that specific VM.
Question 5: What happens to existing connections when you add a new NSG Deny rule that would block active traffic?
- Existing connections are immediately terminated (Correct answer)
- Existing connections continue until they time out naturally
- Azure sends a RST packet to gracefully close the connections
- The rule only applies to new connections established after the rule is created
Correct answer: Existing connections are immediately terminated
NSG rules are stateful for allowed sessions, but adding a new Deny rule causes Azure to immediately terminate existing matching connections.
Question 6: Which tool in the Azure portal can show you which NSG rule is being applied to traffic between two VMs?
- Network Watcher IP flow verify (Correct answer)
- Azure Monitor Network Insights
- Network Performance Monitor
- Connection Troubleshoot
Correct answer: Network Watcher IP flow verify
IP flow verify in Azure Network Watcher tests whether traffic is allowed or denied and identifies the specific NSG rule responsible for the decision.
Question 7: A subnet NSG blocks port 443 outbound. The VMs need to reach Azure Storage. What is the recommended solution that avoids opening broad internet access?
- Add a rule allowing port 443 to the Internet service tag
- Deploy a VPN gateway to route storage traffic
- Create a Service Endpoint for Azure Storage and allow the Storage service tag (Correct answer)
- Remove the NSG from the subnet
Correct answer: Create a Service Endpoint for Azure Storage and allow the Storage service tag
Service endpoints with the Storage service tag allow NSG rules to permit traffic to Azure Storage specifically, without granting broad internet access.
AZ-800 Network Security Group Rules 3
What does the wildcard '*' represent when used in an NSG rule's port field?