AZ-800 Network Security Group Rules 3

Question 1

What does the wildcard '*' represent when used in an NSG rule's port field?

Accepted Answer

All ports from 0 to 65535

Answer

An asterisk (*) in the port field of an NSG rule matches all ports from 0 to 65535.

Question 2

An NSG is associated with a subnet but no NIC. A VM in the subnet sends outbound traffic. How is it evaluated?

Accepted Answer

Only the subnet NSG outbound rules are evaluated

Answer

When an NSG is only on the subnet, outbound traffic from VMs in that subnet is evaluated against the subnet NSG's outbound rules.

Question 3

Which priority range is reserved for Azure default NSG rules and cannot be used for custom rules?

Accepted Answer

65000-65535

Answer

Azure default NSG rules use priorities 65000, 65001, and 65500, and the range 65000-65535 is reserved for these system defaults.

Question 4

You want to allow SSH access to a VM only from a corporate IP range 203.0.113.0/24. Which NSG rule configuration achieves this?

Accepted Answer

Source: 203.0.113.0/24, Destination: VM private IP, Port: 22, Action: Allow

Answer

Specifying the source CIDR and the VM's private IP as destination with port 22 restricts SSH access to only the corporate range targeting that specific VM.

Question 5

What happens to existing connections when you add a new NSG Deny rule that would block active traffic?

Accepted Answer

Existing connections are immediately terminated

Answer

NSG rules are stateful for allowed sessions, but adding a new Deny rule causes Azure to immediately terminate existing matching connections.

AZ-800 - Microsoft Azure Networking Solutions Practice Test

AZ-800 - Microsoft Azure Networking Solutions Practice Test

AZ-800 Network Security Group Rules 3