AZ-800 Network Security Group Rules 4 — Questions and Answers
Question 1: You have an NSG with a rule allowing TCP port 80 inbound from Any. A response to an outbound HTTP request made by the VM arrives. Is the response allowed?
- No, you need a matching outbound allow rule
- Yes, NSGs are stateful so return traffic is automatically allowed (Correct answer)
- Only if the source IP is in the allowed list
- Only if the same NSG is also on the subnet
Correct answer: Yes, NSGs are stateful so return traffic is automatically allowed
NSGs are stateful — return traffic for an established connection is automatically permitted without needing an explicit allow rule.
Question 2: Which NSG rule field controls the direction of traffic (inbound or outbound) the rule applies to?
- Access
- Direction (Correct answer)
- Priority
- Protocol
Correct answer: Direction
The Direction field specifies whether the rule applies to Inbound or Outbound traffic.
Question 3: An application gateway in a dedicated subnet requires an NSG. Which inbound rule is mandatory for the application gateway to function?
- Allow port 443 from Internet
- Allow ports 65200-65535 from GatewayManager (Correct answer)
- Allow port 80 from AzureLoadBalancer
- Allow all traffic from VirtualNetwork
Correct answer: Allow ports 65200-65535 from GatewayManager
Azure Application Gateway requires an inbound NSG rule allowing ports 65200-65535 from the GatewayManager service tag for its infrastructure communication.
Question 4: You need to allow traffic on both TCP and UDP port 53 for DNS. How many NSG rules are required?
- One rule using protocol 'Any' and port 53 (Correct answer)
- Two rules — one for TCP 53 and one for UDP 53
- Three rules — TCP, UDP, and ICMP for DNS
- One rule per protocol per direction, totaling four rules
Correct answer: One rule using protocol 'Any' and port 53
Setting the protocol to 'Any' in a single NSG rule with port 53 covers both TCP and UDP traffic on that port.
Question 5: What is the effective result when a subnet NSG allows port 3389 inbound but the NIC NSG denies port 3389 inbound?
- Traffic is allowed because the subnet NSG is evaluated first and permits it
- Traffic is denied because both NSGs must allow traffic for it to reach the VM (Correct answer)
- Traffic is allowed because NIC NSG takes precedence over subnet NSG
- Azure merges the rules and prompts for manual resolution
Correct answer: Traffic is denied because both NSGs must allow traffic for it to reach the VM
For inbound traffic to a VM, both the subnet NSG and NIC NSG must permit the traffic; if either denies it, the traffic is blocked.
Question 6: Which NSG feature allows you to view all effective rules applied to a NIC, combining both subnet and NIC NSG rules?
- NSG Diagnostics in Network Watcher
- Effective security rules view on the NIC (Correct answer)
- Azure Policy compliance view
- Azure Monitor NSG flow logs
Correct answer: Effective security rules view on the NIC
The 'Effective security rules' view on a NIC in the Azure portal displays the merged and prioritized rules from both the NIC NSG and subnet NSG.
Question 7: You need an NSG rule to allow traffic from multiple non-contiguous IP addresses (10.1.0.0/24 and 192.168.5.0/24) in a single rule. How do you configure this?
- Use a comma-separated list of CIDRs in the source field (Correct answer)
- Create an Application Security Group and assign both CIDRs
- Use a service tag that includes those ranges
- It is not possible; create two separate rules
Correct answer: Use a comma-separated list of CIDRs in the source field
NSG rules support comma-separated IP address prefixes in the source or destination field, allowing multiple CIDRs in a single rule.
AZ-800 Network Security Group Rules 4
You have an NSG with a rule allowing TCP port 80 inbound from Any.
A response to an outbound HTTP request made by the VM arrives.
Is the response allowed?