AZ-800 Network Security Group Rules 4

Question 1

You have an NSG with a rule allowing TCP port 80 inbound from Any. A response to an outbound HTTP request made by the VM arrives. Is the response allowed?

Accepted Answer

Yes, NSGs are stateful so return traffic is automatically allowed

Answer

NSGs are stateful — return traffic for an established connection is automatically permitted without needing an explicit allow rule.

Question 2

Which NSG rule field controls the direction of traffic (inbound or outbound) the rule applies to?

Accepted Answer

Direction

Answer

The Direction field specifies whether the rule applies to Inbound or Outbound traffic.

Question 3

An application gateway in a dedicated subnet requires an NSG. Which inbound rule is mandatory for the application gateway to function?

Accepted Answer

Allow ports 65200-65535 from GatewayManager

Answer

Azure Application Gateway requires an inbound NSG rule allowing ports 65200-65535 from the GatewayManager service tag for its infrastructure communication.

Question 4

You need to allow traffic on both TCP and UDP port 53 for DNS. How many NSG rules are required?

Accepted Answer

One rule using protocol 'Any' and port 53

Answer

Setting the protocol to 'Any' in a single NSG rule with port 53 covers both TCP and UDP traffic on that port.

Question 5

What is the effective result when a subnet NSG allows port 3389 inbound but the NIC NSG denies port 3389 inbound?

Accepted Answer

Traffic is denied because both NSGs must allow traffic for it to reach the VM

Answer

For inbound traffic to a VM, both the subnet NSG and NIC NSG must permit the traffic; if either denies it, the traffic is blocked.

AZ-800 - Microsoft Azure Networking Solutions Practice Test

AZ-800 - Microsoft Azure Networking Solutions Practice Test

AZ-800 Network Security Group Rules 4