AZ-800 Network Security Group Rules 5 — Questions and Answers
Question 1: What is an Application Security Group (ASG) and how does it relate to NSG rules?
- A group of NSGs applied to an application tier
- A logical grouping of VM NICs used as source/destination in NSG rules instead of IP addresses (Correct answer)
- An Azure Firewall policy scoped to one application
- A WAF policy linked to an Application Gateway
Correct answer: A logical grouping of VM NICs used as source/destination in NSG rules instead of IP addresses
ASGs group VM NICs logically, enabling NSG rules to reference the group name instead of IP addresses, simplifying management at scale.
Question 2: NSG flow logs are stored in which Azure service?
- Azure SQL Database
- Azure Cosmos DB
- Azure Storage Account (Correct answer)
- Azure Data Lake Gen2 only
Correct answer: Azure Storage Account
NSG flow logs are written to an Azure Storage Account in JSON format, from where they can be consumed by tools like Traffic Analytics.
Question 3: After VNet peering is established, which service tag automatically includes the peered VNet address space in NSG rules?
- AzureCloud
- Internet
- VirtualNetwork (Correct answer)
- Peered
Correct answer: VirtualNetwork
Once VNet peering is configured, the VirtualNetwork service tag expands to include the address spaces of all peered virtual networks.
Question 4: Which protocol option in an NSG rule covers TCP, UDP, ICMP, and all other IP protocols without creating separate rules?
- All
- Both
- Any (Correct answer)
- Wildcard
Correct answer: Any
Setting the protocol field to 'Any' in an NSG rule matches TCP, UDP, ICMP, and all other IP protocols.
Question 5: You associate an NSG to a subnet. A new VM is added to the subnet. How does the NSG apply to the new VM?
- You must manually associate the NSG to the new VM's NIC
- The NSG automatically applies to the new VM because it is subnet-scoped (Correct answer)
- The NSG applies only after the VM is rebooted
- A new NSG rule must be created for the new VM's IP
Correct answer: The NSG automatically applies to the new VM because it is subnet-scoped
A subnet-associated NSG automatically applies to all resources, including newly created VMs, within that subnet without any additional configuration.
Question 6: Traffic Analytics for NSG flow logs requires which additional Azure service to process and visualize the data?
- Azure Sentinel
- Log Analytics Workspace (Correct answer)
- Azure Data Factory
- Event Hub
Correct answer: Log Analytics Workspace
Traffic Analytics processes NSG flow log data by ingesting it into a Log Analytics Workspace for querying and visualization in Network Watcher.
Question 7: An NSG outbound rule denies port 1433. A VM attempts a SQL connection to an Azure SQL Managed Instance in the same VNet. What happens?
- The connection succeeds because Azure SQL is a PaaS service that bypasses NSGs
- The connection fails because the outbound NSG deny rule blocks the traffic (Correct answer)
- The connection succeeds because Managed Instance uses a private endpoint that ignores NSGs
- Azure SQL automatically adds an allow rule to the NSG
Correct answer: The connection fails because the outbound NSG deny rule blocks the traffic
An explicit outbound Deny rule on port 1433 in the NSG blocks the SQL connection regardless of whether the destination is a PaaS service in the same VNet.
AZ-800 Network Security Group Rules 5
What is an Application Security Group (ASG) and how does it relate to NSG rules?