N10-009 Question 32
Single answerNetwork security groupsA company hosts a three-tier application in a cloud environment. The web servers are in a public subnet, the application servers are in a private subnet, and the database servers are in a restricted subnet. After a recent change, customers can still reach the website over HTTPS, but the application servers can no longer connect to the database on TCP 1433. The cloud engineer confirms that the database service is running and the route tables are unchanged. Which change to a network security group would most likely restore connectivity while maintaining least privilege?
- A
Add an inbound rule to the database servers' network security group allowing TCP 1433 from the application servers' subnet or security group
- B
Add an inbound rule to the web servers' network security group allowing TCP 1433 from the Internet
- C
Add an outbound rule to the database servers' network security group allowing TCP 443 to the application servers
- D
Add an inbound rule to the application servers' network security group allowing TCP 1433 from the database servers
Show answer and explanation
Correct answer: A
Explanation
Network security groups, security groups, and similar cloud virtual firewall constructs are commonly used to control traffic between tiers in segmented environments. In a three-tier design, best practice is to allow only the specific required traffic between tiers: for example, HTTPS from users to the web tier, application-specific traffic from the web tier to the app tier, and database traffic from the app tier to the database tier. When the application servers cannot reach the database and routing and service status are confirmed, the next logical area to check is whether the database tier still permits inbound TCP 1433 from the application tier. Applying the rule narrowly to the application subnet or application security group aligns with least-privilege and microsegmentation best practices. This approach is consistent with common guidance from major cloud providers, which recommend using security groups or NSG rules to explicitly permit only required source, destination, port, and protocol combinations rather than broad access.
- A. Correct.
Correct. In this scenario, the application tier initiates the connection to the database tier on TCP 1433, which is the default port commonly associated with Microsoft SQL Server. If routes are intact and the database service is running, the most likely issue is that the database tier's network security group is no longer permitting inbound traffic from the application tier. Allowing only TCP 1433 from the application subnet or, even better where supported, from the application servers' security group, restores the required flow while preserving least privilege.
- B. Incorrect.
Incorrect. The web servers do not need direct database access from the Internet, and exposing TCP 1433 publicly would create a significant security risk. This option violates segmentation principles and least-privilege design. A common misconception is that opening a port broadly will solve internal communication issues, but doing so unnecessarily increases the attack surface.
- C. Incorrect.
Incorrect. The application servers are failing to initiate a database connection on TCP 1433, so permitting outbound TCP 443 from the database servers does not address the problem. This distractor targets the misconception that any added rule might help connectivity, even when it does not match the protocol, port, direction, or traffic flow involved.
- D. Incorrect.
Incorrect. The application servers are the clients in this transaction, not the listeners on TCP 1433. Adding an inbound rule on the application servers for TCP 1433 from the database servers would be relevant only if the database initiated connections to the application tier on that port, which is not the described behavior. This choice reflects confusion about client-server directionality in security group rules.