N10-009 Question 33
Single answerNetwork security groupsA company hosts a web application in a cloud environment. The web server VM is associated with a network security group (NSG). Users on the internet report they can no longer access the site over HTTPS after a recent security review. Internal administrators can still manage the server over a VPN connection. The NSG currently has these inbound rules, processed by priority from lowest number to highest: 100 - Allow TCP 22 from 10.10.0.0/16, 110 - Deny TCP 443 from Any, 120 - Allow TCP 443 from Any, 130 - Deny All from Any. What is the MOST likely cause of the outage?
- A
The deny rule for TCP 443 at priority 110 is evaluated before the allow rule at priority 120, so HTTPS traffic is blocked
- B
The allow rule for TCP 443 at priority 120 overrides the deny rule at priority 110 because allow rules take precedence over deny rules
- C
The deny-all rule at priority 130 blocks SSH management traffic from the VPN before rule 100 can be processed
- D
The NSG cannot filter HTTPS because encrypted traffic must be inspected by a firewall, not an NSG
Show answer and explanation
Correct answer: A
Explanation
The issue is caused by rule order. In cloud network security groups, inbound and outbound rules are commonly processed by priority, and the first matching rule is applied. Because the deny rule for TCP 443 has a higher precedence due to its lower priority number, it blocks HTTPS before the later allow rule is considered. This aligns with vendor best practices for security groups and ACL-style filtering: review rule priority carefully, place intended permits before broader denies when appropriate, and validate access after changes. Administrators should also document rule changes and use least privilege while avoiding conflicting entries. This question tests practical troubleshooting of security policy behavior rather than simple recall.
- A. Correct.
Correct. Network security group rules are typically evaluated in priority order, with lower numbers processed first. Once a match is found, evaluation stops. Because the inbound deny rule for TCP 443 at priority 110 appears before the allow rule for TCP 443 at priority 120, internet HTTPS traffic matches the deny rule and is blocked. This is a common operational mistake when administrators add a more specific or urgent deny rule without reviewing rule order.
- B. Incorrect.
Incorrect. In NSG-style rule processing, priority/order determines which rule is matched first, not a general preference for allow over deny. A later allow rule does not override an earlier matching deny rule. This option reflects a common misconception from other security products where policies may be merged or interpreted differently.
- C. Incorrect.
Incorrect. Rule 100 allows TCP 22 from 10.10.0.0/16 before rule 130 is reached, which explains why administrators can still connect over the VPN. The deny-all rule only applies to traffic that did not already match a previous rule. This option misunderstands first-match processing.
- D. Incorrect.
Incorrect. An NSG does not need to decrypt HTTPS to permit or deny it. It can filter based on Layer 3 and Layer 4 information such as IP addresses, ports, and protocol. Blocking or allowing TCP 443 is a standard NSG function. Deep packet inspection is not required for basic port-based access control.