AZ-104 Question 196
Single answerYour organization has created an Azure Virtual Network named VNet1 containing two subnets, SubnetA and SubnetB. You need to allow inbound web traffic (HTTP and HTTPS) from the Internet only to SubnetA, while preventing all inbound Internet traffic to SubnetB. The two subnets, however, must still communicate with each other over port 443 for data synchronization. Which configuration meets these requirements with the simplest approach on Azure?
- A
Create a separate Network Security Group (NSG) for SubnetA that allows inbound ports 80 and 443 from the Internet, and another NSG for SubnetB that denies inbound traffic from the Internet. In both NSGs, allow inbound traffic on port 443 from each other’s subnet.
- B
Deploy Azure Firewall in SubnetB to handle inbound traffic from the Internet, then configure a UDR in SubnetA to force all traffic to Azure Firewall for inspection.
- C
Configure a service endpoint for SubnetB to block inbound Internet traffic. Assign a public IP address to SubnetA and allow inbound ports 80 and 443 in SubnetA’s NSG.
- D
Deploy an Application Gateway in SubnetA to route inbound web traffic to SubnetB on ports 80 and 443, and remove any NSGs from SubnetB.
Show answer and explanation
Correct answer: A
Explanation
Network Security Groups (NSGs) provide a straightforward way to allow and restrict traffic. By applying separate NSGs to SubnetA and SubnetB, you can allow inbound Internet traffic only to SubnetA on the required ports, block any direct Internet traffic to SubnetB, and still permit secure communication between the subnets on port 443.
- A. Correct.
Using NSGs on each subnet allows fine-grained control over inbound and outbound traffic. By permitting HTTP/HTTPS from the Internet for SubnetA while denying inbound Internet traffic for SubnetB, and allowing ports 443 between the subnets, all requirements are met simply.
- B. Incorrect.
Azure Firewall can achieve similar goals but is more complex to implement for a scenario that only requires basic port-based allow/deny rules.
- C. Incorrect.
Service endpoints focus on extending private IP addresses into Azure services rather than blocking inbound Internet traffic. Also, just adding a public IP to SubnetA doesn’t fully address SubnetB’s restriction needs.
- D. Incorrect.
Application Gateway is typically used for Layer 7 load balancing. It’s not intended for straightforward inbound port restrictions on specific subnets, and removing NSGs from SubnetB reduces security control.