AZ-104 Question 217
Single answerYou have a virtual network (VNet) containing multiple subnets for web and database virtual machines (VMs). You need to restrict inbound HTTP and HTTPS access to only the web VMs from the Internet, and you want to simplify management by grouping these VMs rather than configuring individual rules. How can you achieve this using Azure Network Security Groups (NSGs) and Application Security Groups (ASGs)?
- A
Assign a separate NSG to each web VM and manually open ports 80 and 443 on each NSG.
- B
Create an Application Security Group for the web VMs, associate it with a single NSG, and define inbound rules allowing TCP ports 80 and 443 for that ASG.
- C
Enable service endpoints for HTTP/HTTPS on the database subnet and rely on default NSG rules for the web subnet.
- D
Use a single ASG for all VMs in the VNet and keep the default inbound NSG rules as is.
Show answer and explanation
Correct answer: B
Explanation
By creating an Application Security Group for your web servers and then associating it with a single Network Security Group, you can centrally manage inbound rules (such as allowing only ports 80 and 443). This setup ensures that only the web VMs receive inbound HTTP/HTTPS traffic from the Internet, while other VMs remain protected.
- A. Incorrect.
This approach complicates management because you must create and maintain multiple NSGs, one per VM, which is not recommended for scalability or ease of management.
- B. Correct.
This correctly groups the web VMs and applies a single Network Security Group rule to allow only HTTP (port 80) and HTTPS (port 443) traffic to those machines, simplifying administration.
- C. Incorrect.
Service endpoints are primarily used to secure access to Azure services (e.g., Azure Storage), not to manage inbound HTTP/HTTPS rules for VMs. They do not solve the need to organize and protect the web VMs.
- D. Incorrect.
This places all VMs under the same security group with the same inbound rules, which does not restrict access to only the web VMs and defeats the purpose of limiting inbound Internet traffic.