AZ-104 Question 218
Single answerYou manage an Azure environment that hosts multiple virtual machines (VMs) for different workloads in the same subnet. You need to apply the same inbound security rules to a subset of these VMs that host an internal web-based application, while minimizing the amount of manual rule configuration. What is the recommended way to achieve this?
- A
Deploy a unique Network Security Group (NSG) per VM and replicate security rules across each NSG.
- B
Move the web-based VMs to a dedicated subnet and apply a single NSG to that subnet.
- C
Create an Application Security Group (ASG) for the web-based VMs and reference that ASG in your NSG rules.
- D
Use Azure Firewall to create a DNAT rule that protects inbound traffic to the web-based VMs.
Show answer and explanation
Correct answer: C
Explanation
Using an Application Security Group to group VMs that share similar traffic filtering requirements is recommended. By listing the ASG as the target or source in NSG rules, you simplify rule management and avoid duplication.
- A. Incorrect.
Having a separate NSG for each VM leads to repetitive configuration and is not the most efficient approach.
- B. Incorrect.
While moving the VMs to a dedicated subnet with a single NSG might work, it is more disruptive and doesn’t scale well for multiple logical groupings.
- C. Correct.
Application Security Groups allow you to group VMs logically and then reference the group in your NSG rules, simplifying management and minimizing repetitive configuration.
- D. Incorrect.
Azure Firewall’s DNAT rules are more about redirecting inbound traffic and do not replace the functionality of NSGs for filtering traffic on a per-VM or per-group basis.