AZ-104 Question 219
Select 2You have deployed several virtual machines to a single subnet in an Azure Virtual Network. All these VMs are intended to host your company’s web application. You create an Application Security Group (ASG) named 'WebAppASG' and add all the VMs to it. Next, you create a Network Security Group (NSG) with an inbound rule allowing traffic from Any source to 'WebAppASG' on port 443 and associate this NSG with the subnet. Despite these configurations, external users report that they cannot reach the application over HTTPS. Which two steps should you perform to ensure that inbound traffic on port 443 is allowed to your VMs? (Choose two.)
- A
Lower the priority of the inbound allow rule so that it overrides the default inbound deny rule
- B
Verify that each VM’s network interface is indeed associated with the 'WebAppASG'
- C
Associate the NSG with the route table of the virtual network for Internet-bound traffic
- D
Change the inbound security rule’s direction to 'Outbound' to enable public access
Show answer and explanation
Correct answers: A, B
Explanation
To allow inbound HTTPS traffic to the virtual machines, you need an NSG rule that successfully overrides the default inbound deny (by having a lower priority value) and you must ensure the VM NICs are correctly assigned to the specified Application Security Group. Without these steps, the inbound HTTPS traffic will continue to be blocked.
- A. Correct.
If the allow rule has a priority higher than (a larger number than) the default deny rule, it will not be effective. Ensuring its priority is lower (a smaller number) than the default deny rule is essential for the allow rule to work correctly.
- B. Correct.
An Application Security Group-based rule will only apply to VMs that are explicitly associated with that ASG. If the VM NICs are not correctly joined to 'WebAppASG', the NSG rule will not match those VMs.
- C. Incorrect.
You associate NSGs with subnets or NICs, not with route tables. Route tables control the flow of packets at the network layer, whereas NSGs manage access at the packet filtering layer.
- D. Incorrect.
Changing the rule from inbound to outbound would only affect outgoing connections, not incoming connections, so this does not resolve the issue of allowing external access to the VMs over HTTPS.