AZ-104 Question 221
Select 2Your company requires inbound HTTPS traffic (TCP port 443) from an on-premises network to reach an Azure VM. You have created an inbound NSG rule to allow port 443, but traffic is still not reaching the VM. You also have an NSG applied at the subnet level and suspect the effective security rules might be blocking the connections. Which two approaches can you use to accurately identify the final action enforced by the NSG for this traffic flow?
- A
Use the 'IP Flow Verify' feature in Azure Network Watcher, specifying the VM's private IP address and port 443.
- B
Review the 'Effective security rules' blade for the VM's network interface in the Azure Portal.
- C
Enable diagnostic logging on the NSG and then query the logs in Azure Monitor for denied traffic.
- D
Configure Azure DDoS Protection Standard on the subnet to identify blocked inbound connections.
Show answer and explanation
Correct answers: A, B
Explanation
When multiple NSGs are applied (at both subnet and NIC levels), Azure merges those rules to determine the effective security configuration. Using IP Flow Verify and the Effective security rules blade are the most direct ways to diagnose any traffic blockages by the final NSG rule set.
- A. Correct.
IP Flow Verify in Azure Network Watcher helps you quickly test whether traffic is allowed or denied by NSG rules. You specify the source and destination IP addresses, port, and protocol to check the effective outcome.
- B. Correct.
Reviewing the Effective security rules blade enables you to see the combined (merged) rules from both the subnet and network interface NSGs, revealing the final enforced configuration for incoming traffic.
- C. Incorrect.
Diagnostic logging can help investigate traffic patterns and possible rule outcomes over time, but it does not directly show you the final, active NSG rule set in real-time for a specific flow.
- D. Incorrect.
Azure DDoS Protection Standard is designed to mitigate distributed denial-of-service attacks, not to display or troubleshoot individual NSG rule enforcement.