AZ-104 Question 222
Single answerAn Azure administrator configures a network security group (NSG) named NSG-Subnet on a subnet to allow inbound RDP (TCP/3389) from the internet at priority 100. Another NSG named NSG-VM is attached to the network interface of a virtual machine in the same subnet, which has a rule at priority 200 that denies inbound RDP. Which statement correctly describes the effective inbound security rule for RDP traffic to the VM?
- A
RDP traffic is allowed because the rule with the lower priority number always wins across all NSGs.
- B
RDP traffic is denied because the NIC-level NSG has a deny rule, regardless of the subnet-level rule.
- C
RDP traffic is allowed because the subnet-level NSG overrides NIC-level rules for inbound traffic.
- D
RDP traffic is denied because there is a priority conflict between subnet and NIC-level rules.
Show answer and explanation
Correct answer: B
Explanation
When multiple NSGs apply to the same resource (at the subnet level and the NIC level), traffic must be allowed by all NSGs. If any one NSG denies the traffic, it is blocked. In this scenario, the NIC-level NSG rule denies RDP, which takes precedence over the subnet-level allow rule, resulting in the traffic being denied.
- A. Incorrect.
While a lower priority number wins within a single NSG, the presence of a deny rule in any NSG results in denial of traffic.
- B. Correct.
If any NSG denies specific traffic, that traffic is effectively denied, regardless of what the other NSG allows.
- C. Incorrect.
Subnet-level rules do not override NIC-level rules; rather, the rules across both NSGs are combined, and any deny will block traffic.
- D. Incorrect.
The traffic is indeed denied, but the reason is that any deny rule takes effect, not specifically because of a ‘priority conflict.’