AZ-500 Question 46
Select 2A company hosts multiple Azure VMs in a single virtual network. The VMs in the front-end pool must be permitted to access an internal application on back-end VMs using port 443 only. The company wants to minimize operational overhead when new VMs are introduced. You decide to use Application Security Groups (ASGs) and Network Security Groups (NSGs) to manage this scenario. Which two actions should you take to fulfill this requirement?
- A
- Create an ASG named FE-ASG for front-end VMs and another named BE-ASG for back-end VMs. Define an inbound NSG rule that allows traffic on port 443 from FE-ASG to BE-ASG.
- B
- Attach the NSG only to the front-end VMs and allow inbound traffic from any source on port 443, relying on Azure’s automatic identification of these VMs.
- C
- Associate the NSG with the back-end subnet or NICs, then define an inbound rule that specifically allows traffic from FE-ASG to BE-ASG on port 443.
- D
- Create a single ASG containing front-end and back-end VMs, and set an inbound rule that allows the ASG to communicate with itself on port 443.
Show answer and explanation
Correct answers: A, C
Explanation
When planning and implementing NSGs and ASGs, Microsoft recommends grouping VMs according to their roles (for example, front-end vs. back-end) and then applying NSG rules that reference these groups. This approach minimizes administrative overhead when additional VMs are added to a particular group. By creating separate ASGs for front-end and back-end VMs, you ensure you can apply advanced filtering rules (such as limiting traffic to TCP port 443) between the groups. For more details, see Azure documentation on Network Security Groups and Application Security Groups: https://learn.microsoft.com/azure/virtual-network/application-security-groups.
- A. Correct.
Option 1 is correct. It uses separate ASGs for front-end and back-end, which is the recommended approach to simplify maintenance as you add or remove VMs. The ASG-based NSG rule precisely allows only the required traffic (port 443) from the front-end ASG to the back-end ASG.
- B. Incorrect.
Option 2 is incorrect. Allowing inbound traffic from any source on port 443 to the front-end VMs does not restrict traffic at the back-end. This also violates the principle of least privilege by leaving the port open to all sources.
- C. Correct.
Option 3 is correct. You typically attach or associate the NSG to either the subnet or the NIC for the back-end VMs, then define an inbound security rule referencing the front-end ASG as source and the back-end ASG as destination on the required port.
- D. Incorrect.
Option 4 is incorrect. Placing all VMs in a single ASG and allowing that ASG to communicate with itself negates the isolation between front-end and back-end VMs, letting all traffic flow freely within the same ASG.