AZ-500 Question 47
Single answerYou are managing a three-tier application in Azure. VMs in each tier (Web, App, and Database) are placed in separate subnets, and you have created three Application Security Groups (ASGs): WebASG, AppASG, and DbASG, each corresponding to its tier. The Web tier must allow inbound HTTP traffic from the Internet, the App tier must receive traffic only from the Web tier, and the Database tier must only accept traffic from the App tier. You want to minimize administrative overhead while enforcing appropriate security rules. Which design should you implement for your Network Security Groups?
- A
Create one NSG and associate it to the entire virtual network, referencing all three ASGs in the inbound and outbound rules.
- B
Create one NSG for each of the three subnets, referencing the corresponding ASGs in the NSG rules to strictly allow traffic between the required tiers.
- C
Attach a separate NSG to each VM, configuring inbound and outbound rules to allow only specific source IP addresses of other VMs in the environment.
- D
Create a single NSG and associate it to only the Web tier subnet, while using default security configurations and relying on user-defined routes to enforce isolation for App and Database subnets.
Show answer and explanation
Correct answer: B
Explanation
Using one NSG per subnet with targeted rules referencing Application Security Groups is the recommended approach for tiered applications in Azure. This method balances granularity and manageability. Each subnet NSG can enforce communication between tiers by referencing ASGs, providing flexibility if VMs are added or removed. For official guidance, refer to Microsoft Docs on 'Filter network traffic with network security groups' (https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview) and 'Use application security groups to simplify network security' (https://learn.microsoft.com/azure/virtual-network/application-security-groups).
- A. Incorrect.
Option 1 is incorrect because associating a single NSG with the entire virtual network makes it more difficult to isolate subnet-level traffic and can lead to overly broad rules. While you can reference ASGs within one NSG, this does not typically provide the most granular control and may cause complexity if multiple subnets have differing needs.
- B. Correct.
Option 2 is correct. Assigning one NSG to each subnet (Web, App, Database) and referencing the relevant ASGs in the rules ensures that only required traffic flows between tiers. This design simplifies ongoing administration, as each subnet can maintain its own set of rules aligned with its tier's function, and ASGs make it easy to dynamically include or exclude VMs in each tier if they scale.
- C. Incorrect.
Option 3 is incorrect because attaching an NSG to each VM, rather than at the subnet level, leads to significant administrative overhead and a higher chance of configuration errors. NSGs at the VM level are possible but not recommended for environments where subnets provide logical segregation and simpler management.
- D. Incorrect.
Option 4 is incorrect because applying a single NSG only to the Web tier subnet and relying on user-defined routes does not sufficiently secure or segment the App and Database tiers. NSGs control inbound and outbound traffic at the NIC or subnet level, while routes alone cannot enforce firewall-like security rules.