AZ-500 Question 48
Single answerYou are designing a solution in Azure where multiple virtual machines (VMs) in the same virtual network (VNet) must have different inbound security rules based on their role, front-end, application, or database. You need to minimize the operational overhead of maintaining individual Network Security Group (NSG) rules for each VM, while ensuring that only the correct inbound traffic is permitted. Which approach should you take to satisfy this requirement?
- A
Create an Application Security Group (ASG) for each role, associate each VM with the appropriate ASG, then reference these ASGs in inbound NSG rules attached to the subnet.
- B
Use a single ASG for the entire VNet and set individual inbound rules in each VM’s NSG directly.
- C
Configure NSGs exclusively at the NIC level and specify individual IP addresses for each VM in the inbound rules.
- D
Group all VMs into one ASG and reference that single ASG in a centrally managed NSG attached to the VNet.
Show answer and explanation
Correct answer: A
Explanation
By creating separate Application Security Groups (ASGs), you can assign VMs to each ASG based on their role (front-end, application, database). You then reference these ASGs in a single Network Security Group (NSG) attached to the relevant subnet or NIC, specifying inbound traffic rules that apply to each ASG. This approach significantly reduces the management overhead compared to maintaining distinct IP-based rules for each VM. Refer to the official Microsoft Learn documentation for more on using ASGs to simplify NSG rule management: https://learn.microsoft.com/azure/virtual-network/application-security-groups.
- A. Correct.
Option 1 is correct because creating separate ASGs for each role (front-end, application, database) and referencing these ASGs in the subnet-level NSG rules simplifies management and ensures that each tier only receives the authorized inbound traffic.
- B. Incorrect.
Option 2 is incorrect because using a single ASG for the entire VNet defeats the purpose of role-based segregation. Also, creating separate rules in each VM’s NSG increases overhead rather than reducing it.
- C. Incorrect.
Option 3 is incorrect because maintaining IP addresses at the NIC level is cumbersome and prone to configuration errors, especially if VM IPs change over time. Also, this does not leverage the benefits of ASGs for grouping VMs by role.
- D. Incorrect.
Option 4 is incorrect because having only one ASG for all VMs does not differentiate roles at all, making it difficult to apply rules that apply uniquely to front-end, application, or database VMs.