AZ-700 Question 253
Select 2You have an Azure VM hosting a web application. You need to ensure HTTP access (TCP port 80) is open to all Internet users, but allow RDP (TCP port 3389) only from a specific on-premises IP address (1.2.3.4). All other inbound connections must be denied. Which two actions must you implement in the Network Security Group (NSG) attached to the VM� subnet in order to meet these requirements?
- A
A) Add an inbound security rule allowing TCP port 80 from the Internet with a priority lower than the default deny rule.
- B
B) Add an inbound security rule allowing UDP port 3389 from your on-premises IP address (1.2.3.4) with a priority lower than the allow port 80 rule.
- C
C) Add an inbound security rule allowing TCP port 3389 from your on-premises IP address (1.2.3.4) with a priority lower than the default deny rule.
- D
D) Add an inbound security rule allowing all inbound traffic from your on-premises IP address (1.2.3.4) with a priority higher than the default rules.
Show answer and explanation
Correct answers: A, C
Explanation
When configuring NSGs, you create inbound and outbound rules that allow or deny traffic based on criteria such as source, destination, protocol, and port. To permit HTTP from all sources, create an inbound rule for TCP port 80 from the Internet with a priority lower than the default deny rule. For a secure RDP setup, restrict inbound traffic to port 3389 from only the specific on-premises IP address (1.2.3.4) with an appropriate priority. By default, NSGs deny inbound traffic if no matching allow rule is found. Refer to Microsoft� documentation on Network Security Groups (https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview) for best practices on configuring rules.
- A. Correct.
A) CORRECT. You need to add an inbound NSG rule that explicitly allows TCP port 80 from any source (i.e., �*� or �Internet�) and give it a priority number that is lower than the default deny-inbound rule. This ensures HTTP traffic is permitted.
- B. Incorrect.
B) INCORRECT. You must allow TCP (not UDP) on port 3389 for RDP. Configuring this as UDP traffic would block the actual RDP connection.
- C. Correct.
C) CORRECT. To allow RDP from a specific IP address, you add a rule that permits inbound TCP traffic on port 3389 from 1.2.3.4. Placing it at a lower (i.e., higher priority) value than the default rules ensures only that IP can open RDP sessions.
- D. Incorrect.
D) INCORRECT. Including all inbound traffic from 1.2.3.4 would allow more traffic than required, potentially introducing unnecessary risk. You should specifically allow TCP port 3389 rather than all ports.