AZ-700 Question 254
Single answerYou are managing a multi-tier web application hosted on Azure. The front-end VMs are located in a subnet named 'ApplicationSubnet' with a Network Security Group (NSG) applied at the subnet level. This NSG allows inbound HTTP traffic from the Internet and denies all other inbound traffic. One of the front-end VMs, named VM1, needs to accept inbound connections on port 1433 from your corporate IP range for a specialized administrative tool. None of the other VMs in the same subnet require inbound 1433. You want to configure NSGs to meet these requirements without disrupting the current rules. What should you do?
- A
Create a new NSG, associate it with only VM1� network interface, and add an inbound rule for port 1433 from the corporate IP range.
- B
Modify the existing subnet-level NSG to allow inbound port 1433 from the corporate IP range specifically for VM1.
- C
No changes are needed because port 1433 is already allowed by the default rules at both subnet and NIC levels.
- D
Create an application security group for VM1 and apply a new inbound rule for port 1433 at the resource group level.
Show answer and explanation
Correct answer: A
Explanation
When you need a highly specific inbound rule for a single VM, applying a separate NSG to that VM� NIC is recommended. This approach isolates the rule to just that one VM. Changing the existing subnet-level NSG could unintentionally expose port 1433 for other VMs or complicate subnet rules. For more guidance, refer to Microsoft� documentation on designing NSG rules and applying multiple NSGs at both the subnet and NIC levels.
- A. Correct.
Correct. By creating an additional NSG and applying it only to the VM1 NIC, you can allow port 1433 for that specific VM. This isolates the inbound rule to VM1 without altering the existing subnet-level rules, which continue to block inbound connections on port 1433 for other VMs in the subnet.
- B. Incorrect.
Incorrect. You cannot directly target one specific VM with a subnet-level NSG rule using standard IP-based filtering. While you could theoretically specify a single private IP address for VM1, this approach is less flexible and risks unintended impacts on future IP changes. Best practice is to apply fine-grained rules at the NIC level when you only want to allow traffic for one VM.
- C. Incorrect.
Incorrect. Default NSG rules at both the subnet and NIC levels block inbound traffic unless explicitly allowed for the required protocol and port. There's no default rule that allows inbound port 1433 from the corporate IP range. Failing to create a rule for port 1433 means the traffic remains blocked.
- D. Incorrect.
Incorrect. Creating an application security group (ASG) could help group VMs logically, but simply creating an ASG and applying it at the resource group level does not directly translate into the required inbound rule. NSG rules must still be associated with a subnet or NIC to be enforced.