AZ-700 Question 255
Single answerContoso has an Azure Virtual Network with multiple subnets hosting several Windows VMs. The security team wants to allow inbound RDP traffic on port 3389 only from a specific on-premises IP range (203.0.113.0/24). All other inbound RDP traffic should be restricted, while outbound internet access must remain open. Which Network Security Group (NSG) configuration best meets these requirements?
- A
Create an NSG with a single inbound rule allowing port 3389 traffic from the entire internet. Apply it to each VM� network interface.
- B
Create an NSG with one inbound rule that allows port 3389 traffic from 203.0.113.0/24 and another inbound rule denying port 3389 for all addresses. Associate the NSG with the subnet hosting the VMs.
- C
Create an NSG with only default rules and rely on the platform to block unauthorized inbound traffic. Only associate the NSG with the virtual network gateway subnet.
- D
Create an NSG with multiple outbound deny rules for ports 3389 and apply it to each VM� network interface. Leave inbound rules at their default values.
Show answer and explanation
Correct answer: B
Explanation
To secure inbound RDP traffic to Azure VMs from a specific source IP range, the recommended approach is to use two rules in the same NSG: (1) an allow rule with a high priority (low numeric value) for the trusted IP range on port 3389, and (2) a rule with a lower priority (higher numeric value) that denies inbound traffic on port 3389 from all other sources. Associating this NSG at the subnet level ensures that all VMs in the subnet inherit these restrictions. This setup does not alter default outbound rules, which generally permit outbound internet traffic. Refer to Microsoft Documentation for more details: https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works.
- A. Incorrect.
Option 1 is incorrect. Allowing RDP from the entire internet is too broad and does not restrict the source to 203.0.113.0/24. This fails the requirement of restricting RDP only to the specified on-premises IP range.
- B. Correct.
Option 2 is correct. Defining an inbound allow rule for 203.0.113.0/24 on port 3389 with a higher priority (lower number) than a subsequent deny rule on the same port from all addresses ensures only the specified range can access RDP. Associating the NSG with the subnet applies this policy to all VMs in that subnet and does not block outbound internet traffic by default.
- C. Incorrect.
Option 3 is incorrect. Relying on default rules alone will not specifically restrict RDP access to the 203.0.113.0/24 range. Additionally, placing the NSG on the gateway subnet only does not protect the VMs in other subnets from unwanted inbound RDP traffic.
- D. Incorrect.
Option 4 is incorrect. Denying outbound port 3389 does not meet the inbound RDP restriction requirements, and default inbound rules would still allow or deny traffic based on a broader scope. This does not correctly limit inbound RDP to the on-premises IP range.