AZ-700 Question 256
Select 3You administer an Azure environment hosting a multi-tier application in a single Virtual Network with two subnets: 'frontend' for web servers and 'backend' for database servers. You need to allow HTTP (port 80) inbound from the public Internet only to the 'frontend' subnet, while the 'backend' subnet should only accept SQL traffic (port 1433) coming from the 'frontend' subnet. To achieve this, you plan to create and associate Network Security Groups (NSGs) with each subnet. Which THREE of the following steps must you take to meet these requirements?
- A
Associate an NSG with the 'frontend' subnet and create an inbound rule allowing port 80 from any source.
- B
Associate an NSG with the 'backend' subnet and create an inbound rule allowing port 1433 from only the 'frontend' subnet� IP range.
- C
Create an outbound rule in the NSG on the 'frontend' subnet denying port 1433 traffic from any source.
- D
Enable a public IP address on the 'backend' VMs so you can associate an NSG directly to each NIC.
- E
Deny all inbound traffic from the public internet in the NSG associated with the 'backend' subnet.
Show answer and explanation
Correct answers: A, B, E
Explanation
In Azure, you can attach an NSG at the subnet or NIC level to control traffic flow. For a multi-tier application, it is often recommended to attach NSGs to subnets for consistent traffic filtering across similar workloads. In this scenario, you must allow inbound HTTP traffic to the front-end subnet on port 80 and restrict inbound SQL traffic on port 1433 to only come from the front-end subnet. Additionally, blocking external traffic from reaching the backend subnet directly prevents unauthorized access. For more details, refer to Microsoft Azure documentation on 'Network security groups' (https://learn.microsoft.com/azure/virtual-network/security-overview).
- A. Correct.
Option 1 is correct. Associating an NSG to the 'frontend' subnet and explicitly allowing inbound HTTP (port 80) from any source ensures that web traffic is accessible from the public internet.
- B. Correct.
Option 2 is correct. To restrict inbound SQL traffic on port 1433 only from the 'frontend' subnet, you must create an inbound rule in the 'backend' subnet� NSG allowing port 1433 specifically for the source IP range of the 'frontend' subnet.
- C. Incorrect.
Option 3 is incorrect. Denying port 1433 outbound from the 'frontend' subnet is not necessary in this scenario. The key requirement is to allow the front-end to access the back-end on port 1433, which involves an inbound rule on the 'backend' subnet's NSG in most common designs.
- D. Incorrect.
Option 4 is incorrect. You do not need to enable or expose public IP addresses on the 'backend' VMs nor associate an NSG directly with each NIC. Subnet-level NSGs are sufficient to enforce traffic restrictions in this scenario.
- E. Correct.
Option 5 is correct. To secure the 'backend' subnet from direct internet access, you should deny all inbound traffic from the public internet. This helps ensure that only interior traffic (e.g., from the 'frontend' subnet) can reach the 'backend' subnet.