AZ-700 Question 257
Single answerYou manage an Azure environment with a single virtual network containing two VMs (front-end and back-end) in the same subnet. You have created a Network Security Group (NSG) that allows inbound HTTP/HTTPS ports (80 and 443). Additionally, administrators need RDP access (port 3389) to the front-end VM but should be prevented from connecting via RDP to the back-end VM. How should you associate the NSG to ensure only the front-end VM is accessible over RDP?
- A
Associate the NSG with the entire virtual network to apply inbound port 3389 to all VMs.
- B
Associate the NSG with the subnet and add an inbound rule for port 3389 from the Internet.
- C
Associate the NSG with the network interface of the front-end VM and add an inbound rule for port 3389.
- D
Place each VM in its own resource group and associate the NSG with the resource group containing the front-end VM.
Show answer and explanation
Correct answer: C
Explanation
By associating an NSG with the network interface rather than the subnet or entire virtual network, you gain precise control over inbound connections to that specific VM. Microsoft documentation (https://learn.microsoft.com/azure/virtual-network/manage-network-security-group) recommends applying an NSG at the network interface level when you need dedicated rule sets for individual VMs within the same subnet.
- A. Incorrect.
Option 1: Associating the NSG with the entire virtual network applies the same rules to all subnets and VMs. This would enable RDP for both the front-end and back-end VMs, which is not desired.
- B. Incorrect.
Option 2: Associating the NSG with the subnet is less granular and still grants RDP to any VM on that subnet. This doesn�t isolate the front-end VM� RDP access from the back-end VM.
- C. Correct.
Option 3: Associating the NSG to the front-end VM� network interface is the correct choice. This allows you to specifically control inbound traffic (port 3389) for that VM only, without affecting other VMs in the subnet.
- D. Incorrect.
Option 4: NSGs cannot be directly associated with resource groups to control incoming VM traffic. Resource groups are logical groupings of resources, not network-level boundaries.