AZ-700 Question 258
Single answerYou have a subnet in an Azure virtual network hosting multiple virtual machines (VMs) with different security requirements. One VM runs a critical application that must allow inbound traffic only from specific on-premises IP addresses, while other VMs in the same subnet require broader inbound access. You want to minimize the impact on the other VMs� traffic while strictly controlling inbound flows to the critical VM. Which approach should you use to associate a Network Security Group (NSG)?
- A
A. Associate a new NSG to the entire subnet and create rules allowing traffic only from the on-premises IP addresses.
- B
B. Associate a separate NSG directly to the critical VM� network interface and create rules allowing only on-premises IP addresses.
- C
C. Apply a built-in Azure Firewall policy to the subnet instead of using an NSG.
- D
D. Enable just-in-time (JIT) VM access for all subnets in the virtual network.
Show answer and explanation
Correct answer: B
Explanation
When you need to apply traffic rules to a specific VM without affecting other machines on the same subnet, associate the NSG at the network interface level of that VM. By doing so, the NSG rules only impact that particular VM� inbound and outbound traffic. Microsoft documentation recommends applying NSGs at the subnet level when you want consistent rules across all resources in that subnet, or at the NIC level when you only want to target a specific resource. (Reference: Microsoft Learn � Filter network traffic with network security groups.)
- A. Incorrect.
A. This approach would restrict traffic for all VMs in the subnet. Although associating an NSG at the subnet level is valid, it does not meet the requirement to minimize impact on other VMs that need broader access.
- B. Correct.
B. Associating the NSG at the VM� network interface level allows you to target the critical VM with custom inbound rules. This ensures the other VMs are unaffected by the stricter rules, fulfilling both security and minimal disruption requirements.
- C. Incorrect.
C. Azure Firewall policies are not a direct replacement for NSGs in this scenario. While you can use Azure Firewall to control traffic across a subnet, it typically involves additional configuration overhead and cost. The question specifically focuses on using an NSG for controlling traffic on a single VM.
- D. Incorrect.
D. JIT VM access is a feature of Microsoft Defender for Cloud focusing on temporarily opening specific ports on VMs. It does not replace fine-grained inbound rules in an NSG and does not address the requirement to permanently allow specific on-premises IP addresses.