AZ-700 Question 259
Select 3You are designing a microservices-based application in Azure with a front-end tier (ASG-Frontend) and a back-end tier (ASG-Backend). You want to securely allow inbound HTTPS (port 443) traffic from the front-end VMs to the back-end VMs using an Application Security Group (ASG) and a Network Security Group (NSG). Which of the following steps must you take to ensure the correct traffic flow?
- A
Create the ASG-Backend in the same region and resource group as the back-end VMs, attach each VM� network interface (NIC) to it, and reference ASG-Backend as the destination in an NSG rule allowing port 443.
- B
Create an ASG-Frontend in the same region and resource group as the front-end VMs, attach each VM� NIC to it, and reference ASG-Frontend as the source in the same NSG rule.
- C
Create a route table that specifically routes traffic to the ASG-Backend to manage inbound connections.
- D
Enable a user-defined route (UDR) to direct traffic from the front-end subnet to the back-end subnet through the ASG-Backend.
- E
Associate the NSG containing the ASG-based rules with either the subnet of the back-end VMs or the NICs of the back-end VMs.
Show answer and explanation
Correct answers: A, B, E
Explanation
To restrict traffic using ASGs, you must create separate ASGs for each tier (front-end and back-end) in the same region and resource group as the respective VMs. Then, configure an NSG rule that allows traffic from the front-end ASG to the back-end ASG on the desired port. Finally, associate the NSG where the rule is defined with either the subnet or the NICs hosting the back-end VMs. For more information, refer to Microsoft Azure documentation on Application Security Groups (https://learn.microsoft.com/azure/virtual-network/application-security-groups).
- A. Correct.
Correct. An ASG must be created in the same region and resource group as the VMs it will protect. After creation, you attach each VM� NIC to the ASG. In the NSG rule, referencing the ASG as the destination and specifying the allowed port (443) enables secure inbound traffic.
- B. Correct.
Correct. The front-end VMs also need an ASG, so you can properly reference it as the source in the NSG rule. By setting the source to the front-end ASG, only these VMs can communicate with the back-end ASG on port 443.
- C. Incorrect.
Incorrect. While route tables can be used to direct traffic through specific network paths, they are not required for creating or using application security groups. ASGs are managed through NSGs, not route tables.
- D. Incorrect.
Incorrect. A user-defined route (UDR) is not necessary to allow legitimate traffic from one ASG to another within the same virtual network. UDRs are typically used to override default system routes for specialized routing scenarios, but not for basic ASG-based traffic rules.
- E. Correct.
Correct. The NSG with the ASG-based security rules must be associated with either the subnet containing the back-end VMs or the NICs of those VMs. This ensures that the assigned rules (allowing inbound traffic on port 443 from ASG-Frontend to ASG-Backend) are enforced.