AZ-700 Question 260
Single answerYou deployed multiple virtual machines (VMs) in the East US region to host a front-end application. You created a new Application Security Group (ASG) named 'FrontEndASG' to manage inbound security rules for these VMs. Which action must you take next to ensure that inbound traffic to these VMs is restricted based on membership in 'FrontEndASG'?
- A
Associate the 'FrontEndASG' with the subnet where the VMs reside and remove all individual VM references.
- B
Add each VM's network interface to the 'FrontEndASG' and reference 'FrontEndASG' in the inbound NSG rule.
- C
Add all VM hostnames as tags in the Network Security Group and reference them in the inbound NSG rule.
- D
Create a separate Network Security Group for each VM, then link those NSGs to 'FrontEndASG' as a source in the inbound rules.
Show answer and explanation
Correct answer: B
Explanation
In Azure, Application Security Groups (ASGs) group the network interfaces (NICs) of multiple VMs so you can apply the same NSG rules to them collectively. After creating an ASG in the same region as your VMs, you must add the VM NICs to the ASG and then reference the ASG in either the source or destination field of the NSG rule. This simplifies the management of repeated security policies across multiple VMs. For more details, see Microsoft's documentation on 'Manage application security groups � Azure portal.'
- A. Incorrect.
Option 1: Incorrect. You do not attach ASGs to a subnet. You must attach network interfaces to the ASG, not the subnet. Subnet association is done for NSGs, not ASGs.
- B. Correct.
Option 2: Correct. You must add each VM's network interface to the Application Security Group, then reference the ASG as the source or destination in an inbound NSG rule to control traffic collectively.
- C. Incorrect.
Option 3: Incorrect. NSG rules do not directly reference VM hostnames or tags as inbound filters. ASGs are designed to simplify this by grouping NICs.
- D. Incorrect.
Option 4: Incorrect. Creating multiple NSGs for each VM is unnecessary and complex. You reference the ASG directly in a single NSG rule to centralize the security configuration.