AZ-700 Question 261
Single answerYou have created an Application Security Group (ASG) named 'ASG-WebServers' to control traffic for a multi-tier application. You want to ensure that the ASG is properly associated with the network interface named 'NIC1' of a virtual machine named 'VM1.' Which action should you perform?
- A
Configure 'ASG-WebServers' on the subnet where 'VM1' resides so that all network interfaces in that subnet are automatically associated.
- B
Set the primary IP configuration of 'NIC1' to use 'ASG-WebServers' in the Application Security Groups settings.
- C
Delete the default Network Security Group (NSG) assigned to 'VM1' and create a new rule using 'ASG-WebServers' as the destination.
- D
Add 'ASG-WebServers' to the inbound NSG rule associated with 'NIC1' without updating the NIC's own Application Security Group settings.
Show answer and explanation
Correct answer: B
Explanation
To associate an ASG to a NIC, you must explicitly add the ASG to the NIC's configuration under 'Application security groups.' This tells Azure that the NIC is part of that ASG, allowing NSG rules referencing the ASG to apply properly. Microsoft documentation (https://learn.microsoft.com/azure/virtual-network/application-security-groups) provides guidance on configuring ASGs, including how to assign a NIC to an ASG using the Azure portal, Azure CLI, or PowerShell.
- A. Incorrect.
Option 1: Incorrect. Simply associating the ASG at the subnet level does not automatically attach it to each NIC. Having an ASG at a subnet level alone does not ensure each VM NIC is assigned to that ASG. You must explicitly assign the ASG to the NIC itself.
- B. Correct.
Option 2: Correct. You must edit the NIC configuration (in the Azure portal or through CLI/PowerShell) to select 'ASG-WebServers' under the Application Security Groups setting. This ensures the NIC is recognized as part of that ASG for traffic filtering.
- C. Incorrect.
Option 3: Incorrect. Deleting the default NSG is unnecessary and risky. You do not have to remove or recreate NSGs to add a NIC to an ASG; you just need to associate the NIC with the ASG and then reference that ASG within the NSG rules if desired.
- D. Incorrect.
Option 4: Incorrect. Although referencing an ASG in an NSG rule is part of enforcing security policies, you must still assign the ASG to the NIC itself for traffic to be properly filtered by ASG-based rules.