AZ-700 Question 262
Single answerYou manage a multi-tier application in Azure. You�ve created an Application Security Group (ASG) named 'WebFrontASG' to group front-end virtual machines (VMs). You then added an inbound Network Security Group (NSG) rule referencing 'WebFrontASG' as the destination to allow HTTPS traffic (TCP port 443). Despite creating this rule, traffic to the front-end VMs remains blocked. Which action must you take to ensure HTTPS traffic is allowed to these VMs?
- A
Assign 'WebFrontASG' to the subnet that hosts your front-end VMs.
- B
Associate each front-end VM� network interface (NIC) with 'WebFrontASG'.
- C
Configure the NSG rule to reference 'WebFrontASG' as the source instead of the destination.
- D
Set the NSG� inbound rule priority to a lower number (higher priority) than 100.
Show answer and explanation
Correct answer: B
Explanation
To successfully allow inbound traffic via an Application Security Group (ASG), you must first associate the desired Azure NICs with that ASG. Then, you can reference the ASG in your NSG rules (either as source or destination) as appropriate. In this scenario, referencing 'WebFrontASG' as the destination only works if each front-end VM NIC is associated with the 'WebFrontASG'. For more details, refer to Microsoft� documentation on managing security with Azure Application Security Groups: https://learn.microsoft.com/azure/virtual-network/application-security-groups
- A. Incorrect.
Incorrect. Application Security Groups are attached at the NIC level, not at the subnet level. Subnet-level association applies to NSGs, not ASGs.
- B. Correct.
Correct. An ASG must be associated with the specific NICs of the VMs for the NSG rule to recognize them as part of that ASG. Without NIC association, the ASG reference in the NSG rule has no effect.
- C. Incorrect.
Incorrect. While you can reference an ASG as a source or destination, in this scenario the front-end VMs belong to 'WebFrontASG' to receive inbound HTTP/HTTPS traffic. Making it the source instead of the destination would not achieve the intended outcome.
- D. Incorrect.
Incorrect. The priority of the rule matters, but if you haven�t associated the front-end NICs with the ASG, the rule won�t apply to the intended VMs even with a higher priority.