AZ-700 Question 263
Select 2You manage a production web server in Azure that must accept HTTPS traffic (port 443) only from the IP address 203.0.113.10. However, there is an existing NSG inbound rule with priority 300 that allows inbound traffic on port 443 from all sources, and you cannot delete or modify this rule for compliance reasons. You need to create additional NSG rules so that only 203.0.113.10 can access the web server over port 443. Which two of the following approaches will meet this requirement?
- A
Create a new inbound rule with priority 250 that allows inbound traffic from 203.0.113.10 on port 443, and rely on default rules to block everything else.
- B
Create a new inbound rule with priority 200 that allows inbound traffic from 203.0.113.10 on port 443, then create another rule with priority 250 that denies inbound traffic on port 443 from 0.0.0.0/0.
- C
Create a new inbound rule with priority 150 that allows traffic from 203.0.113.10 on port 443, followed by another inbound rule with priority 250 that denies traffic on port 443 from 0.0.0.0/0.
- D
Disable the existing rule with priority 300 and create a single new inbound rule with priority 100 that allows inbound traffic from 203.0.113.10 on port 443.
Show answer and explanation
Correct answers: B, C
Explanation
When multiple NSG rules exist, Azure processes them in increasing order of priority (the lower the number, the higher the precedence). To override an existing rule you cannot modify, you must create a more specific allow rule for your trusted IP address with a lower (more important) priority number and then deny traffic from all other sources with a subsequent rule. This setup ensures that only the trusted IP address is allowed to reach the web server. For more details, see Microsoft documentation on NSG rule processing: https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview.
- A. Incorrect.
Option 1 is incorrect. A rule with priority 250 that allows 203.0.113.10 will handle that specific address, but the existing priority 300 rule still allows all other IPs on port 443. Since priority 300 is processed after priority 250, traffic from any other IP would still be allowed by the existing rule. Simply relying on default rules is insufficient because the existing allow rule explicitly overrides the default deny.
- B. Correct.
Option 2 is correct. By first creating a rule (priority 200) that allows inbound traffic from 203.0.113.10 on port 443, that traffic is matched and passed. Then, a higher priority number rule (priority 250) denies all other inbound traffic on port 443 (0.0.0.0/0). This ensures only 203.0.113.10 is allowed, and the existing priority 300 rule is effectively overridden for other IPs.
- C. Correct.
Option 3 is correct. Similar reasoning applies here: a rule with a lower priority number (priority 150) explicitly allows traffic from 203.0.113.10 on port 443, and another rule (priority 250) then denies port 443 traffic from 0.0.0.0/0. The earlier rule lets 203.0.113.10 in, and the later rule blocks everyone else, making the existing allow rule redundant for other IPs.
- D. Incorrect.
Option 4 is incorrect. The scenario explicitly states you cannot delete or modify the existing rule. Disabling that rule is effectively modifying it. Therefore, this approach violates the compliance restriction and is not viable.