AZ-700 Question 264
Single answerYou are designing an Azure environment for a multi-tier application with separate web and database subnets. The environment must meet the following requirements: � The web subnet must allow inbound HTTP (port 80) from the Internet. � The web subnet must communicate with the database subnet over port 1433. � The database subnet must allow inbound RDP (port 3389) only from your corporate IP range. � You want to simplify management by enforcing security consistently within each subnet.
Which approach should you use to create and configure NSG rules to meet these requirements?
- A
Create two separate NSGs, each associated with one subnet. The first NSG for the web subnet allows inbound port 80 from the Internet and outbound port 1433 to the database subnet. The second NSG for the database subnet allows inbound port 3389 only from the corporate IP range.
- B
Create a single NSG and apply it to both subnets, allowing inbound HTTP on port 80 from any source, inbound RDP on port 3389 from any source, and outbound port 1433 to the database subnet.
- C
Create an NSG for each VM� NIC in both subnets, allowing inbound ports 80 and 3389 from all sources to simplify connectivity and blocking all outbound traffic to the database subnet.
- D
Create a single NSG for the entire virtual network, permitting inbound port 80 from the Internet and inbound port 3389 from the corporate IP range, while blocking all outbound traffic from the database subnet.
Show answer and explanation
Correct answer: A
Explanation
Following Azure best practices, you typically assign NSGs at the subnet level to control inbound and outbound traffic for all resources within that subnet. This approach minimizes complexity and maintains a clear separation of rules. For more details, see the official Azure documentation on Network Security Groups (e.g., https://learn.microsoft.com/azure/virtual-network/network-security-overview).
- A. Correct.
Option 1 is correct. By assigning an NSG to each subnet, you can apply the proper inbound and outbound rules at the subnet level. In the web subnet, you allow port 80 inbound from the Internet and port 1433 outbound to the database subnet. In the database subnet, you allow only RDP (port 3389) from the corporate IP range. This setup provides the required security constraints while simplifying management for all VMs within each subnet.
- B. Incorrect.
Option 2 is incorrect because it applies a single NSG with overly broad rules to both subnets. In particular, it permits inbound RDP (port 3389) from any source, which does not meet the requirement of restricting RDP to the corporate IP range.
- C. Incorrect.
Option 3 is incorrect because creating an NSG for each VM� NIC and allowing inbound ports 80 and 3389 from all sources is overly permissive. It also does not properly handle database connectivity requirements, as it blocks outbound port 1433 traffic that the web subnet needs to reach the database subnet.
- D. Incorrect.
Option 4 is incorrect because applying one NSG at the virtual network level can be unwieldy and does not selectively enforce inbound and outbound rules per subnet. Additionally, blocking all outbound traffic from the database subnet goes against the requirement for communication over port 1433 from web to database.