AZ-700 Question 267
Select 2Your organization recently deployed a web application on an Azure VM behind a Network Security Group (NSG) in a dedicated subnet. You enabled NSG flow logs to monitor inbound traffic. After analyzing the logs, you notice repeated inbound attempts from multiple international IP addresses on port 443 with an 'Action' of 'Deny', while port 80 traffic from the same IP addresses is 'Allowed'. Your operations team also reports unusual high traffic volume on port 80. Which two statements accurately describe how to interpret these flow logs and how you might respond?
- A
Because the logs show 'Deny' on port 443, the suspicious IP addresses cannot proceed past the NSG on that port, verifying the deny rule is in effect.
- B
The logs indicate that suspicious IP addresses are successfully reaching your application over port 80, so additional measures like restricting inbound rules or implementing a Web Application Firewall might be warranted.
- C
The denied traffic on port 443 implies the TLS handshake is failing, so switching to allow TLS 1.2 instead of TLS 1.0 would resolve it.
- D
All inbound traffic on port 80 should be blocked outright to prevent any possible threats, as indicated by the high traffic volume.
Show answer and explanation
Correct answers: A, B
Explanation
By reviewing NSG flow logs, you can determine which traffic is allowed or denied, the direction of flows, and the protocols or ports in use. A 'Deny' action confirms that the NSG is effectively blocking inbound connections for that port or protocol, whereas 'Allowed' entries indicate traffic is passing through. In this scenario, it is evident that traffic is allowed on port 80 but denied on port 443. To address the suspicious activity, you could refine inbound rules or add additional protective measures, such as a Web Application Firewall. Refer to Microsoft documentation on Azure Network Watcher and NSG flow logs (https://learn.microsoft.com/azure/network-watcher/traffic-flow-logging) for guidance on best practices and advanced filtering options.
- A. Correct.
Option 1 is correct because the NSG logs show repeated 'Deny' events on port 443, confirming the rule is preventing inbound HTTPS traffic from those IP addresses.
- B. Correct.
Option 2 is correct because the flow logs confirm traffic is allowed on port 80 from the suspicious IP addresses. This suggests that the application is reachable over port 80, so additional security measures (like IP-based restrictions or a WAF) may be needed to mitigate potential threats.
- C. Incorrect.
Option 3 is incorrect because a 'Deny' action on port 443 in the NSG does not necessarily imply a TLS handshake failure at the application layer. It's more likely a security rule preventing that traffic by design, not a protocol mismatch.
- D. Incorrect.
Option 4 is incorrect because while restricting inbound traffic can reduce the attack surface, blocking all traffic on port 80 may disrupt legitimate access. A more strategic approach would involve refining NSG rules or implementing a WAF.