Hotspot Question You have an Azure subscription that contains a virtual network named VNET1 in the East US 2 region. Network interfaces named VM1-NI and VM2-NI are connected to VNET1. You…

This question tests understanding of Azure Network Security Groups (NSGs) deployed via ARM templates, specifically how NSGs are associated with network interfaces and how security rules affect traffic between resources.

Submitted by minji_kr· Mar 4, 2026Configure and manage virtual networking

Question

Hotspot Question You have an Azure subscription that contains a virtual network named VNET1 in the East US 2 region. Network interfaces named VM1-NI and VM2-NI are connected to VNET1. You successfully deploy the following Azure Resource Manager template. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Exhibit

Answer Area

VMI and V2 can connect to VNET1.
If an Azure datacenter becomes unavailable, VM1 or VM2 will be available.
If the East US 2 region becomes unavailable, VM1 or VM2 will be available.

Explanation

Approach. When an ARM template deploys an NSG and associates it with network interfaces (VM1-NI and VM2-NI), the NSG rules govern inbound and outbound traffic for those NICs. Key evaluation points include: (1) Whether the NSG is successfully associated with both NICs after deployment, (2) Whether specific security rules (like allowing/denying RDP on port 3389, HTTP on port 80, or other ports) are defined and their priority order, (3) Whether the effective rules allow communication between VM1 and VM2 within VNET1 - since both are on the same virtual network, default 'AllowVnetInBound' rules typically permit internal traffic unless explicitly denied by a higher-priority rule, and (4) Whether the NSG has outbound rules that could affect connectivity to the internet or other resources. Without seeing the exact template content, the standard approach is to trace each NSG rule by priority (lower number = higher priority), determine if a matching rule exists for the traffic in question, and apply the first matching rule's Allow or Deny action.

Concept tested. Azure Network Security Groups (NSGs) - ARM template deployment, NSG-to-NIC association, inbound/outbound security rule evaluation, rule priority processing, and effective security rules for virtual machines within a virtual network.

Reference. https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

Topics

#ARM Templates#Virtual Networks#Network Interfaces

Community Discussion

No community discussion yet for this question.

Full AZ-104 Practice