AZ-500 · Question #253
There are four Azure virtual machines (VMs) in your company. Windows Server 2016 is run on all the VMs and located on a subnet named web1 in a virtual network (VNet) named vnet1. The four Azure VMs…
The correct answer is B. 2. To meet the inbound network traffic requirements for four VMs (TCP 443 for all, TCP 1444 for web1 and web3), two Network Security Groups (NSGs) are needed.
Question
Options
- A3
- B2
- C4
- D1
How the community answered
(40 responses)- A3% (1)
- B83% (33)
- C10% (4)
- D5% (2)
Why each option
To meet the inbound network traffic requirements for four VMs (TCP 443 for all, TCP 1444 for web1 and web3), two Network Security Groups (NSGs) are needed.
While 3 NSGs (one for the subnet, and one each for web1 and web3 NICs) could work, it is not the minimum number required in this specific scenario.
To satisfy these requirements with the minimum number of NSGs, you can create one NSG that allows TCP 443 and TCP 1444, and apply it to the network interfaces of `web1` and `web3`. A second NSG would then be created to allow only TCP 443, and applied to the network interfaces of `web2` and `web4`. This uses two distinct NSG configurations to meet the varying inbound access needs within the same subnet.
4 NSGs (one for each VM) would certainly work but is overly complex and not the most efficient solution.
One NSG cannot differentiate between `web1`/`web3` and `web2`/`web4` for port 1444 when applied uniformly to the subnet or all VMs, without using Application Security Groups as destination, which would still be one NSG.
Concept tested: Azure Network Security Group (NSG) application and rules
Source: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
Community Discussion
No community discussion yet for this question.