Hotspot Question You have the Azure virtual networks shown in the following table. You have the Azure virtual machines shown in the following table. The firewalls on all the virtual machines allow…

Question

Exhibits

Answer Area

• VM1No
• VM2No
• VM3Yes
• VM4Yes

Explanation

This question tests understanding of Azure Network Security Groups (NSGs), virtual network peering, and how inbound/outbound rules affect traffic between virtual machines in different subnets and VNets.

Approach. To evaluate each statement, you must consider: (1) whether the VNets are peered and if peering is bidirectional, (2) which subnet each VM belongs to and whether NSG1 is associated with that subnet or NIC, (3) the specific inbound and outbound rules in NSG1 including priority, port, protocol, source/destination, and action (Allow/Deny), and (4) the default Azure NSG rules which allow VNet-to-VNet traffic and deny all inbound from Internet by default. Azure NSG rules are evaluated by priority (lowest number = highest priority), and the first matching rule is applied. For ping (ICMP), you must check if there is an explicit Allow or Deny rule for ICMP or 'Any' protocol. If NSG1 is attached to a subnet, it affects all VMs in that subnet; if attached to a NIC, it only affects that specific VM. VNet peering must be established in both directions for full connectivity, and NSG rules still apply to peered traffic.

Concept tested. Azure NSG rule evaluation, VNet peering connectivity, ICMP/ping traffic filtering, and the interaction between subnet-level and NIC-level NSG associations across peered virtual networks.

Reference. https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

No community discussion yet for this question.