Hotspot Question You implement the planned changes for ASG1 and ASG2. In which NSGs can you use ASG1, and the network interfaces of which virtual machines can you assign to ASG2? Answer:

Question

Exhibit

Answer Area

• NSGs:NSG2 and NSG4 only
  NSG2 onlyNSG2 and NSG4 onlyNSG2, NSG3, and NSG4
• Virtual machines:VM2, VM3, and VM4 only
  VM3 onlyVM2 and VM4 onlyVM1, VM2, and VM4 onlyVM2, VM3, and VM4 onlyVM1, VM2, VM3, and VM4

Explanation

This hotspot question tests understanding of Application Security Group (ASG) scope rules in Azure - specifically that ASGs are region-scoped and can only be used in NSGs and assigned to VMs within the same region and virtual network constraints.

Approach. ASGs in Azure are region-specific resources. An ASG can only be referenced in an NSG security rule if the NSG and the ASG exist in the same Azure region. Similarly, a network interface can only be assigned to an ASG if the NIC's virtual machine resides in the same region as the ASG, and all NICs assigned to a given ASG must belong to VMs in the same virtual network. Therefore, for ASG1 you can use it in any NSG that is in the same region as ASG1, and for ASG2 you can assign network interfaces only from VMs that reside in the same region and virtual network as ASG2.

Concept tested. Azure Application Security Group (ASG) regional and virtual network scoping rules - ASGs are region-bound, meaning they can only be referenced in NSG rules within the same region, and NICs can only be assigned to an ASG if the associated VMs are in the same region and virtual network as the ASG.

Reference. https://learn.microsoft.com/en-us/azure/virtual-network/application-security-groups

No community discussion yet for this question.