AZ-500 · Question #421
Hotspot Question You have an Azure subscription that contains the virtual machines shown in the following table. VNET1, VNET2, and VNET3 are peered with each other. You perform the following…
The correct answer is You can add the network interface of VM2 only to ASG1. = Yes; You can add the network interfaces of VM2 and VM4 only to ASG1. = No; You can add the network interfaces of VM2, VM3, and VM4 only to ASG1. = No; You can add the network interfaces of VM2 and VM4 only to ASG2. = No; You can add the network interfaces of VM1, VM2, and VM4 only to ASG2. = Yes; You can add the network interfaces of VM2, VM3, and VM4 only to ASG2. = No; You can add the network interfaces of VM1, VM2, VM3, and VM4 to ASG2. = No. Azure Application Security Groups (ASGs) - Hotspot Explained Key Rules to Know First | Rule | Detail | |------|--------| | Region lock | An ASG only accepts NICs from VMs in the same region as the ASG | | VNet lock | Once the first NIC is added to an ASG, that ASG becomes bound…
Question
Exhibits
Answer Area
- You can add the network interface of VM2 only to ASG1.Yes
- You can add the network interfaces of VM2 and VM4 only to ASG1.No
- You can add the network interfaces of VM2, VM3, and VM4 only to ASG1.No
- You can add the network interfaces of VM2 and VM4 only to ASG2.No
- You can add the network interfaces of VM1, VM2, and VM4 only to ASG2.Yes
- You can add the network interfaces of VM2, VM3, and VM4 only to ASG2.No
- You can add the network interfaces of VM1, VM2, VM3, and VM4 to ASG2.No
Explanation
Azure Application Security Groups (ASGs) - Hotspot Explained
Key Rules to Know First
| Rule | Detail |
|---|---|
| Region lock | An ASG only accepts NICs from VMs in the same region as the ASG |
| VNet lock | Once the first NIC is added to an ASG, that ASG becomes bound to that VNet. All subsequent NICs must be from the same VNet |
| Multi-ASG | A NIC can belong to multiple ASGs simultaneously |
Inferred VM Table (from answer logic)
| VM | Region | VNet |
|---|---|---|
| VM1 | West US | VNET1 |
| VM2 | West US | VNET1 |
| VM3 | East US | VNET2 |
| VM4 | West US | VNET2 |
ASG1 and ASG2 are both in West US. VM1's NIC is already in ASG1, so ASG1 is VNet-locked to VNET1.
Statement-by-Statement
1. "VM2 only to ASG1" -> YES
- ASG1 is locked to VNET1 (West US) because VM1 is in it
- VM2 is in VNET1, West US -> eligible
- VM3 is in East US -> region mismatch, blocked
- VM4 is in VNET2 -> VNet mismatch, blocked
- VM2 is the only remaining VM that qualifies
2. "VM2 and VM4 only to ASG1" -> NO
- VM4 is in VNET2, but ASG1 is locked to VNET1 -> VNet constraint blocks VM4
- VM4 cannot be added to ASG1
3. "VM2, VM3, and VM4 only to ASG1" -> NO
- VM3 is in East US -> region constraint blocks it (ASG1 is West US)
- VM4 is in VNET2 -> VNet constraint blocks it
- Only VM2 qualifies for ASG1
4. "VM2 and VM4 only to ASG2" -> NO
- ASG2 is empty, so there is no VNet lock yet
- VM1 (VNET1, West US) is also eligible for ASG2 - NICs can belong to multiple ASGs
- This list is incomplete; VM1 is missing
5. "VM1, VM2, and VM4 only to ASG2" -> YES
- ASG2 is empty -> no VNet restriction yet
- VM1 (West US), VM2 (West US), VM4 (West US) -> all pass the region check
- VM3 (East US) -> fails the region check
- These three are exactly the eligible candidates
6. "VM2, VM3, and VM4 only to ASG2" -> NO
- VM3 is in East US -> region mismatch, cannot be added
- Also omits VM1, which is eligible
7. "VM1, VM2, VM3, and VM4 to ASG2" -> NO
- VM3 is in East US -> region constraint blocks it
- You cannot add an East US NIC to a West US ASG, period
Memory Tip
"Region first, then VNet" - An ASG rejects NICs from the wrong region immediately. For NICs that pass the region check, the VNet constraint only kicks in after the first NIC is added. An empty ASG has no VNet preference yet.
A useful mnemonic: Region locks the door, VNet locks the room - you can't enter the building if you're in the wrong city, and once someone moves into a room, only roommates from the same floor (VNet) can join.
Topics
Community Discussion
No community discussion yet for this question.