Microsoft Certified Azure Network Engineer Associate · Free Practice Question Medium
Question 2
You’re hosting a two-tier application within VNet-01, which has a CIDR block of 10.0.0.0/16, and the following resource configurations:
The front end is situated on a VM called “VMFrontend” within a public subnet. This public subnet has an IP address range of 10.0.2.0/24. VM_Front has a private IP address of 10.0.2.5 and a public IP address of 192.168.50.2.
The back end is located on a second VM, “VMBackend,” within a private subnet. This private subnet has an IP address range of 10.0.3.0/24. VMBackend has a private IP address of 10.0.3.4.
A public load balancer is present with a private IP address of 10.0.1.6 and a public IP address of 172.16.50.35.
You’re setting up a final rule for a network security group (NSG) linked to resources in the private subnet where VMBackend is located. This final rule should deny all traffic from the public subnet. Any traffic from the public subnet that doesn’t match any of the NSG Allow rules would be handled by this rule.
Which parameters for the NSG rule would fulfill the requirements for this NSG rule?
-
A
- Inbound Rule
- Source: 10.0.2.0/24
- Source Port: 0-65535
- Destination: 10.0.3.4
- Destination Port: 0-65535
- Protocol: ANY
- Priority: 4096
- Action: Deny
-
B
- Outbound Rule
- Source: 10.0.2.0/24
- Source Port: 0-65535
- Destination: 10.0.3.4
- Destination Port: 0-65535
- Protocol: ANY
- Priority: 20
- Action: Deny
-
C
- Inbound Rule
- Source: 10.0.0.0/16
- Source Port: *
- Destination: 10.0.3.4
- Destination Port: *
- Protocol: ANY
- Priority: 4096
- Action: Deny
-
D
- Outbound Rule
- Source: 0.0.0.0/0
- Source Port: *
- Destination: 10.0.3.4
- Destination Port: *
- Protocol: ANY
- Priority: 20
- Action: Deny
Reveal correct answer
Correct answer: A
Explanation
In this scenario, the aim is to configure a rule for VM_Back. To achieve this, it is appropriate to use its precise IP address (10.0.3.4) as the destination. This ensures that the rule is specifically targeted and will not accidentally block or allow traffic to other resources that may exist or be added later to the private subnet.
If you want to learn more, go to:
Create, change, or delete an Azure network security group | Microsoft Learn
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
