Network Security Groups (NSG) in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does NSG rule priority affect traffic filtering?

You have two NSG rules: Rule A with priority 100 allowing inbound HTTP (port 80), and Rule B with priority 200 denying all inbound traffic. What happens to inbound HTTP traffic?

A Inbound HTTP traffic is allowed only if it matches Rule B.

B Inbound HTTP traffic is denied because Rule B denies all inbound traffic.

C Inbound HTTP traffic is denied because NSG rules are evaluated randomly.

D Inbound HTTP traffic is allowed because Rule A has higher priority (lower number).

💡 Hint

Remember, NSG rules are processed in order of priority from lowest number to highest.

NSG rules are evaluated by priority number, lowest first. Rule A with priority 100 allows HTTP traffic before Rule B with priority 200 denies all inbound traffic, so HTTP traffic is allowed.

❓ Architecture

intermediate

Where should you apply NSGs for best security in a multi-tier Azure app?

You have a web tier, app tier, and database tier in separate subnets. Which NSG application strategy best limits unwanted traffic?

A Apply NSGs on all subnets to control traffic between tiers and from internet.

B Apply NSGs only on the web tier subnet to filter inbound internet traffic.

C Apply NSGs only on the database subnet to block all traffic except app tier.

D Do not use NSGs; rely on Azure Firewall instead.

💡 Hint

Think about controlling traffic flow between each tier and from outside.

Applying NSGs on all subnets allows filtering inbound and outbound traffic between tiers and from the internet, providing layered security.

❓ Configuration

advanced

What is the effect of this NSG rule configuration snippet?

Given this NSG rule JSON snippet, what is the effect on inbound traffic?

Azure

{
  "name": "Deny-SSH",
  "properties": {
    "priority": 300,
    "direction": "Inbound",
    "access": "Deny",
    "protocol": "Tcp",
    "sourcePortRange": "*",
    "destinationPortRange": "22",
    "sourceAddressPrefix": "*",
    "destinationAddressPrefix": "*"
  }
}

A Blocks inbound SSH traffic only from specific IP addresses.

B Allows all inbound SSH traffic because access is Deny but priority is high.

C Blocks all inbound SSH (port 22) traffic from any source.

D Blocks outbound SSH traffic on port 22.

💡 Hint

Check the direction, port, and access fields carefully.

The rule denies inbound TCP traffic on port 22 from any source to any destination, effectively blocking all inbound SSH connections.

❓ security

advanced

What happens if you have conflicting NSG rules with the same priority?

You create two NSG rules with priority 100: one allows inbound HTTP, the other denies inbound HTTP. What is the outcome?

A The deny rule takes precedence and blocks HTTP traffic.

B Azure NSG rejects the configuration; you cannot have duplicate priorities.

C The allow rule takes precedence and allows HTTP traffic.

D Traffic is randomly allowed or denied due to conflict.

💡 Hint

Check Azure NSG rules priority requirements.

Azure NSG requires unique priority numbers for rules. Duplicate priorities cause deployment errors.

🧠 Conceptual

expert

How does NSG flow logs help in troubleshooting network issues?

Which statement best describes the role of NSG flow logs in Azure?

A They log allowed and denied traffic flows through NSGs, helping identify blocked or allowed connections.

B They provide detailed packet captures of all network traffic for deep inspection.

C They automatically fix misconfigured NSG rules by suggesting corrections.

D They replace NSGs by providing firewall capabilities.

💡 Hint

Think about what logs usually record about network traffic.

NSG flow logs record metadata about allowed and denied traffic flows, useful for troubleshooting and auditing network security.

Practice

1. What is the primary purpose of an Azure Network Security Group (NSG)?

easy

A. To monitor application performance

B. To store data securely in Azure Blob Storage

C. To control inbound and outbound traffic to Azure resources

D. To manage user identities and access

Solution

1. Step 1: Understand NSG function

   NSGs are designed to filter network traffic to and from Azure resources.

2. Step 2: Identify correct purpose

   They do not store data, manage identities, or monitor performance.

3. Final Answer:

   To control inbound and outbound traffic to Azure resources -> Option C

4. Quick Check:

   NSG controls traffic [OK]

Hint: NSG controls network traffic, not data or users [OK]

Common Mistakes:

• Confusing NSG with storage or identity services
• Thinking NSG monitors performance
• Assuming NSG stores data

2. Which of the following is the correct way to specify a rule priority in an NSG rule?

easy

A. Priority is a string describing the rule

B. Priority is an IP address range

C. Priority is a boolean value true or false

D. Priority must be a unique integer between 100 and 4096

Solution

1. Step 1: Understand NSG rule priority format

   NSG rule priority is a unique integer between 100 and 4096 that determines rule evaluation order.

2. Step 2: Eliminate incorrect types

   Priority is not a string, boolean, or IP range.

3. Final Answer:

   Priority must be a unique integer between 100 and 4096 -> Option D

4. Quick Check:

   Priority = integer 100-4096 [OK]

Hint: Priority is a number from 100 to 4096 [OK]

Common Mistakes:

• Using strings or booleans for priority
• Confusing priority with IP ranges
• Not using unique priority numbers

3. Given this NSG rule:
Priority: 200, Direction: Inbound, Access: Deny, Source: Any, Destination: 10.0.0.4, Protocol: TCP, Port: 22
What happens when a user tries to SSH (port 22) to 10.0.0.4?

medium

A. The connection is denied

B. The connection is allowed only if from a specific IP

C. The connection is allowed

D. The connection is logged but allowed

Solution

1. Step 1: Analyze rule details

   The rule denies inbound TCP traffic on port 22 to destination 10.0.0.4 from any source.

2. Step 2: Determine effect on SSH connection

   SSH uses TCP port 22, so the connection attempt matches the deny rule and is blocked.

3. Final Answer:

   The connection is denied -> Option A

4. Quick Check:

   Deny inbound TCP port 22 = connection denied [OK]

Hint: Deny inbound on port 22 blocks SSH connections [OK]

Common Mistakes:

• Assuming 'Any' source means allow
• Confusing deny with logging
• Ignoring direction and port in rule

4. You created an NSG rule to allow inbound HTTP traffic on port 80, but the traffic is still blocked. What is the most likely cause?

medium

A. The NSG is not attached to the subnet or network interface

B. A higher priority deny rule blocks port 80 traffic

C. The source IP address is not specified

D. The protocol is set to UDP instead of TCP

Solution

1. Step 1: Check rule priority and conflicts

   NSG rules are evaluated by priority; a deny rule with higher priority can block traffic despite allow rules.

2. Step 2: Confirm rule attachment and protocol

   While attachment and protocol matter, the most common cause is a conflicting higher priority deny rule.

3. Final Answer:

   A higher priority deny rule blocks port 80 traffic -> Option B

4. Quick Check:

   Higher priority deny overrides allow [OK]

Hint: Check for higher priority deny rules first [OK]

Common Mistakes:

• Ignoring rule priority order
• Assuming NSG attachment is always correct
• Confusing protocol types

5. You want to restrict access so only a specific IP address (203.0.113.5) can access a VM on port 3389 (RDP). Which NSG rule configuration achieves this securely?

hard

A. Priority: 300, Direction: Inbound, Access: Allow, Source: 203.0.113.5, Destination: Any, Protocol: TCP, Port: 3389

B. Priority: 100, Direction: Inbound, Access: Deny, Source: Any, Destination: Any, Protocol: TCP, Port: 3389

C. Priority: 200, Direction: Inbound, Access: Allow, Source: Any, Destination: Any, Protocol: TCP, Port: 3389

D. Priority: 400, Direction: Outbound, Access: Allow, Source: 203.0.113.5, Destination: Any, Protocol: TCP, Port: 3389

Solution

1. Step 1: Allow only specific IP inbound on port 3389

   Priority: 300, Direction: Inbound, Access: Allow, Source: 203.0.113.5, Destination: Any, Protocol: TCP, Port: 3389 allows inbound TCP traffic on port 3389 only from IP 203.0.113.5, which matches the requirement.

2. Step 2: Check other options for correctness

   Priority: 100, Direction: Inbound, Access: Deny, Source: Any, Destination: Any, Protocol: TCP, Port: 3389 denies all inbound TCP 3389 traffic, blocking access. Priority: 200, Direction: Inbound, Access: Allow, Source: Any, Destination: Any, Protocol: TCP, Port: 3389 allows all sources, which is insecure. Priority: 400, Direction: Outbound, Access: Allow, Source: 203.0.113.5, Destination: Any, Protocol: TCP, Port: 3389 is outbound, irrelevant for inbound access.

3. Final Answer:

   Priority: 300, Direction: Inbound, Access: Allow, Source: 203.0.113.5, Destination: Any, Protocol: TCP, Port: 3389 -> Option A

4. Quick Check:

   Allow inbound TCP 3389 from specific IP [OK]

Hint: Allow inbound from specific IP, deny others by priority [OK]

Common Mistakes:

• Allowing all sources instead of specific IP
• Using outbound direction instead of inbound
• Denying all traffic without exception