Network Security Groups (NSG) in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does NSG rule priority affect traffic filtering?

You have two NSG rules: Rule A with priority 100 allowing inbound HTTP (port 80), and Rule B with priority 200 denying all inbound traffic. What happens to inbound HTTP traffic?

A Inbound HTTP traffic is allowed only if it matches Rule B.

B Inbound HTTP traffic is denied because Rule B denies all inbound traffic.

C Inbound HTTP traffic is denied because NSG rules are evaluated randomly.

D Inbound HTTP traffic is allowed because Rule A has higher priority (lower number).

💡 Hint

Remember, NSG rules are processed in order of priority from lowest number to highest.

NSG rules are evaluated by priority number, lowest first. Rule A with priority 100 allows HTTP traffic before Rule B with priority 200 denies all inbound traffic, so HTTP traffic is allowed.

❓ Architecture

intermediate

Where should you apply NSGs for best security in a multi-tier Azure app?

You have a web tier, app tier, and database tier in separate subnets. Which NSG application strategy best limits unwanted traffic?

A Apply NSGs on all subnets to control traffic between tiers and from internet.

B Apply NSGs only on the web tier subnet to filter inbound internet traffic.

C Apply NSGs only on the database subnet to block all traffic except app tier.

D Do not use NSGs; rely on Azure Firewall instead.

💡 Hint

Think about controlling traffic flow between each tier and from outside.

Applying NSGs on all subnets allows filtering inbound and outbound traffic between tiers and from the internet, providing layered security.

❓ Configuration

advanced

What is the effect of this NSG rule configuration snippet?

Given this NSG rule JSON snippet, what is the effect on inbound traffic?

Azure

{
  "name": "Deny-SSH",
  "properties": {
    "priority": 300,
    "direction": "Inbound",
    "access": "Deny",
    "protocol": "Tcp",
    "sourcePortRange": "*",
    "destinationPortRange": "22",
    "sourceAddressPrefix": "*",
    "destinationAddressPrefix": "*"
  }
}

A Blocks inbound SSH traffic only from specific IP addresses.

B Allows all inbound SSH traffic because access is Deny but priority is high.

C Blocks all inbound SSH (port 22) traffic from any source.

D Blocks outbound SSH traffic on port 22.

💡 Hint

Check the direction, port, and access fields carefully.

The rule denies inbound TCP traffic on port 22 from any source to any destination, effectively blocking all inbound SSH connections.

❓ security

advanced

What happens if you have conflicting NSG rules with the same priority?

You create two NSG rules with priority 100: one allows inbound HTTP, the other denies inbound HTTP. What is the outcome?

A The deny rule takes precedence and blocks HTTP traffic.

B Azure NSG rejects the configuration; you cannot have duplicate priorities.

C The allow rule takes precedence and allows HTTP traffic.

D Traffic is randomly allowed or denied due to conflict.

💡 Hint

Check Azure NSG rules priority requirements.

Azure NSG requires unique priority numbers for rules. Duplicate priorities cause deployment errors.

🧠 Conceptual

expert

How does NSG flow logs help in troubleshooting network issues?

Which statement best describes the role of NSG flow logs in Azure?

A They log allowed and denied traffic flows through NSGs, helping identify blocked or allowed connections.

B They provide detailed packet captures of all network traffic for deep inspection.

C They automatically fix misconfigured NSG rules by suggesting corrections.

D They replace NSGs by providing firewall capabilities.

💡 Hint

Think about what logs usually record about network traffic.

NSG flow logs record metadata about allowed and denied traffic flows, useful for troubleshooting and auditing network security.