NSG rules (inbound, outbound) in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Understanding NSG Inbound Rule Priority

You have an Azure Network Security Group (NSG) with two inbound rules:

• Rule 100: Allow TCP port 80 from any source
• Rule 200: Deny all inbound traffic

What will happen to an inbound TCP request on port 80?

A The request is denied because rule 200 has a higher priority number than rule 100.

B The request is denied because deny all overrides allow rules regardless of priority.

C The request is allowed because rule 100 permits TCP port 80 before the deny all rule.

D The request is allowed only if it comes from a specific IP range.

💡 Hint

Remember that NSG rules are processed in order of priority, from lowest number to highest.

NSG rules are evaluated by priority number, lowest first. Rule 100 allows TCP port 80, so the request is allowed before the deny all rule 200 is checked.

❓ Configuration

intermediate

Outbound NSG Rule Effect on Internet Access

You configure an NSG with the following outbound rules:

• Rule 100: Deny outbound traffic to internet IP ranges
• Rule 200: Allow outbound traffic to all destinations

What will be the effect on outbound internet access?

A Outbound internet traffic is denied because rule 100 blocks it before rule 200 allows all traffic.

B Outbound internet traffic is allowed because rule 200 allows all traffic regardless of rule 100.

C Outbound internet traffic is denied only if the source IP is in a specific subnet.

D Outbound internet traffic is allowed only during business hours.

💡 Hint

Consider how NSG rules are processed by priority and the effect of deny rules.

NSG outbound rules are processed by priority. Rule 100 denies outbound traffic to internet IPs first, so the traffic is blocked before rule 200 allows all traffic.

❓ security

advanced

Impact of Overlapping NSG Rules on Security

An NSG has these inbound rules:

• Rule 100: Allow TCP port 22 from IP range 10.0.0.0/24
• Rule 150: Deny TCP port 22 from IP range 10.0.0.0/16

What is the effective behavior for a connection attempt on TCP port 22 from IP 10.0.1.5?

A The connection is allowed because rule 100 allows 10.0.0.0/24 which includes 10.0.1.5.

B The connection is denied because 10.0.1.5 is in 10.0.0.0/16 and rule 150 denies it before rule 100 allows a smaller range.

C The connection is allowed because deny rules are ignored if an allow rule exists.

D The connection is denied only if it comes from outside 10.0.0.0/24.

💡 Hint

Check which rule has higher priority and if the IP matches the CIDR ranges.

Rule 150 has priority 150 and denies TCP port 22 from 10.0.0.0/16, which includes 10.0.1.5. Rule 100 allows only 10.0.0.0/24, which does not include 10.0.1.5. So the deny rule applies first.

❓ Architecture

advanced

Designing NSG Rules for Multi-Tier Application

You have a three-tier application with web, app, and database subnets. You want to allow inbound HTTP traffic only to the web subnet, allow app subnet to communicate with database subnet on port 1433, and block all other traffic.

Which NSG rule set correctly implements this?

A Web subnet NSG: Allow inbound TCP 80 from internet; App subnet NSG: Allow inbound TCP 1433 from app subnet; Database subnet NSG: Allow inbound TCP 1433 from app subnet; All NSGs: Deny all other traffic.

B .ciffart rehto lla yneD :sGSN llA ;tenbus ppa morf 3341 PCT dnuobni wollA :GSN tenbus esabataD ;tenbus ppa morf 3341 PCT dnuobni wollA :GSN tenbus ppA ;tenretni morf 08 PCT dnuobni wollA :GSN tenbus beW

C Web subnet NSG: Allow inbound TCP 80 from internet; App subnet NSG: Allow inbound TCP 1433 from web subnet; Database subnet NSG: Allow inbound TCP 1433 from app subnet; All NSGs: Deny all other traffic.

D Web subnet NSG: Allow inbound TCP 80 from internet; App subnet NSG: Allow inbound TCP 1433 from web subnet; Database subnet NSG: Allow inbound TCP 1433 from app subnet; All NSGs: Allow all outbound traffic.

💡 Hint

Think about which subnet needs access to which ports and from where.

The web subnet allows inbound HTTP from internet. The app subnet needs to communicate with database subnet on port 1433, so database NSG allows inbound TCP 1433 from app subnet. Deny all other traffic ensures no unwanted access.

✅ Best Practice

expert

Optimizing NSG Rules for Performance and Security

You manage an NSG with many rules. You notice latency in rule processing and want to optimize.

Which practice will best improve NSG performance and maintain security?

A Remove all deny rules and rely on default deny behavior to reduce rule count.

B Add more rules with specific IP addresses to increase granularity and security.

C Place deny rules at the lowest priority numbers to ensure they are evaluated last.

D Consolidate rules by combining CIDR ranges where possible and order rules by priority with most used rules first.

💡 Hint

Think about how rule evaluation order and rule count affect performance.

Consolidating rules reduces the total number of rules, and ordering rules by priority with the most frequently matched rules first reduces processing time. This improves performance while maintaining security.

Practice

1. What is the primary purpose of an Azure Network Security Group (NSG)?

easy

A. To store data securely in the cloud

B. To manage user identities and access

C. To control inbound and outbound network traffic to resources

D. To monitor application performance

Solution

1. Step 1: Understand NSG function

   NSGs are designed to filter network traffic to and from Azure resources.

2. Step 2: Compare options

   Only To control inbound and outbound network traffic to resources describes controlling inbound and outbound traffic, which matches NSG's role.

3. Final Answer:

   To control inbound and outbound network traffic to resources -> Option C

4. Quick Check:

   NSG controls traffic = B [OK]

Hint: NSG controls traffic flow, not data or users [OK]

Common Mistakes:

• Confusing NSG with storage or identity services
• Thinking NSG monitors performance
• Assuming NSG manages user access

2. Which of the following is the correct way to specify an inbound NSG rule to allow TCP traffic on port 80?

easy

A. Priority: 100, Direction: Inbound, Protocol: TCP, Port: 80, Action: Allow

B. Priority: 100, Direction: Inbound, Protocol: UDP, Port: 80, Action: Allow

C. Priority: 100, Direction: Outbound, Protocol: TCP, Port: 80, Action: Allow

D. Priority: 100, Direction: Inbound, Protocol: TCP, Port: 443, Action: Allow

Solution

1. Step 1: Identify direction and protocol

   The question asks for inbound TCP traffic on port 80, so Direction must be Inbound and Protocol TCP.

2. Step 2: Check port and action

   Port must be 80 and Action Allow to permit traffic.

3. Final Answer:

   Priority: 100, Direction: Inbound, Protocol: TCP, Port: 80, Action: Allow -> Option A

4. Quick Check:

   Inbound TCP port 80 allow = C [OK]

Hint: Inbound + TCP + port 80 + Allow = correct rule [OK]

Common Mistakes:

• Using outbound direction instead of inbound
• Using UDP protocol instead of TCP
• Specifying wrong port number

3. Given these NSG rules applied in order of priority:
1) Priority 100: Allow inbound TCP port 22 from 10.0.0.0/24
2) Priority 200: Deny inbound TCP port 22 from any
What will happen if a connection attempt comes from IP 10.0.0.5 on port 22?

medium

A. The connection is allowed because allow rule has higher priority

B. The connection is allowed because deny rules do not apply to private IPs

C. The connection is denied because default deny applies

D. The connection is denied because deny rule has higher priority

Solution

1. Step 1: Understand rule priority

   Lower priority number means higher priority. Priority 100 rule is evaluated before 200.

2. Step 2: Evaluate matching rules

   IP 10.0.0.5 matches allow rule at priority 100, so connection is allowed before deny rule is checked.

3. Final Answer:

   The connection is allowed because allow rule has higher priority -> Option A

4. Quick Check:

   Lower priority allow beats higher priority deny = D [OK]

Hint: Lower priority number rules apply first [OK]

Common Mistakes:

• Assuming deny always overrides allow
• Ignoring rule priority order
• Thinking private IPs bypass deny rules

4. You created an NSG rule to allow outbound HTTPS traffic on port 443, but traffic is still blocked. Which of the following is the most likely cause?

medium

A. The source IP address range is set to 0.0.0.0/0

B. The NSG rule is set to inbound instead of outbound

C. The protocol is set to UDP instead of TCP

D. There is a higher priority outbound deny rule blocking port 443

Solution

1. Step 1: Check rule priority and direction

   If traffic is blocked despite allow rule, a deny rule with higher priority likely blocks it.

2. Step 2: Evaluate other options

   Inbound vs outbound mismatch or protocol mismatch would cause no effect, but the question states rule exists for outbound HTTPS.

3. Final Answer:

   There is a higher priority outbound deny rule blocking port 443 -> Option D

4. Quick Check:

   Higher priority deny blocks traffic despite allow = A [OK]

Hint: Check for higher priority deny rules first [OK]

Common Mistakes:

• Ignoring rule priority order
• Confusing inbound and outbound directions
• Assuming source IP 0.0.0.0/0 blocks traffic

5. You want to allow inbound HTTP traffic only from a specific IP range 192.168.1.0/24 and deny all other inbound HTTP traffic. Which NSG rule configuration achieves this?

hard

A. Priority 100: Deny inbound TCP port 80 from any; Priority 200: Allow inbound TCP port 80 from 192.168.1.0/24

B. Priority 100: Allow inbound TCP port 80 from 192.168.1.0/24; Priority 200: Deny inbound TCP port 80 from any

C. Priority 100: Allow inbound TCP port 80 from any; Priority 200: Deny inbound TCP port 80 from 192.168.1.0/24

D. Priority 100: Deny inbound TCP port 80 from 192.168.1.0/24; Priority 200: Allow inbound TCP port 80 from any

Solution

1. Step 1: Allow specific IP range first

   Allow rule with higher priority (lower number) must permit traffic from 192.168.1.0/24.

2. Step 2: Deny all other IPs

   Deny rule with lower priority blocks all other inbound HTTP traffic.

3. Final Answer:

   Priority 100: Allow inbound TCP port 80 from 192.168.1.0/24; Priority 200: Deny inbound TCP port 80 from any -> Option B

4. Quick Check:

   Allow specific IP first, then deny others = A [OK]

Hint: Allow specific IP with lower priority number, deny others after [OK]

Common Mistakes:

• Placing deny rule before allow rule
• Allowing all IPs instead of specific range
• Using wrong priority numbers