NSG rules (inbound, outbound) in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Understanding NSG Inbound Rule Priority

You have an Azure Network Security Group (NSG) with two inbound rules:

• Rule 100: Allow TCP port 80 from any source
• Rule 200: Deny all inbound traffic

What will happen to an inbound TCP request on port 80?

A The request is denied because rule 200 has a higher priority number than rule 100.

B The request is denied because deny all overrides allow rules regardless of priority.

C The request is allowed because rule 100 permits TCP port 80 before the deny all rule.

D The request is allowed only if it comes from a specific IP range.

💡 Hint

Remember that NSG rules are processed in order of priority, from lowest number to highest.

NSG rules are evaluated by priority number, lowest first. Rule 100 allows TCP port 80, so the request is allowed before the deny all rule 200 is checked.

❓ Configuration

intermediate

Outbound NSG Rule Effect on Internet Access

You configure an NSG with the following outbound rules:

• Rule 100: Deny outbound traffic to internet IP ranges
• Rule 200: Allow outbound traffic to all destinations

What will be the effect on outbound internet access?

A Outbound internet traffic is denied because rule 100 blocks it before rule 200 allows all traffic.

B Outbound internet traffic is allowed because rule 200 allows all traffic regardless of rule 100.

C Outbound internet traffic is denied only if the source IP is in a specific subnet.

D Outbound internet traffic is allowed only during business hours.

💡 Hint

Consider how NSG rules are processed by priority and the effect of deny rules.

NSG outbound rules are processed by priority. Rule 100 denies outbound traffic to internet IPs first, so the traffic is blocked before rule 200 allows all traffic.

❓ security

advanced

Impact of Overlapping NSG Rules on Security

An NSG has these inbound rules:

• Rule 100: Allow TCP port 22 from IP range 10.0.0.0/24
• Rule 150: Deny TCP port 22 from IP range 10.0.0.0/16

What is the effective behavior for a connection attempt on TCP port 22 from IP 10.0.1.5?

A The connection is allowed because rule 100 allows 10.0.0.0/24 which includes 10.0.1.5.

B The connection is denied because 10.0.1.5 is in 10.0.0.0/16 and rule 150 denies it before rule 100 allows a smaller range.

C The connection is allowed because deny rules are ignored if an allow rule exists.

D The connection is denied only if it comes from outside 10.0.0.0/24.

💡 Hint

Check which rule has higher priority and if the IP matches the CIDR ranges.

Rule 150 has priority 150 and denies TCP port 22 from 10.0.0.0/16, which includes 10.0.1.5. Rule 100 allows only 10.0.0.0/24, which does not include 10.0.1.5. So the deny rule applies first.

❓ Architecture

advanced

Designing NSG Rules for Multi-Tier Application

You have a three-tier application with web, app, and database subnets. You want to allow inbound HTTP traffic only to the web subnet, allow app subnet to communicate with database subnet on port 1433, and block all other traffic.

Which NSG rule set correctly implements this?

A Web subnet NSG: Allow inbound TCP 80 from internet; App subnet NSG: Allow inbound TCP 1433 from app subnet; Database subnet NSG: Allow inbound TCP 1433 from app subnet; All NSGs: Deny all other traffic.

B .ciffart rehto lla yneD :sGSN llA ;tenbus ppa morf 3341 PCT dnuobni wollA :GSN tenbus esabataD ;tenbus ppa morf 3341 PCT dnuobni wollA :GSN tenbus ppA ;tenretni morf 08 PCT dnuobni wollA :GSN tenbus beW

C Web subnet NSG: Allow inbound TCP 80 from internet; App subnet NSG: Allow inbound TCP 1433 from web subnet; Database subnet NSG: Allow inbound TCP 1433 from app subnet; All NSGs: Deny all other traffic.

D Web subnet NSG: Allow inbound TCP 80 from internet; App subnet NSG: Allow inbound TCP 1433 from web subnet; Database subnet NSG: Allow inbound TCP 1433 from app subnet; All NSGs: Allow all outbound traffic.

💡 Hint

Think about which subnet needs access to which ports and from where.

The web subnet allows inbound HTTP from internet. The app subnet needs to communicate with database subnet on port 1433, so database NSG allows inbound TCP 1433 from app subnet. Deny all other traffic ensures no unwanted access.

✅ Best Practice

expert

Optimizing NSG Rules for Performance and Security

You manage an NSG with many rules. You notice latency in rule processing and want to optimize.

Which practice will best improve NSG performance and maintain security?

A Remove all deny rules and rely on default deny behavior to reduce rule count.

B Add more rules with specific IP addresses to increase granularity and security.

C Place deny rules at the lowest priority numbers to ensure they are evaluated last.

D Consolidate rules by combining CIDR ranges where possible and order rules by priority with most used rules first.

💡 Hint

Think about how rule evaluation order and rule count affect performance.

Consolidating rules reduces the total number of rules, and ordering rules by priority with the most frequently matched rules first reduces processing time. This improves performance while maintaining security.