NSG rules (inbound, outbound) in Azure - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create an inbound NSG rule allowing HTTP traffic on port 80.

Azure

resource "azurerm_network_security_rule" "allow_http_inbound" {
  name                        = "Allow-HTTP-Inbound"
  priority                    = 100
  direction                   = "[1]"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "80"
  source_address_prefix       = "*"
  destination_address_prefix  = "*"
  network_security_group_name = azurerm_network_security_group.example.name
  resource_group_name         = azurerm_resource_group.example.name
}

Drag options to blanks, or click blank then click option'

AOutbound

BBoth

CIngress

DInbound

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Outbound' instead of 'Inbound' for incoming traffic.

Using 'Both' which is not a valid direction value.

The direction for inbound traffic must be set to "Inbound" to allow incoming HTTP requests.

2fill in blank

medium

Complete the code to create an outbound NSG rule blocking all traffic.

Azure

resource "azurerm_network_security_rule" "deny_all_outbound" {
  name                        = "Deny-All-Outbound"
  priority                    = 4096
  direction                   = "Outbound"
  access                      = "[1]"
  protocol                    = "*"
  source_port_range           = "*"
  destination_port_range      = "*"
  source_address_prefix       = "*"
  destination_address_prefix  = "*"
  network_security_group_name = azurerm_network_security_group.example.name
  resource_group_name         = azurerm_resource_group.example.name
}

Drag options to blanks, or click blank then click option'

ADeny

BAllow

CBlock

DReject

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Allow' which permits traffic.

Using 'Block' or 'Reject' which are not valid access values.

The access must be set to "Deny" to block outbound traffic.

3fill in blank

hard

Fix the error in the NSG rule direction to allow outbound SSH traffic on port 22.

Azure

resource "azurerm_network_security_rule" "allow_ssh_outbound" {
  name                        = "Allow-SSH-Outbound"
  priority                    = 200
  direction                   = "[1]"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "22"
  source_address_prefix       = "*"
  destination_address_prefix  = "*"
  network_security_group_name = azurerm_network_security_group.example.name
  resource_group_name         = azurerm_resource_group.example.name
}

Drag options to blanks, or click blank then click option'

AInbound

BOutbound

CIngress

DEgress

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Inbound' which blocks outgoing traffic.

Using 'Ingress' or 'Egress' which are not valid direction values in this context.

The direction must be "Outbound" to allow traffic leaving the resource on port 22.

4fill in blank

hard

Fill both blanks to create an NSG rule allowing inbound HTTPS traffic on port 443 from a specific IP.

Azure

resource "azurerm_network_security_rule" "allow_https_inbound_specific_ip" {
  name                        = "Allow-HTTPS-Inbound-Specific-IP"
  priority                    = 150
  direction                   = "[1]"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "443"
  source_address_prefix       = "[2]"
  destination_address_prefix  = "*"
  network_security_group_name = azurerm_network_security_group.example.name
  resource_group_name         = azurerm_resource_group.example.name
}

Drag options to blanks, or click blank then click option'

AInbound

BOutbound

C192.168.1.10/32

D0.0.0.0/0

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Outbound' direction which blocks incoming traffic.

Using '0.0.0.0/0' which allows all IPs instead of a specific one.

Inbound direction is needed for incoming traffic. The source IP must be the specific IP address to restrict access.

5fill in blank

hard

Fill all three blanks to create an NSG rule denying outbound traffic on port 25 (SMTP) to any destination.

Azure

resource "azurerm_network_security_rule" "deny_smtp_outbound" {
  name                        = "Deny-SMTP-Outbound"
  priority                    = 300
  direction                   = "[1]"
  access                      = "[2]"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "[3]"
  source_address_prefix       = "*"
  destination_address_prefix  = "*"
  network_security_group_name = azurerm_network_security_group.example.name
  resource_group_name         = azurerm_resource_group.example.name
}

Drag options to blanks, or click blank then click option'

AOutbound

BDeny

C25

DAllow

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Inbound' direction which blocks incoming traffic instead.

Using 'Allow' access which permits traffic.

Using wrong port number.

Outbound direction is for traffic leaving the network. Access must be 'Deny' to block it. Port 25 is the SMTP port to block.

Practice

1. What is the primary purpose of an Azure Network Security Group (NSG)?

easy

A. To store data securely in the cloud

B. To manage user identities and access

C. To control inbound and outbound network traffic to resources

D. To monitor application performance

Solution

1. Step 1: Understand NSG function

   NSGs are designed to filter network traffic to and from Azure resources.

2. Step 2: Compare options

   Only To control inbound and outbound network traffic to resources describes controlling inbound and outbound traffic, which matches NSG's role.

3. Final Answer:

   To control inbound and outbound network traffic to resources -> Option C

4. Quick Check:

   NSG controls traffic = B [OK]

Hint: NSG controls traffic flow, not data or users [OK]

Common Mistakes:

• Confusing NSG with storage or identity services
• Thinking NSG monitors performance
• Assuming NSG manages user access

2. Which of the following is the correct way to specify an inbound NSG rule to allow TCP traffic on port 80?

easy

A. Priority: 100, Direction: Inbound, Protocol: TCP, Port: 80, Action: Allow

B. Priority: 100, Direction: Inbound, Protocol: UDP, Port: 80, Action: Allow

C. Priority: 100, Direction: Outbound, Protocol: TCP, Port: 80, Action: Allow

D. Priority: 100, Direction: Inbound, Protocol: TCP, Port: 443, Action: Allow

Solution

1. Step 1: Identify direction and protocol

   The question asks for inbound TCP traffic on port 80, so Direction must be Inbound and Protocol TCP.

2. Step 2: Check port and action

   Port must be 80 and Action Allow to permit traffic.

3. Final Answer:

   Priority: 100, Direction: Inbound, Protocol: TCP, Port: 80, Action: Allow -> Option A

4. Quick Check:

   Inbound TCP port 80 allow = C [OK]

Hint: Inbound + TCP + port 80 + Allow = correct rule [OK]

Common Mistakes:

• Using outbound direction instead of inbound
• Using UDP protocol instead of TCP
• Specifying wrong port number

3. Given these NSG rules applied in order of priority:
1) Priority 100: Allow inbound TCP port 22 from 10.0.0.0/24
2) Priority 200: Deny inbound TCP port 22 from any
What will happen if a connection attempt comes from IP 10.0.0.5 on port 22?

medium

A. The connection is allowed because allow rule has higher priority

B. The connection is allowed because deny rules do not apply to private IPs

C. The connection is denied because default deny applies

D. The connection is denied because deny rule has higher priority

Solution

1. Step 1: Understand rule priority

   Lower priority number means higher priority. Priority 100 rule is evaluated before 200.

2. Step 2: Evaluate matching rules

   IP 10.0.0.5 matches allow rule at priority 100, so connection is allowed before deny rule is checked.

3. Final Answer:

   The connection is allowed because allow rule has higher priority -> Option A

4. Quick Check:

   Lower priority allow beats higher priority deny = D [OK]

Hint: Lower priority number rules apply first [OK]

Common Mistakes:

• Assuming deny always overrides allow
• Ignoring rule priority order
• Thinking private IPs bypass deny rules

4. You created an NSG rule to allow outbound HTTPS traffic on port 443, but traffic is still blocked. Which of the following is the most likely cause?

medium

A. The source IP address range is set to 0.0.0.0/0

B. The NSG rule is set to inbound instead of outbound

C. The protocol is set to UDP instead of TCP

D. There is a higher priority outbound deny rule blocking port 443

Solution

1. Step 1: Check rule priority and direction

   If traffic is blocked despite allow rule, a deny rule with higher priority likely blocks it.

2. Step 2: Evaluate other options

   Inbound vs outbound mismatch or protocol mismatch would cause no effect, but the question states rule exists for outbound HTTPS.

3. Final Answer:

   There is a higher priority outbound deny rule blocking port 443 -> Option D

4. Quick Check:

   Higher priority deny blocks traffic despite allow = A [OK]

Hint: Check for higher priority deny rules first [OK]

Common Mistakes:

• Ignoring rule priority order
• Confusing inbound and outbound directions
• Assuming source IP 0.0.0.0/0 blocks traffic

5. You want to allow inbound HTTP traffic only from a specific IP range 192.168.1.0/24 and deny all other inbound HTTP traffic. Which NSG rule configuration achieves this?

hard

A. Priority 100: Deny inbound TCP port 80 from any; Priority 200: Allow inbound TCP port 80 from 192.168.1.0/24

B. Priority 100: Allow inbound TCP port 80 from 192.168.1.0/24; Priority 200: Deny inbound TCP port 80 from any

C. Priority 100: Allow inbound TCP port 80 from any; Priority 200: Deny inbound TCP port 80 from 192.168.1.0/24

D. Priority 100: Deny inbound TCP port 80 from 192.168.1.0/24; Priority 200: Allow inbound TCP port 80 from any

Solution

1. Step 1: Allow specific IP range first

   Allow rule with higher priority (lower number) must permit traffic from 192.168.1.0/24.

2. Step 2: Deny all other IPs

   Deny rule with lower priority blocks all other inbound HTTP traffic.

3. Final Answer:

   Priority 100: Allow inbound TCP port 80 from 192.168.1.0/24; Priority 200: Deny inbound TCP port 80 from any -> Option B

4. Quick Check:

   Allow specific IP first, then deny others = A [OK]

Hint: Allow specific IP with lower priority number, deny others after [OK]

Common Mistakes:

• Placing deny rule before allow rule
• Allowing all IPs instead of specific range
• Using wrong priority numbers