Exam AZ-103 All Questions

View all questions & answers for the AZ-103 exam

Exam AZ-103 topic 3 question 1 discussion

Actual exam question from Microsoft's AZ-103

Question #: 1
Topic #: 3

HOTSPOT -
You have an Azure subscription named Subscription1. Subscription1 contains a virtual machine named VM1.
You install and configure a web server and a DNS server on VM1.
VM1 has the effective network security rules shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer

Suggested Answer:

Box 1:
Rule2 blocks ports 50-60, which includes port 53, the DNS port. Internet users can reach the Web server, since it uses port 80.
Box 2:
If Rule2 is removed internet users can reach the DNS server as well.
Note: Rules are processed in priority order, with lower numbers processed before higher numbers, because lower numbers have higher priority. Once traffic matches a rule, processing stops. As a result, any rules that exist with lower priorities (higher numbers) that have the same attributes as rules with higher priorities are not processed.
References:
https://docs.microsoft.com/en-us/azure/virtual-network/security-overview

by awsnoob at March 23, 2020, 9:47 a.m.

Comments

Submit Cancel

Cloudyuga

Highly Voted 5 years, 1 month ago

It's correct answer ..When some try to connect Dns as rule having priority 900 it will resolve it and block. And when we delete this rule other rule 50-500 has both dns port 53 and web server 80 so it will allow both.

upvoted 8 times

...

gsbence

Highly Voted 5 years, 1 month ago

The question assumes that web servers are listening on default HTTP (TCP 80) and HTTPS (TCP 443) ports which is not necessarily the case. I really think they should give more clarity in the question. It also worth mentioning that UDP 53 is usually used for DNS client queries and on Windows 10 it doesn't fall back to TCP 53 (just tested it). TCP 53 is usually used for zone transfers.

upvoted 7 times

J4U

3 years, 11 months ago

You are correct. Only web server is accessible from internet through Rule 1 in both case. Irrespective of rule 2 is available or not, UDP 53 isn't available to query DNS from internet.

upvoted 2 times

...

tashakori

Most Recent 1 year, 3 months ago

Given answer is correct

upvoted 1 times

...

walexkino

4 years, 2 months ago

came out in exam

upvoted 1 times

Varshathvar

4 years, 2 months ago

Answers plz!

upvoted 2 times

...

samatar

4 years, 5 months ago

Answers are correct

upvoted 1 times

...

networkingcontrol

4 years, 6 months ago

The key point here: "Rules with small (meaning higher priority) values are processed before rules with larger (meaning lower priority) values."

upvoted 1 times

...

jjkidd72

4 years, 10 months ago

Some things to think about here; 1. 'Internet' users being 'outside users' trying to access (incoming traffic) your Web (Internet Server/Site) / DNS Server. 2. I saw no mention of NSG order of processing Rules. "A number between 100 and 4096. Rules are processed in priority order, with lower numbers processed before higher numbers, because lower numbers have higher priority. Once traffic matches a rule, processing stops. As a result, any rules that exist with lower priorities (higher numbers) that have the same attributes as rules with higher priorities are not processed." That said, I believe the given answers are correct.

upvoted 4 times

Aki_Aeshan

4 years, 8 months ago

If the the term internet users refers to outside users, well... given answers here are correct. 1. DNS port is blocked by rule2 - then only port 80 is accessible to use. 2. Deleting rule2 which blocking DNS port - means both web port 80 which is not block and unblocking DNS port by deleting rule2 - means both web and DNS are accessible. If the term internet users refer to outside users.

upvoted 1 times

...

manishkhare

4 years, 10 months ago

Answers are not correct: - Sceario1 Rule1 blocks DNS and Outgoing rule blocks Web server port .So internet users cannot access either DNS or WEB Scenario 2: Only DNS can be accessed.

upvoted 3 times

Gbala

4 years, 10 months ago

the question is about the inbound internet traffic and not the outgoing.. The given answers are correct..

upvoted 2 times

...

Achilles81

4 years, 9 months ago

Agree on this explanation. No internet user can get a response back if outbound is blocked.

upvoted 1 times

...

sidharthwader

4 years, 2 months ago

Do you know outbound has access to internet by default ? We need to add only inbound rules to configure access to internet. You are wrong Answers are right

upvoted 2 times

...

krst

4 years, 11 months ago

Answer stated is correct: DNS uses port 53/TCP for zone transfers and 53/UDP for lookups. As port 50-60 ANY (=TCP and UDP) protocol is denied by Rule2. DNS server wil not work. Webserver (port 80/TCP and port 443/TCP) will work as Rule1 allows this. If Rule2 is removed, DNS server will also work. (Rule3 is irrelevant.)

upvoted 2 times

J4U

3 years, 11 months ago

How will DNS work by removing deny rule. There is no allow rule for UDP 53.

upvoted 2 times

...

Shades

4 years, 11 months ago

Came in exam 1st Aug 2020

upvoted 5 times

Banaben

4 years, 10 months ago

did you answer the same answer? stupid question, but did you pass? I know you might have answered it wrong and passed thought, but just wanted to know :)

upvoted 2 times

...

Gizdagyerek

4 years, 11 months ago

TCP 53 is only for zone transfers for DNS servers. UDP 53 for name resolution for "users". Whoever created this question, he/she was clearly not aware of that. Strictly speaking, provided answer is wrong.

upvoted 1 times

Gizdagyerek

4 years, 10 months ago

But since there is no better answer, we have to live with the provided one.

upvoted 1 times

...

JimD79

4 years, 12 months ago

Not the best question, technically you can access both directly through 3389 but I don't think that is what they are asking. I think they are talking about direct ports 80 and 53 in which case, answer is correct. Protocol = ANY (TCP/UDP/ICMP)

upvoted 2 times

...

it115

5 years ago

Inbound NSG rule will block DNS but will allow port 80 or 443 whichever port for webserver to work. Outbound rule will block port 80. If a user initiates a conection (incoming) to the webserver he gets connected but however a rule exists to prevent port 80 from going out. My guess is user cannot access DNS or webserver. Someone please clarify.

upvoted 2 times

paulosrsf

4 years, 11 months ago

Users on the internet can access only the webserver. The outgoing rule that blocks port 80 only affects the server if it initiates an internet access. For exemple, an admin user logged on the server, trying to reach the internet. The webservers doesn't send traffic on the port 80 or 443, they only listen.

upvoted 3 times

...

Sitender

5 years ago

given answers are correct

upvoted 3 times

exammood15

5 years ago

The outbound port 80 is blocked, so how he will get the webpage from web server. Considering the available options provided answers are correct

upvoted 2 times

kopper2019

5 years ago

does not matter if port 80 is blocked web server will respond I just tested and works

upvoted 1 times

...

macco455

5 years ago

Given answer is correct

upvoted 3 times

...

bella

5 years, 1 month ago

we also need to assume we are using IP addresses as opposed to hostnames as DNS wouldn't be resolving anything which also could change answer 1 to none of those services DNS nor HTTP unless like I said they are using IP addresses instead. Hard to tell.

upvoted 1 times

...

nfett

5 years, 1 month ago

dns uses udp for look ups. zone transfers are done over tcp. question is vague in that but the assumption is that they are looking for an dns lookup as thats what the general public will gravitate towards on this question,

upvoted 1 times

...

Load full discussion...