Exam AZ-104 topic 5 question 90 discussion

Answer is correct . No, Yes, Yes. No: VM1 has default rules which denies any port open for inbound rules Yes: VM2 has custom rule allowing RDP port Yes: VM1 and VM2 are in the same Vnet. by default, communication are allowed

Correct Answer: Box 1: No NSG1 has default rules, which denies any port open for inbound rules Box 2: Yes NSG2 has custom Rule1, allowing RDP port 3389 with TCP. Box 3: Yes VM1 and VM2 are in the same Vnet. By default, communication is allowed.

Answer is correct, N/Y/Y (1)VM with no attached NSG: all in and all out (2)VM with attached NSG but with no custom rule: follow the default rule, vNet/LB in but no internet in, all out (3)VM with attached NSG and custom rule: evaluate custom rule first

Default NSG rule for SUBNET 65000 AllowVnetInBound VirtualNetwork Any Any Allow so VNET > VNET RDP is allowed by default IF NSGs are applied to Subnet. If applied to NIC - you need manually add a rule. subtle!

CORRECT..

CORRECT

CORRECT

For me is, explaneid below : NO: VM1 is affected by NSG1 at subnet level, since NSG has no rules, the implicit deny all by default at the end applies here, so basically any traffic regarding subnet1 is blocked by NSG1 YES: VM2 is affected by NSG2 at NIC level , NSG2 allows dstport 3389 so yes NO: VM1 is affected by NSG1 at subnet level, NSG1 has no rules, the implicit deny all by default at the end applies here, so no traffic can flow at subnet level, you need to go from VM1, through subnet1, in order to arrive to the other subnet subnet2 and finally the VM2, so NO. For people stating that inside VNET traffic is allowed by default, is true, but that changes whenever you begin pushing NSG which by default blocks everything at the end , and need to include some rules to allow specific traffic REF: https://docs.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works

For me is, explaneid below : NO: VM1 is affected by NSG1 at subnet level, since NSG has no rules, the implicit deny all by default at the end applies here, so basically any traffic regarding subnet1 is blocked by NSG1 YES: VM2 is affected by NSG2 at NIC level , NSG2 allows dstport 3389 so yes NO: VM1 is affected by NSG1 at subnet level, NSG1 has no rules, the implicit deny all by default at the end applies here, so no traffic can flow at subnet level, you need to go from VM1, through subnet1, in order to arrive to the other subnet subnet2 and finally the VM2, so NO. For people stating that inside VNET traffic is allowed by default, is true, but that changes whenever you begin pushing NSG which by default blocks everything at the end , and need to include some rules to allow specific traffic

No Yes No

Got this question on 20/03/24

Got this question on 20/03/24

Given answer is correct

Chat GPT said, "Yes, you can connect to VM1 by using Remote Desktop from the Internet. This is because VM1 uses a public IP address and allows inbound Remote Desktop connections. Additionally, the network security group (NSG) associated with the subnet of VM1 allows incoming traffic on TCP port 3389, which is the port used by Remote Desktop Protocol (RDP). However, please note that while this setup allows RDP connections, it’s crucial to secure such connections due to potential security risks. Always ensure you’re following best practices for security." Is this answer wrong? ChatGPT says 1st one is YES

No, No, Yes For second question, nsg2 is associated with NIC not subnet. The request will be blocked by subnet. For incoming traffic, the request is first processed by subnet and then by NIC

This was on my exam. The suggested answer to the question is correct.

Default Inbound Security Rules: AllowVNetInBound: Priority: 65000 Allows all inbound traffic from resources in the same Virtual Network (VNet). Source: VirtualNetwork Destination: VirtualNetwork Source and Destination Port Ranges: Any Protocol: Any Action: Allow