Exam AZ-104 topic 5 question 90 discussion

Answer is correct . No, Yes, Yes. No: VM1 has default rules which denies any port open for inbound rules Yes: VM2 has custom rule allowing RDP port Yes: VM1 and VM2 are in the same Vnet. by default, communication are allowed

Correct Answer: Box 1: No NSG1 has default rules, which denies any port open for inbound rules Box 2: Yes NSG2 has custom Rule1, allowing RDP port 3389 with TCP. Box 3: Yes VM1 and VM2 are in the same Vnet. By default, communication is allowed.

Answer is correct, N/Y/Y (1)VM with no attached NSG: all in and all out (2)VM with attached NSG but with no custom rule: follow the default rule, vNet/LB in but no internet in, all out (3)VM with attached NSG and custom rule: evaluate custom rule first

Default NSG rule for SUBNET 65000 AllowVnetInBound VirtualNetwork Any Any Allow so VNET > VNET RDP is allowed by default IF NSGs are applied to Subnet. If applied to NIC - you need manually add a rule. subtle!

For me is, explaneid below : NO: VM1 is affected by NSG1 at subnet level, since NSG has no rules, the implicit deny all by default at the end applies here, so basically any traffic regarding subnet1 is blocked by NSG1 YES: VM2 is affected by NSG2 at NIC level , NSG2 allows dstport 3389 so yes NO: VM1 is affected by NSG1 at subnet level, NSG1 has no rules, the implicit deny all by default at the end applies here, so no traffic can flow at subnet level, you need to go from VM1, through subnet1, in order to arrive to the other subnet subnet2 and finally the VM2, so NO. For people stating that inside VNET traffic is allowed by default, is true, but that changes whenever you begin pushing NSG which by default blocks everything at the end , and need to include some rules to allow specific traffic REF: https://docs.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works

For me is, explaneid below : NO: VM1 is affected by NSG1 at subnet level, since NSG has no rules, the implicit deny all by default at the end applies here, so basically any traffic regarding subnet1 is blocked by NSG1 YES: VM2 is affected by NSG2 at NIC level , NSG2 allows dstport 3389 so yes NO: VM1 is affected by NSG1 at subnet level, NSG1 has no rules, the implicit deny all by default at the end applies here, so no traffic can flow at subnet level, you need to go from VM1, through subnet1, in order to arrive to the other subnet subnet2 and finally the VM2, so NO. For people stating that inside VNET traffic is allowed by default, is true, but that changes whenever you begin pushing NSG which by default blocks everything at the end , and need to include some rules to allow specific traffic

No Yes No

Got this question on 20/03/24

Got this question on 20/03/24

Given answer is correct

Chat GPT said, "Yes, you can connect to VM1 by using Remote Desktop from the Internet. This is because VM1 uses a public IP address and allows inbound Remote Desktop connections. Additionally, the network security group (NSG) associated with the subnet of VM1 allows incoming traffic on TCP port 3389, which is the port used by Remote Desktop Protocol (RDP). However, please note that while this setup allows RDP connections, it’s crucial to secure such connections due to potential security risks. Always ensure you’re following best practices for security." Is this answer wrong? ChatGPT says 1st one is YES

No, No, Yes For second question, nsg2 is associated with NIC not subnet. The request will be blocked by subnet. For incoming traffic, the request is first processed by subnet and then by NIC

This was on my exam. The suggested answer to the question is correct.

Default Inbound Security Rules: AllowVNetInBound: Priority: 65000 Allows all inbound traffic from resources in the same Virtual Network (VNet). Source: VirtualNetwork Destination: VirtualNetwork Source and Destination Port Ranges: Any Protocol: Any Action: Allow

I have tested today with score 870 most of question came from ET question and be carful for wrong answers from the site and try to understand the solution not suppose most voted answers is the correct answers

There are 2 NSG. NSG1 applied to subnet 1. NSG2 apply to VM2. For a host is subnet 1 to accept traffic from Internet, both Subnet NSG and NIC NSG should allow traffic. - VM1 is in subnet 1 and it doesn't have a NIC associated NSG, so subnet NSG1 applies which denies Inbound Internet traffic by default. Answer No. - VM2 is in subnet 2, which doesn't have an associated subnet NSG and has NSG2 applied to the VM. NSG2 allows traffic RDP traffic from anywhere, so RDP connection is possible. Answer Yes. - Same policy as before (Source=Any), then VM1 can RDO to VM2. Answer Yes. https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works

No : NSG1 restricts RDP to Subnet1/VM1. Default NSG denies all inbound Yes: NSG2 Rule1 allows this. Since Subnet2 has no NSG and VM2 is in Subnet2, NSG2 only applies Yes: allowed by default