Box 2 is Correct! - No! All of you guys saying that a Network Security Group (NSG) can be associated to a virtual network should be banned on taking this exam as you just misguide others. Please make some research before you decide to leave some worthless comment. “You can associate zero, or one, network security group to each virtual network subnet and network interface in a virtual machine. The same network security group can be associated to as many subnets and network interfaces as you choose.” References: https://docs.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works Note: It clearly says it must be either a subnet (not a virtual network) or a NIC.

should be all Yes. You can use an Azure network security group to filter network traffic to and from Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources. For each rule, you can specify source and destination, port, and protocol.

Answer is Y-Y-Y Please check reference link: https://learn.microsoft.com/en-us/answers/questions/1160561/azure-network-security-group-(nsg)-can-be-attached

ANS: Y Y Y Yes, you can associate a Network Security Group (NSG) to a Virtual Network (VNet) in Azure. Here are the steps to do it: Create an NSG if you haven’t already1. Open the NSG and select “Subnets” from the left navigation2. Click on the “Associate” button2. A new panel will open on the right side2. On the new panel, select the virtual network and the subnet inside that network that you want to associate the NSG to2. Please note that you can associate zero, or one, network security group to each virtual network subnet and network interface in a virtual machine3. The same network security group can be associated with as many subnets and network interface.

Boz 2 is No-- see below https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works

YNY. https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works "You can associate zero, or one, network security group to each virtual network subnet and network interface in a virtual machine. The same network security group can be associated to as many subnets and network interfaces as you choose."

Based on ChatGPT: he Azure Native Virtual Network (VNet) does not support directly associating Network Security Groups (NSGs) with the entire VNet. However, you can associate NSGs with individual subnets within the VNet to control network traffic at the subnet level. This way, you can effectively apply NSGs to a Virtual Network indirectly by configuring NSGs for its subnets.

correct answer is YNY Network Security Group (NSG) in Azure will block all network traffic by default. When you create a new NSG, there are no inbound or outbound security rules defined. This means that all inbound and outbound traffic to/from resources associated with the NSG is blocked. To allow traffic to flow, you need to create inbound and/or outbound security rules explicitly in the NSG. These rules define the type of traffic (such as TCP or UDP), the source and destination IP addresses and ports, and the action (allow or deny). It's important to note that NSGs are applied to subnets or network interfaces, not individual virtual machines. This means that all virtual machines associated with a subnet or network interface will be subject to the same NSG rules. Also, keep in mind that NSGs are stateful, which means that if you create an inbound security rule to allow traffic, the return traffic will be allowed automatically. You don't need to create a separate outbound security rule to allow the return traffic.

Yes, Yes, Yes from chatGPT

Yes, Yes, Yes

https://learn.microsoft.com/en-us/azure/virtual-network/media/network-security-group-how-it-works/network-security-group-interaction.png No is correct for 2nd option

checked with ChatGPT, should be YES YES YES

A network security group works like a firewall. You can attach a network security group to a virtual network and/or individual subnets within the virtual network. You can also attach a network security group to a network interface assigned to a virtual machine. You can use multiple network security groups within a virtual network to restrict traffic between resources such as virtual machines and subnets. You can filter network traffic to and from Azure resources in an Azure virtual network with a network security group. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources.Answer is YYS

YNY is the answer. https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works You can deploy resources from several Azure services into an Azure virtual network. For a complete list, see Services that can be deployed into a virtual network. You can associate zero, or one, network security group to each virtual network subnet and network interface in a virtual machine. The same network security group can be associated to as many subnets and network interfaces as you choose.

You can only attache NSG to subnet or Network interface. " You can associate zero, or one, network security group to each virtual network subnet and network interface in a virtual machine. The same network security group can be associated to as many subnets and network interfaces as you choose." https://docs.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works

some comments are missing The logic here. Assigning NSG to vnet cannot be done without specifying a subnet. Yes you will need to select a VNET but then you need to select a subnet. I am saying logic is missing here because eventually if you have two subnets in one VNET, attaching NSG will be done to only one of them, not to both (incase you are thinking of assigning the NSG to VNET) . The mentioned answer is correct YNY

All three are yes. You can associate zero, or one, network security group to each virtual network subnet and network interface in a virtual machine. The same network security group can be associated to as many subnets and network interfaces as you choose. https://docs.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works