networkSingle choice
NSG1 is associated with the subnet of a web server and contains the following inbound rules: Priority 200 — DenyHTTP — Source: Internet — TCP 80 — Deny Priority 300 — AllowHTTP — Source: Internet — TCP 80 — Allow Users on the internet cannot reach the web server on port 80. You need to allow the traffic. The DenyHTTP rule must NOT be deleted or modified. What should you do?
الـ NSG1 مربوط بالـ Subnet بتاع Web server، وفيه الـ Inbound rules دي: Priority 200 — DenyHTTP — Source: Internet — TCP 80 — Deny Priority 300 — AllowHTTP — Source: Internet — TCP 80 — Allow المستخدمين على الإنترنت مش قادرين يوصلوا للـ Web server على بورت 80. محتاج تسمح بالترافيك ده، وممنوع تمسح أو تعدّل قاعدة DenyHTTP. تعمل إيه؟
- AChange the priority of AllowHTTP to 150.
- BChange the priority of AllowHTTP to 4096.
- CCreate an outbound rule that allows TCP 80.
- DAssociate a second NSG that allows TCP 80 to the subnet.
Why: NSG rules are evaluated in priority order, lowest number first, and processing stops at the first match. DenyHTTP (200) matches before AllowHTTP (300), so the traffic is denied. Giving AllowHTTP priority 150 makes it match first without touching DenyHTTP. Priority 4096 would make it evaluate even later. An outbound rule isn't needed because NSGs are stateful — return traffic is allowed automatically. A subnet can have only one NSG, so you can't associate a second one.
Exam skills it covers
- Evaluate effective security rules in NSGs