networkSingle choice
Web servers and database servers are deployed to the same subnet. IP addresses change frequently. You need to configure an NSG rule so that only the web servers can connect to the database servers on TCP 1433. The solution must minimize administrative effort. What should you use as the source and destination of the rule?
فيه Web servers و Database servers متنشرين في نفس الـ Subnet، والـ IP addresses بتتغير كتير. محتاج تعمل NSG rule بحيث الـ Web servers بس هما اللي يقدروا يوصلوا للـ Database servers على TCP 1433، والحل لازم يقلل المجهود الإداري. تستخدم إيه كـ Source و Destination في القاعدة؟
- AService tags
- BApplication security groups
- CA separate subnet for each server
- DThe VirtualNetwork service tag
Why: Application security groups let you group VM NICs by role (asg-web, asg-db) and reference those groups in NSG rules instead of IP addresses, so IP changes require no rule changes. Service tags represent Azure service address ranges, not your own VMs. Separate subnets per server would work but is a large administrative burden. The VirtualNetwork tag covers the entire VNet, so it can't restrict access to the web tier only — and remember to add a Deny for other sources because the default AllowVnetInBound allows all VNet traffic.
Exam skills it covers
- Create and configure network security groups (NSGs) and application security groups