AZ-104 Practice Question 9: NSG Rule Priority Evaluation
Microsoft Azure Administrator Associate (AZ-104) · Test 1 · question 9 of 10
The subnet snet-web is associated with a network security group that contains one custom inbound rule, Deny-Internet-In (priority 200, source Internet, any port, protocol Any, Deny). To publish a new site you add a second inbound rule, Allow-HTTPS-In (priority 300, source Internet, destination port 443, TCP, Allow).
After the change, external clients still cannot reach the site on port 443. Nothing else in the environment changed. What should you do to allow the traffic?
Show answer and explanation
Answer:
Network security group rules are processed in priority order, and a lower number means a higher priority. Once traffic matches a rule, processing stops. An inbound HTTPS packet from the internet matches Deny-Internet-In at priority 200 first, so it is dropped and Allow-HTTPS-In at 300 is never evaluated. Giving the allow rule a smaller number, any value from 100 to 199, makes it match first, and the broad deny then continues to catch everything else.
Option A is not possible, and would not help. The default rules cannot be removed; they can only be overridden by custom rules with a higher priority (a lower number). DenyAllInBound at 65500 is also not what is blocking this traffic; the custom rule at 200 is.
Option B misunderstands NSG statefulness. Network security groups are stateful: because a flow record is created for the allowed inbound connection, the response is permitted automatically with no matching outbound rule. Flipping the direction removes the inbound allow entirely.
Option D does not bypass the problem. When a subnet NSG and a NIC NSG both apply, inbound traffic is evaluated against the subnet's NSG first and then the NIC's, and both must allow the traffic. The subnet's deny rule would still drop the packet before the NIC rules were consulted.
Reference: Network security groups overview