Task 4.2: Configure secure access to virtual networks

• ADenied, because the priority 200 rule is processed first

  Correct

  Lower numbers have higher priority, and processing stops at the first match, which is the deny at 200.

• BAllowed, because the more specific source range wins

  Incorrect

  NSGs don't pick the most specific rule; they process rules in priority order.

• CAllowed, because allow rules are evaluated before deny rules

  Incorrect

  Allow and deny rules are treated alike; only the priority number orders them.

• DDenied, because the default DenyAllInBound rule takes over

  Incorrect

  DenyAllInBound at 65500 is reached only when nothing matches earlier; here the deny at 200 matches first.

Each rule has a priority from 100 to 4096, processed from lowest to highest. When traffic matches a rule, processing stops, so a broad deny at a lower number shadows a narrower allow at a higher number.

• AEach ASG can contain the NICs of one subnet

  Incorrect

  An ASG can hold NICs from several subnets; the limit is about the virtual network.

• BThe NSG with the rule must be associated with each NIC

  Incorrect

  The rule can sit in an NSG on the subnet or the NIC; it doesn't have to be on each NIC.

• COne rule can't name ASGs as both its source and its destination

  Incorrect

  A rule can name ASGs on both ends; the condition is that their NICs share a virtual network.

• DThe NICs in both ASGs must be in the same virtual network

  Correct

  With ASGs as both source and destination, the NICs in both groups must exist in the same virtual network.

ASGs let rules target groups of NICs instead of IP addresses, so new VMs just join the group. All NICs in an ASG must be in the same virtual network as the first NIC, and a rule that uses ASGs on both ends needs both in one virtual network.

• AIt's named AzureBastionSubnet

  Correct

  Every Bastion SKU except Developer needs a dedicated subnet with exactly this name.

• BIt has an NSG that allows TCP 3389 from the internet

  Incorrect

  Users reach Bastion over HTTPS 443 through the portal; opening RDP to the internet is what Bastion avoids.

• CIts prefix is /26 or larger

  Correct

  Bastion resources deployed since November 2021 need an AzureBastionSubnet of /26 or larger.

• DIt has a route table that sends 0.0.0.0/0 to a firewall

  Incorrect

  User-defined routes aren't supported on the Bastion subnet, so a route table is no part of what it requires.

• EIt's delegated to Microsoft.Network/bastionHosts

  Incorrect

  Subnet delegation isn't part of the Bastion setup; the subnet name and size are what it requires.

Azure Bastion (except the Developer offering) deploys into a dedicated subnet named AzureBastionSubnet with a /26 or larger prefix, and needs a Standard, static public IP unless it's private-only.

• AA service endpoint for Microsoft.Storage on the VMs' subnet

  Incorrect

  A service endpoint changes the route to the public endpoint; it doesn't make the name resolve to the private endpoint.

• BA private DNS zone named blob.core.windows.net linked to VNet-App

  Incorrect

  Overriding the whole public zone would break name resolution for every other storage account; the zone to use is the privatelink one.

• CA private DNS zone privatelink.blob.core.windows.net linked to VNet-App

  Correct

  The public name is a CNAME to the privatelink name, so the linked zone with the endpoint's A record returns the private IP.

• DA custom DNS server set on VNet-App pointing at 168.63.129.16

  Incorrect

  That address is already the Azure-provided resolver, so the setting changes nothing.

Private endpoints rely on DNS. Create the private DNS zone privatelink.blob.core.windows.net with an A record for the endpoint and link it to the virtual network; the public name then resolves through the CNAME to the private IP.

• AAllow 3389 from Internet

  Incorrect

  That opens RDP to the world.

• BAllow 3389 from 10.0.1.0/26

  Correct

  Bastion connects to VMs from its subnet's private addresses, so allow RDP from that range only.

• CAllow 443 from GatewayManager

  Incorrect

  That rule doesn't open RDP to the VMs at all.

• DAllow 3389 from VirtualNetwork

  Incorrect

  VirtualNetwork would let any host in the network or peered networks use RDP.

Bastion reaches target VMs over their private IPs from its own subnet. A rule allowing RDP or SSH from that subnet's range, ahead of a deny, keeps direct RDP closed.

• AInbound rules must use odd numbers

  Incorrect

  There's no such rule.

• BCustom rules take priorities from 100 to 4096

  Correct

  Custom rule priorities run from 100 to 4096; default rules use 65000 and up.

• CPriorities must be multiples of 100

  Incorrect

  Any whole number in range is allowed.

• DPriority 5000 is reserved for service tags

  Incorrect

  There's no reserved priority for service tags.

Custom NSG rules use priorities 100 to 4096. The default rules sit at 65000, 65001 and 65500, outside that range.

• AA service endpoint for Microsoft.Storage

  Incorrect

  A service endpoint uses the public endpoint over the backbone, not a private IP.

• BThe file subresource added to the existing blob private endpoint

  Incorrect

  A private endpoint has a single target subresource; another storage service can't be added to it.

• CA second private endpoint for the file subresource

  Correct

  Each private endpoint targets one subresource, so Files needs its own endpoint.

• DNothing; the blob endpoint covers Files after a restart

  Incorrect

  The blob endpoint doesn't carry file traffic.

Private endpoints connect to a specific target subresource such as blob, file, queue or dfs, and each storage service you need to reach privately gets its own private endpoint.

• ABoth apply, the newer one first

  Incorrect

  Order isn't the issue; only one association is allowed.

• BA subnet can be associated with one NSG at a time

  Correct

  Each subnet and each NIC can have zero or one NSG associated.

• CBoth apply, and their rules are merged

  Incorrect

  A subnet takes a single NSG.

• DThe second NSG replaces the rules that overlap

  Incorrect

  There's no partial replacement; association is one NSG.

Associate one NSG per subnet and one per NIC. Combine rules in one NSG, or use the subnet NSG plus a NIC NSG.