Question
You have an Azure virtual network named VNet1 that contains three subnets named Subnet1, Subnet2, and Subnet3. A single network security group (NSG) named NSG1 is associated with all the subnets. You have the following virtual machines:
- VM1 on Subnet1
- VM2 on Subnet2
- VM3 on Subnet3
You create two application security groups named ASG1 and ASG2. VM2 is a member of ASG1, and VM3 is a member of ASG2.
You need to ensure that only VM2 can connect to VM3. The solution must continue to work if the private IP address of VM2 changes.
How should you configure the inbound rule on NSG1? To answer, drag the settings to the correct configurations. Each setting may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Explanation
The traffic starts at VM2, which is the only member of ASG1, so ASG1 is the source; it ends at VM3, the member of ASG2, so ASG2 is the destination. An NSG rule that references application security groups follows the network interfaces in the group rather than their addresses, so it keeps working if the private IP address of VM2 changes, which rules out the IP address settings. VirtualNetwork would match every VM in VNet1, including VM1. Because the default AllowVNetInBound rule permits traffic inside the virtual network, a lower-priority deny rule is also needed to stop other sources from reaching VM3.
