Question

Your company runs a three-tier application in a single virtual network. The web tier has 8 VMs and the app tier has 6 VMs, and their IP addresses change frequently due to autoscaling. You must configure an NSG so that only the web-tier VMs can initiate connections to the app-tier VMs on port 8080, without hardcoding IP addresses and without creating a separate NSG rule per VM. What should you do?

Accepted Answer

Create two application security groups (ASGs), assign the web VMs' NICs to one and the app VMs' NICs to the other, then write one NSG rule using the ASGs as source and destination.

Answer

Assign static private IP addresses to all 14 VMs and create NSG rules referencing each IP address explicitly.

Answer

Place the web tier and app tier in separate subnets and create NSG rules that use the subnet address ranges as source and destination.

Answer

Create a user-defined route that forces web-tier traffic to the app tier through an Azure Firewall on port 8080.