Question

Contoso runs a three-tier application in a single subnet: 6 web VMs, 4 application VMs, and 3 database VMs. Security requires that only web VMs can reach the application VMs on TCP 8080, and only application VMs can reach the database VMs on TCP 1433. The subnet may grow with additional VMs of each tier over time. You must minimize the number of NSG rules and avoid maintaining explicit IP address lists as VMs are added. What should you implement?

Accepted Answer

Create three Application Security Groups (asg-web, asg-app, asg-db), assign each VM's NIC to the appropriate ASG, and write NSG rules that reference the ASGs as source and destination.

Answer

Create separate subnets for each tier and write NSG rules using each subnet's address prefix as source and destination.

Answer

Create NSG rules that list the individual private IP addresses of the VMs in each tier as source and destination, updating the lists whenever a VM is added.

Answer

Assign a service tag to each tier of VMs and reference the service tags in the NSG inbound rules.