Question

Contoso runs a three-tier application in a single virtual network. The web tier VMs must accept inbound HTTPS from the internet, and the app tier VMs must accept inbound TCP 8443 only from the web tier VMs. New web and app VMs are provisioned frequently by an autoscale process, and their private IP addresses change each time. You must design NSG rules that stay accurate as VMs are added or removed, without editing rules on each scaling event. What should you implement?

Accepted Answer

Create two Application Security Groups (asg-web and asg-app), assign VM NICs to the appropriate ASG, and write NSG rules that reference the ASGs as source and destination.

Answer

Create NSG rules that reference the web and app subnet address prefixes as source and destination, and reapply the NSG after every scaling event.

Answer

Use a service tag for the web tier as the source in the app tier NSG rule and the VirtualNetwork service tag as the destination.

Answer

Assign static private IP addresses to every VM and hard-code each address as a source in the NSG security rules.