Question

A subnet hosts several web servers, protected by a network security group (NSG) named nsg-web. You add the following custom inbound rules: Rule 'Allow-HTTP' priority 300 allows TCP 80 from any source; Rule 'Deny-Subnet-A' priority 200 denies TCP 80 from source 10.0.5.0/24; Rule 'Allow-Mgmt' priority 100 allows TCP 3389 from 10.0.10.5. A management server at 10.0.10.5 needs to reach the web servers over HTTP (port 80), while all HTTP traffic from 10.0.5.0/24 must be blocked. A host at 10.0.5.20 attempts to connect to a web server on TCP 80. What happens, and why?

Accepted Answer

The connection is denied because rule 'Deny-Subnet-A' (priority 200) is evaluated before 'Allow-HTTP' (priority 300).

Answer

The connection is allowed because 'Allow-HTTP' explicitly permits TCP 80 from any source.

Answer

The connection is denied because 'Allow-Mgmt' (priority 100) only permits 10.0.10.5 and blocks all other sources.

Answer

The connection is allowed because lower-numbered priorities are evaluated last, so 'Allow-HTTP' wins.