Exam AZ-700 topic 14 question 1 discussion

2 Rules 1 Assignment Reminds me of an old video I once saw on the internet...

3 rules with lower priority for Rule3: 1) allow outbound TCP 443 from VMSS1 IPs, 2) allow inbound TCP 443 for VMSS2 - needed too, otherwise Rule 1 will not work, 3) deny all outbound TCP 443 from VMSS1 IPs - lower priority 1 assignment to the subnet

My 2 cents on this: 1 Custom Rule and 1 assignment Custome rule: Allow trafic from VMSS1 to VMSS2 on port 443. Assignment: NSG assigned to subnet since they reside inside the same subnet. Now the caveat... With each NSG we have a standard rule to ALLOW inbound Vnet communications. If you DENY that traffic you don't need to create another custom rule to deny the traffic within the subnet. Am I wrong ? Please

why not 1:1 ? 1 - assignment to just VMSS2 as "Network Security Groups can be applied directly to a scale set, by adding a reference to the network interface configuration section of the scale set virtual machine properties." 1 rule - block TCP/443 with source of subnet1 and deny. REST VNET's cidrs would be allowed by default. out of the scope of this question I guess but you could assign ASG to VMSS1 and use that as source in that single blocking rule assigned directly to VMSS2

To restrict traffic from VMScaleSet1 to VMScaleSet2 on TCP port 443, we need to create a custom NSG rule to allow traffic on port 443 and apply it to both VMScaleSet1 and VMScaleSet2. We also need to create a custom NSG rule to deny all traffic and apply it to VMScaleSet1. So the minimum number of custom NSG rules and NSG assignments required would be: 2 custom NSG rules: 1 to allow traffic on TCP port 443 and 1 to deny all traffic 2 NSG assignments: 1 for VMScaleSet1 and 1 for VMScaleSet2 Therefore, the answer is: Minimum number of custom NSG rules = 2 Minimum number of NSG assignments = 2 Note: It's important to note that we could potentially use an existing NSG that is already assigned to the virtual machines and add the necessary rules to it. In that case, the minimum number of NSG assignments would be 1.

Correct