Configuring NSG Rules with Application Security Groups
Short answer
Source: ASG1; Destination: ASG2; Action: Allow
Question
You have an Azure virtual network named VNet1 that contains three subnets named Subnet1, Subnet2, and Subnet3. A single network security group (NSG) named NSG1 is associated with all the subnets. You have the following virtual machines:
VM1 on Subnet1
VM2 on Subnet2
VM3 on Subnet3
You create two application security groups named ASG1 and ASG2. VM2 is a member of ASG1, and VM3 is a member of ASG2.
You need to ensure that only VM2 can connect to VM3. The solution must continue to work if the private IP address of VM2 changes.
How should you configure the inbound rule on NSG1? To answer, drag the settings to the correct configurations. Each setting may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Key Takeaways
The main trap is using static IP addresses instead of ASGs; ASGs automatically resolve IPs, ensuring rules remain valid after VM reconfiguration.
Learn how to configure Azure Network Security Group inbound rules using Application Security Groups to maintain access policies when virtual machine IP addresses change dynamically.
Common mistake: Selecting the specific private IP address of VM3 as the destination instead of ASG2, which fails to leverage the dynamic resolution benefits required for scalable management.
Expert Analysis
Source Selection: Application Security Groups (ASGs) To satisfy the requirement that the rule must persist despite IP changes, you must use an Application Security Group for the source. The scenario specifies VM2 is a member of ASG1. By selecting ASG1 as the source, Azure dynamically resolves the private IP addresses associated with that group. This eliminates the need to manually update the NSG rule whenever VM2 receives a new IP address from DHCP or through reconfiguration.
Destination Selection: Specificity and Logic The destination must be set to ASG2. While VM3 is currently the only member of ASG2, using the ASG tag ensures the rule targets the correct logical group. Although one might argue that specifying VM3's specific IP would also work if it never changed, the prompt implies a managed environment where dynamic resolution is preferred for scalability and maintenance. More importantly, the solution requires defining the relationship between the two groups. Setting the source to ASG1 and the destination to ASG2 creates the necessary boundary.
Action: Allow The goal is to permit connectivity. Therefore, the action must be set to "Allow". If this were denied, VM2 would be blocked from reaching VM3, contradicting the requirement.
Operational Consequence Failing to use ASGs for the source forces administrators to constantly monitor IP changes and update NSG rules, leading to potential downtime or security gaps during transitions. Using ASGs automates this mapping, ensuring continuous compliance and access.
Common Trap Learners often select the specific private IP address of VM3 as the destination, thinking it is more precise. However, in dynamic cloud environments, relying on static IPs is fragile. The key insight is that ASGs allow you to manage security based on application roles rather than network topology.
Official Reference
https://learn.microsoft.com/en-us/azure/virtual-network/application-security-groups
This link opens the official vendor documentation in a new tab.
Exam Strategy
When configuring NSG rules in exam scenarios, always check if the question mentions 'dynamic IP', 'DHCP', or 'changing addresses'. If so, prioritize Application Security Groups (ASGs) for sources or destinations over specific IP addresses to ensure the solution remains robust without manual intervention.
Frequently Asked Questions
Why not use the private IP of VM3 as the destination?
Can I use ASG1 as both source and destination?
Discussion 2 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 2
-
Eltooth 👍 4Source: ASG1 (contains VM2) Destination: ASG2 (contains VM3) Action: Allow Dynamic IP Resolution: By assigning ASG1 as the source, Azure dynamically maps VM2's network interface card (NIC) to the rule. If VM2's private IP changes, Azure updates the underlying security rules automatically without manual intervention. Granular Target Enforcement: By setting the destination to ASG2, the inbound rule specifically isolates traffic targeting VM3, while keeping it separate from the other subnets and virtual machines on the same VNet.
-
mniyas 👍 1why the destination is not IP address of VM3? Here the condition is only the private Ip address changes of VM2 must not impact the rule. in that case source ASG1 is correct but destination can be ASG2 or IP address of VM3 right?
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →