Network Access Control Lists (NACLs) and Network Security Groups (NSG) CSE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company is migrating a legacy application to the cloud. The application requires that a specific set of IP addresses (from a partner) be able to access a management interface on a VM. The security team wants to ensure that even if the VM's OS firewall is compromised, the network layer still blocks unauthorized access. They also want to minimize the number of rules to manage. Which approach should they take?

   • AConfigure a single NSG on the subnet that includes allow rules for the partner IPs and deny rules for all other traffic.
   • BConfigure both a NACL on the subnet and an NSG on the VM's network interface, each with allow rules for the partner IPs on the management port and appropriate deny rules.
   • CConfigure an NSG on the VM's network interface with an allow rule for the partner IPs on the management port, and a deny-all rule with a lower priority.
   • DConfigure a NACL on the subnet with an allow rule for the partner IPs on the management port, and a deny-all rule with a higher rule number.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A security team wants to implement defense-in-depth for a subnet containing web servers. Which combination of network security controls is a best practice?

   • AApply a NACL at the subnet level and NSGs on each web server's network interface.
   • BUse only NACLs to filter traffic at the subnet level.
   • CUse only NSGs on each web server's network interface.
   • DDisable all network security to maximize performance.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the default behavior of an NSG when no rules match?

   • AAllow all traffic
   • BDeny all traffic
   • CAllow only traffic from the same subnet
   • DLog the traffic and allow it
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team is implementing a defense-in-depth strategy for a three-tier application. They want to ensure that even if an NSG is misconfigured on a particular instance, the subnet-level controls still prevent unauthorized traffic. Which approach best achieves this?

   • AConfigure only NACLs on the subnets, and do not use NSGs, to reduce the attack surface.
   • BConfigure NACLs on each subnet to allow only the necessary traffic between tiers, and configure NSGs on each instance to enforce the same rules at the resource level.
   • CConfigure only NSGs on the instances, and do not use NACLs, because NSGs are stateful and more secure.
   • DConfigure NSGs on each subnet to allow only the necessary traffic between tiers, and configure NACLs on each instance to enforce the same rules.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   At which level are NACLs typically applied?

   • ASubnet level
   • BVirtual machine level
   • CRegion level
   • DNetwork interface (NIC) level
   Reveal Solution Discussion Select an answer first