Explanation:

Based on the information provided in the images about the network security groups (NSGs), the rules within NSG1, and the virtual machines’ subnet assignments, we can determine the connectivity between the VMs.

NSG1 is associated with Subnet1 and has the following custom inbound rules:

Priority 101: Allow port 80 from any source.

Priority 150: Allow port 443 from any source.

Priority 200: Deny all traffic from the virtual network.

NSG2, associated with Subnet2, has only the default rules, which generally allow communication within the VNet and deny all inbound traffic from other sources unless specifically allowed by a rule.

VM1 and VM2 are in Subnet1, and VM3 is in Subnet2.

With this setup, here are the answers to the connectivity statements:

VM3 can connect to port 8080 on VM1.

Answer. No. VM1 is in Subnet1, which has NSG1 with a rule that denies all traffic from the virtual network (priority 200). Since there is no rule allowing port 8080, VM3 (which is in Subnet2) cannot connect to VM1 on port 8080.

VM1 and VM2 can connect on port 9090.

Answer. No. Both VM1 and VM2 are in Subnet1, which has NSG1 applied to it. NSG1 has a deny all rule for the virtual network traffic (priority 200), so even though they are in the same subnet, the NSG rule will block communication on port 9090.

VM1 can connect to VM3 on port 9090.

Answer. No. VM3 is in Subnet2, which is subject to NSG2’s default rules. The default rules of NSG2 would block inbound traffic from other subnets unless a specific rule is created to allow it. Additionally, NSG1 would block outbound traffic to the virtual network, so VM1 cannot initiate a connection to VM3 on port 9090.

Explanation:

To restrict traffic from VMScaleSet1 to VMScaleSet2, Network Security Group (NSG) rules need to be created and assigned to the appropriate resources. An NSG rule is required to allow or deny traffic to or from a network interface (NIC), VM, or subnet.

Based on the requirement to only allow traffic from VMScaleSet1 to VMScaleSet2 on TCP port 443, the following can be determined:

Minimum number of custom NSG rules:

You need at least one rule to allow TCP port 443 and another to deny all other traffic that does not match any prior rules. However, because NSGs have default rules that deny all inbound traffic if no other rule allows it, you might only need to create a single rule to allow traffic on TCP port 443. But to be fully explicit and depending on the existing rules, you might also add a deny rule explicitly. So, the minimum number could be 1 (if relying on default rules) or 2 (if being explicit).

Minimum number of NSG assignments:

For NSG assignments, you would typically assign an NSG to the subnet or network interfaces of VMScaleSet2 to control the inbound traffic from VMScaleSet1. Since all VM instances in a scale set can share a single NSG, you only need to make one assignment of the NSG to cover all instances of VMScaleSet2. Therefore, the minimum number of NSG assignments is 1.

So, for the given scenario:

The minimum number of custom NSG rules required: 1 (to allow TCP port 443, assuming default rules handle the deny)

The minimum number of NSG assignments required: 1 (assign the NSG to the subnet or NICs of VMScaleSet2)

These selections are made with the assumption that the goal is to enforce the minimum necessary configuration changes while still satisfying the requirements.

Explanation:

Box 1: No

The manual DNS record will overwrite the auto-registered DNS record so VM1 will resolve to 10.1.10.9.

Box 2: No

The DNS record for VM1 is now a manually created record rather than an auto-registered record.

Only auto-registered DNS records are deleted when a VM is deleted.

Box 3: No

This answer depends on how the IP address is changed. To change the IP address of a VM manually, you would need to select ‘Static’ as the IP address assignment. In this case, the DNS record will not be updated because only DHCP assigned IP addresses are auto-registered.

Reference: https://docs.microsoft.com/en-us/azure/dns/dns-faq-private

Explanation:

Yes, Yes, Yes

NSG rules applied to the subnet hosting the private endpoint are not applied to the private endpoint. So the NSG1 doesn’t limit storage access from either VM1 or VM2. https://docs.microsoft.com/en-us/azure/storage/common/storage-private-endpoints#network-security-group-rules-for-subnets-with-private-endpoints

Explanation:

Box 1:

If forced tunneling was enabled, the Firewall Subnet would be named AzureFirewallManagementSubnet. Forced tunneling can only be enabled during the creation of the firewall. It cannot be enabled after the firewall has been deployed.

Box 2:

The “Visit Azure Firewall Manager to configure and manage this firewall” link in the exhibit shows that the firewall is managed by Azure Firewall Manager.

Explanation:

For the first question, only ExpressRoute GW SKU Ultra Performance support FastPath feature. For the second question, vnet1 will connect to ExpressRoute gw, once Vnet1 peers with Vnet2, the traffic from on-premise network will bypass GW and Vnet1, directly goes to Vnet2, while this feature is under public preview.

Reference: ExpressRoute virtual network gateway is designed to exchange network routes and route network traffic. FastPath is designed to improve the data path performance between your on-premises network and your virtual network. When enabled, FastPath sends network traffic directly to virtual machines in the virtual network, bypassing the gateway.

To configure FastPath, the virtual network gateway must be either:

Ultra Performance

ErGw3AZ

VNet Peering – FastPath will send traffic directly to any VM deployed in a virtual network peered to the one connected to ExpressRoute, bypassing the ExpressRoute virtual network gateway.

https://docs.microsoft.com/en-us/azure/expressroute/about-fastpath

Gateway SKU

https://docs.microsoft.com/en-us/azure/expressroute/expressroute-about-virtual-network-gateways