CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Mastering Azure Subnet Access Control in AZ-104
Learn how to effectively manage subnet access in Azure with this detailed question walkthrough for the AZ-104 exam.
Restricting access to a specific subnet can trip up candidates during the AZ-104 exam. Understanding the right Azure feature to use is key. Let's break down a relevant question that tests this knowledge.
The question
You have a virtual network with two subnets. You want to restrict access to a specific subnet so that only certain virtual machines can communicate with it. Which Azure feature should you use?
- A. Implement a Network Security Group (NSG) and associate it with the subnet.
- B. Use Azure Firewall to control access to the subnet.
- C. Create a route table and associate it with the subnet.
- D. Configure Azure Private Link for the subnet.
Think before you scroll
Before moving on, consider the specific functionalities of each option. Focus on which feature directly controls access to a subnet rather than broader network traffic management or routing.
The answer
The correct option is A. Implement a Network Security Group (NSG) and associate it with the subnet. An NSG is designed to filter network traffic to and from Azure resources within a virtual network, making it the ideal choice for restricting access to a subnet.
Why the other options lose
- B. Use Azure Firewall to control access to the subnet. While Azure Firewall provides extensive security features, it functions at a broader network level compared to NSGs. It is more suited for controlling traffic between networks rather than per subnet.
- C. Create a route table and associate it with the subnet. A route table manages routing of network traffic, not access control. It does not provide security rules to restrict which virtual machines can communicate.
- D. Configure Azure Private Link for the subnet. Azure Private Link is used for connecting to Azure services privately. It does not restrict access to subnets but rather enables private connectivity to services.
The concept behind it
The underlying principle here is that Network Security Groups (NSGs) are specifically intended for access control. They use rules to allow or deny traffic based on various criteria, such as IP address, port, and protocol. Understanding this principle allows you to apply it to any scenario involving subnet access restrictions.
Exam trap to remember
Always choose NSGs for subnet-level access control. They are your go-to for filtering traffic to and from subnets in Azure.