Lab — Prove a security group is stateful
AZ-104 › Unit 4 › Lab
Lab — Prove a security group is stateful
Lab brief
- AZ104-U4.T2
- 25 minutes
- A virtual network, two subnets, a network security group and rules
- required
- Core
The claim to make physical: you write one rule, not two. Allowing traffic one way is enough, because the flow record lets the response back — and the option that adds a return rule is the classic wrong answer.
Before you start
A subscription. Virtual networks, subnets and security groups are free to create; you are charged for what runs inside them, and this lab runs nothing.
Walkthrough
Prove a security group is stateful
1. Create a virtual network with two subnets
One address space, two subnets. Nothing is deployed into them — the whole lab is about the rules, and an empty subnet evaluates them just as well.
Did it teach you what it was meant to?
A web server must reach an update service on port 443 outbound. Which rule set does step 4 show is correct?
Step 3 refused to delete a default rule. How do you stop the traffic a default rule allows?
What goes wrong
Tear it down
Run this whether or not the lab worked. Everything above was chosen to cost approximately nothing, and leaving it in place is how approximately nothing becomes something.
Teardown
Delete the resource group
az group delete --name bb-lab-net, which takes the virtual network, the subnets and the security group with it.
Where these figures come from
Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.
| Document | sha1 |
|---|---|
| Create, change, or delete a network security group | 580ad3a25f30 |
| Network security groups | e9cc8195539f |
| Application security groups | 682a8663225e |
| Manage Azure resource groups by using Azure CLI | a3840d837a3d |