A company runs a web app behind an Application Gateway WAF v2 deployed in a dedicated subnet. After someone attaches a new network security group to that subnet, backend health shows Unknown and clients receive 502 errors. Which TWO NSG rules would restore the gateway's health communication?
Choose two.
Show answer and explanation
Answer: A and B
Application Gateway v2 is managed by Azure infrastructure, which communicates with the gateway subnet over ports 65200 to 65535 from the GatewayManager service tag. Health probes also originate from the AzureLoadBalancer service tag, so both sources must be allowed inbound on the gateway subnet. Blocking these flows stops the control plane from reporting health and stops probe responses from returning, which shows up as Unknown backend health and 502 errors. Outbound rules to the Internet do not affect these inbound management and probe flows.
Why the other options are wrong
- C. Denying outbound Internet traffic from the gateway subnet does not touch the inbound management and probe flows the gateway needs, so it does not explain Unknown health states.
- D. Opening SSH from any source is unrelated to Application Gateway health communication. It widens exposure without restoring health, because the gateway does not use port 22 for its probes.
- E. Backend subnet outbound rules are not the path for gateway control traffic. The management traffic arrives inbound from GatewayManager, so an outbound rule on the backend subnet to that tag does not fix the failure.