Implement and Manage Virtual Networking →mediumMultiple Choice

AZ-104 Implement and Manage Virtual Networking Practice Question

You manage an Azure virtual network named VNet-App that contains a subnet named Subnet-Web with 40 web server VMs. The VMs must be reachable on TCP 443 from the internet, and Microsoft publishes service tags such as Internet, VirtualNetwork, and AzureLoadBalancer. You attach a network security group (NSG) named NSG-Web to Subnet-Web. You need to allow inbound HTTPS to the VMs while blocking all other inbound internet traffic. What should you configure in NSG-Web?

⚠ Common exam trap

The trap here is assuming that a custom deny rule is required for all other traffic, when Azure NSGs already include default inbound deny rules that handle this automatically.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

An inbound security rule with source Internet, destination port 443, protocol TCP, action Allow at priority 1000, and a default Deny rule for all other inbound traffic.

NSGs evaluate inbound rules by priority, and Azure provides default rules that deny inbound traffic from the internet unless a higher-priority allow rule matches. Creating an allow rule for the Internet service tag on TCP 443 permits only HTTPS, while the built-in default deny blocks everything else. Using VirtualNetwork or AzureLoadBalancer as the source would not match public client traffic, and allowing all ports would be overly permissive.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
An inbound security rule with source Internet, destination port 443, protocol TCP, action Allow at priority 1000, and a default Deny rule for all other inbound traffic.
Why this is correct
This is correct because an NSG rule with source service tag Internet, destination TCP 443, and Allow permits exactly the required HTTPS traffic. Azure NSGs have default rules that deny inbound traffic not explicitly allowed, so explicitly allowing 443 and relying on the built-in deny for everything else satisfies the requirement without needing to create a custom deny rule.
✗
An inbound security rule with source Internet, destination port Any, protocol Any, action Allow at priority 100, and a default Deny rule for all other inbound traffic.
Why it's wrong here
Allowing all ports and protocols from the Internet opens the VMs to every inbound connection, far exceeding the requirement of HTTPS on TCP 443 only. This weakens security and violates the stated goal of blocking all other inbound internet traffic. The destination port should be restricted to 443 and protocol to TCP.
✗
An inbound security rule with source AzureLoadBalancer, destination port 443, protocol TCP, action Allow at priority 100, and a default Deny rule for all other inbound traffic.
Why it's wrong here
The AzureLoadBalancer service tag represents health probe traffic from the Azure load balancer infrastructure, not general client traffic from the internet. Allowing only this tag would permit probes but block actual HTTPS requests from external users. It does not satisfy the requirement to allow inbound HTTPS from the internet.
✗
An inbound security rule with source VirtualNetwork, destination port 443, protocol TCP, action Allow at priority 65000, and a default Deny rule for all other inbound traffic.
Why it's wrong here
Using the VirtualNetwork service tag limits the rule to traffic from within the virtual network or peered networks, not from the public internet. Internet clients would not match this source tag, so their HTTPS connections would be blocked. This fails the stated requirement that the VMs be reachable on TCP 443 from the internet.

Visual reference

Go deeper

AZ-104 Implement and Manage Virtual Networking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question