Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped

AZ-204 Practice Question: Connect to and consume Azure services and third-party services

Exhibit

Refer to the exhibit.

{
  "type": "Microsoft.Network/networkSecurityGroups/securityRules",
  "apiVersion": "2021-02-01",
  "name": "DenyInternetOutbound",
  "properties": {
    "priority": 100,
    "direction": "Outbound",
    "access": "Deny",
    "sourceAddressPrefixes": ["VirtualNetwork"],
    "destinationAddressPrefixes": ["Internet"],
    "destinationPortRanges": ["*"],
    "protocol": "*",
    "sourcePortRange": "*"
  }
}

Refer to the exhibit. You are deploying an ARM template that includes the above network security group rule. The rule is intended to block all outbound internet traffic from a virtual network. However, after deployment, virtual machines in the subnet still have outbound internet access. What is the most likely reason?

⚠ Common exam trap

Many exam-takers assume defining a rule in an ARM template automatically applies it to traffic, but Azure requires explicit association of the NSG with a subnet or NIC for the rules to be enforced.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The network security group is not associated with the subnet or network interface.

A network security group (NSG) rule only takes effect when the NSG is explicitly associated with a subnet or a network interface. Without this association, the rule is not applied to traffic flowing through the subnet, so virtual machines retain default outbound internet access. The ARM template may have defined the NSG and its rules, but if the association step (e.g., via Microsoft.Network/virtualNetworks/subnets with the networkSecurityGroup property) is missing or misconfigured, the rule is effectively ignored.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The destination port range '*' is invalid; you must specify explicit ports.
Why it's wrong here
The wildcard character '*' is a perfectly valid and commonly used value for both source/destination port ranges in Azure Network Security Group (NSG) rules. Specifying '*' explicitly permits traffic on all TCP and UDP ports, eliminating the need to list individual port numbers or ranges. Therefore, the assertion that '*' is invalid and requires explicit ports is incorrect, as it serves as a legitimate shorthand for "all ports."
✗
The source address prefix should be '*' instead of 'VirtualNetwork'.
Why it's wrong here
Using 'VirtualNetwork' as the source address prefix is entirely valid and often preferred over '*' in an NSG rule. 'VirtualNetwork' is an Azure service tag that represents all IP address ranges within the virtual network, including all connected subnets and peered virtual networks. This provides a more secure and specific scope than '*', which would encompass all internet traffic, making the statement that '*' should be used instead incorrect.
✓
The network security group is not associated with the subnet or network interface.
Why this is correct
An Azure Network Security Group, even when perfectly configured with appropriate rules, remains ineffective until it is explicitly associated with either a subnet or a specific network interface (NIC). Without this crucial association step, the NSG rules are not applied to any network traffic flowing to or from virtual machines or other resources. Therefore, the lack of association renders any defined security rules inert and unable to enforce traffic filtering.
✗
The rule priority is too low; it should be lower than the default allow rule.
Why it's wrong here
In Azure NSG rule processing, a lower numerical value for priority indicates a *higher* precedence. Rules are evaluated in ascending order of priority, meaning a rule with priority 100 will be processed and applied *before* any rules with higher numerical priorities, including the default allow rules which typically start at 65000. Consequently, a priority of 100 is considered high and would take precedence, making the statement that it's too low incorrect.

Visual reference

Go deeper

AZ-204 Practice Question: Connect to and consume Azure services and third-party services

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question