Courseiva
← AZ-204
Full test
Implement Azure security →hardMultiple ChoiceObjective-mapped

AZ-204 Implement Azure security Practice Question

Exhibit

Refer to the exhibit.
{
  "type": "Microsoft.Network/networkSecurityGroups",
  "apiVersion": "2023-11-01",
  "name": "nsg-app",
  "properties": {
    "securityRules": [
      {
        "name": "AllowSSH",
        "properties": {
          "protocol": "Tcp",
          "sourcePortRange": "*",
          "destinationPortRange": "22",
          "sourceAddressPrefix": "VirtualNetwork",
          "destinationAddressPrefix": "*",
          "access": "Allow",
          "priority": 100,
          "direction": "Inbound"
        }
      },
      {
        "name": "DenyAll",
        "properties": {
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "*",
          "sourceAddressPrefix": "*",
          "destinationAddressPrefix": "*",
          "access": "Deny",
          "priority": 200,
          "direction": "Inbound"
        }
      }
    ]
  }
}

You are reviewing an ARM template that deploys a network security group (NSG) for a web application. The exhibit shows the security rules. The web application runs on port 443. You need to ensure that HTTPS traffic from the internet can reach the web servers. What is the issue with the current configuration?

⚠ Common exam trap

The trap here is that candidates may focus on the SSH rule's security implications or priority ordering, overlooking the fundamental absence of an HTTPS allow rule, which is the direct cause of the web application being unreachable.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

There is no rule to allow HTTPS traffic (port 443) from the internet.

The ARM template's security rules do not include an inbound rule that allows HTTPS traffic (TCP port 443) from the internet. Without such a rule, the default DenyAll inbound rule will block all HTTPS requests, preventing the web application from being accessible over the internet. NSG rules are evaluated in priority order, and if no explicit allow rule exists for port 443, traffic is denied.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    The SSH rule is allowing SSH from the internet, which is a security risk.

    Why it's wrong here

    The SSH rule's `sourceAddressPrefix` is set to `VirtualNetwork`, which explicitly limits SSH access to resources within the same Azure virtual network. This configuration prevents direct SSH connections from public IP addresses on the internet, thereby mitigating the security risk of exposing SSH to the wider internet. Therefore, the statement claiming it allows SSH from the internet is factually incorrect based on the typical ARM template structure for NSG rules.

  • ✗

    The SSH rule should have a higher priority (lower number) to ensure SSH access.

    Why it's wrong here

    Network Security Group rules are processed in order of their priority, with lower numbers indicating higher precedence. A priority of 100 for an SSH rule is a very high precedence, ensuring it is evaluated early, typically before most other custom rules and certainly before any general deny rules. This high priority is more than sufficient to ensure SSH access is evaluated and allowed if other conditions match, so the rule's priority is not the underlying issue.

  • ✗

    The DenyAll rule should have a lower priority (higher number) to allow more specific rules.

    Why it's wrong here

    The DenyAll rule is intentionally configured with a high priority number (e.g., 65000), which translates to a low precedence in Network Security Group rule processing. This design ensures that all more specific 'Allow' rules, such as those for SSH or HTTPS, are evaluated and applied first. Only traffic that does not match any preceding 'Allow' rules will then be caught and blocked by this catch-all 'DenyAll' rule, making its current priority appropriate for a secure posture.

  • ✓

    There is no rule to allow HTTPS traffic (port 443) from the internet.

    Why this is correct

    For an application to be accessible via HTTPS from the internet, a specific Network Security Group rule must exist that explicitly permits inbound traffic on destination port 443 (HTTPS) from a source of 'Internet' or `*`. Without such an explicit 'Allow' rule, any incoming HTTPS requests will inevitably be blocked by the implicit 'DenyAllInbound' rule or an explicit, higher-priority 'DenyAll' rule. This omission prevents critical web traffic from reaching the application, highlighting a significant functional gap.

About these practice questions

One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.