AZ-204 Implement Azure security Practice Question
You need to restrict access to an Azure web app so that only traffic from a specific virtual network (VNet) can reach it. The web app is already deployed. What should you configure on the web app?
⚠ Common exam trap
Test-takers frequently confuse VNet integration (outbound) with access restrictions (inbound), leading candidates to select VNet integration when the question asks about restricting incoming traffic from a VNet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Access restrictions
Access restrictions (also known as IP restrictions) allow you to define allow/deny rules based on source IP addresses or Virtual Network (VNet) service endpoints. By configuring a service endpoint-based rule that permits traffic only from your specific VNet, you can block all other inbound traffic to the web app. This is the correct mechanism for restricting access at the web app level without modifying the underlying infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VNet integration
Why it's wrong here
VNet integration primarily facilitates outbound connectivity for an Azure Web App, allowing it to securely access resources located within a specified Azure Virtual Network, such as databases or virtual machines. It establishes a network path from the web app *into* the VNet. However, VNet integration does not inherently provide a mechanism to filter or restrict *inbound* network traffic originating from external sources to the web app itself, which is the requirement.
- ✓
Access restrictions
Why this is correct
Access restrictions are a native feature of Azure App Service designed specifically to control inbound network traffic to a web app. They allow administrators to define a set of allow/deny rules based on IP addresses (IPv4/IPv6 CIDR blocks) or by leveraging Virtual Network service endpoints to restrict access to specific subnets within an Azure VNet. This directly addresses the need to deny all traffic except from a particular source.
- ✗
Network Security Group (NSG) on the subnet
Why it's wrong here
Network Security Groups (NSGs) are used to filter network traffic to and from Azure resources deployed *within* an Azure Virtual Network, typically applied to network interfaces or subnets. An Azure Web App, when running in a multi-tenant environment, is not directly deployed into a customer-managed VNet subnet where an NSG could be applied to its ingress. Therefore, an NSG on a subnet cannot directly restrict inbound access to a standard Azure Web App.
- ✗
Point-to-Site VPN
Why it's wrong here
A Point-to-Site (P2S) VPN enables individual client devices to establish a secure, encrypted connection to an Azure Virtual Network, allowing those clients to access resources *within* that VNet. This solution is designed for remote user access to internal network resources. It does not provide a mechanism to configure global inbound access rules for an Azure Web App or to restrict public internet access to the web app based on source IP or VNet.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.