AZ-500 Secure networking Practice Question
A company deploys Azure virtual machines in a virtual network. A security policy requires that only Remote Desktop Protocol (RDP) traffic from the corporate VPN's public IP address (203.0.113.0/26) is allowed. All other inbound RDP traffic must be denied. Which configuration should be applied to the network security group (NSG) associated with the VM subnet?
⚠ Common exam trap
The trap here is that candidates often forget that NSGs have default rules that allow inbound traffic from the virtual network and Azure load balancer, and they mistakenly think a default deny rule already blocks all RDP, when in fact you must explicitly allow the specific source IP and rely on the default deny to block everything else.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add an inbound rule to allow RDP from the corporate IP range, and add a default deny rule for all other inbound RDP traffic.
The requirement is to allow RDP (TCP port 3389) only from the corporate VPN's public IP range (203.0.113.0/26) and deny all other inbound RDP traffic. An NSG processes rules in priority order; by adding an inbound allow rule for the corporate IP range with a high priority (e.g., 100) and relying on the default deny rule (which denies all inbound traffic not explicitly allowed), only RDP from the specified range is permitted. This matches the security policy precisely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add an inbound rule to allow RDP from the Internet and a deny rule for RDP from the corporate IP.
Why it's wrong here
This rule set inverts the required access control: it opens RDP to the entire Internet while explicitly excluding the corporate IP range. Because the corporate IP is the only source that should be allowed, blocking it while permitting all other traffic would prevent legitimate remote administration and expose the VM to broader attacks. Furthermore, if the deny rule for the corporate IP has a higher priority (lower priority number) than the allow-Internet rule, it might still block the corporate IP, but the allow-Internet rule introduces unnecessary risk from untrusted sources.
- ✗
Add an inbound rule to deny RDP from the corporate IP and a default deny all inbound.
Why it's wrong here
This configuration denies RDP from the corporate IP and also sets a default deny for all inbound traffic, which effectively eliminates any possibility of remote administration. Even if there was an allow rule for some other source, the default deny all inbound would block it unless that allow rule had a lower priority number. The requirement is to permit RDP exclusively from the corporate IP range, so denying that specific source directly contradicts the goal and leaves neither the corporate nor any other source with access.
- ✓
Add an inbound rule to allow RDP from the corporate IP range, and add a default deny rule for all other inbound RDP traffic.
Why this is correct
To allow RDP only from the corporate IP range, you must create an inbound NSG rule with priority number lower than any competing deny rule, permitting traffic from that source to TCP port 3389. Then a second inbound rule with a higher priority number (lower precedence) should deny RDP from all other sources, ensuring that any traffic not matching the corporate allow rule is blocked. This pair of rules works with the default DenyAllInbound rule to restrict unauthorized access while preserving the required administrative path.
- ✗
No additional rules are needed because the default NSG rules already deny RDP.
Why it's wrong here
Default NSG rules do include DenyAllInbound, which blocks all inbound traffic from the internet, but this rule also blocks RDP from the corporate IP if that IP is outside the virtual network. The default rules do not contain any rule that explicitly allows RDP from any source, so without a custom allow rule, no one, including the corporate range, can successfully use RDP. Additionally, the DenyAllInbound rule has priority 40000, so any custom rule with a lower priority number can override it; simply relying on defaults leaves the VMs inaccessible to authorized administrators.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.