AZ-500 Network Security Group (NSG) Practice Question
A small business has a single Azure subscription with one virtual network containing two subnets: 'Frontend' for web servers and 'Backend' for database servers. The web servers need to access the internet to download updates, but the database servers must not have any outbound internet access. The business also needs to allow remote administration of the web servers from the internet via RDP (port 3389) but only from the IT department's public IP range (203.0.113.0/24). You need to configure network security to meet these requirements using Azure-native services. What should you do?
⚠ Common exam trap
A common mistake is to assume that NSGs have a default deny outbound behavior, but they actually have a default allow outbound. The option B explicitly sets a 'default deny outbound', which would block internet access unless an explicit allow rule is added. Candidates may overlook the need for that allow rule.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy Azure Firewall in the virtual network and configure DNAT rules for RDP and outbound rules for internet access.
Azure Firewall provides a managed, scalable solution for controlling outbound internet access and inbound RDP. You can configure DNAT rules to allow RDP access from the IT department IP range (203.0.113.0/24) to the web servers, and set outbound rules to allow internet access from the Frontend subnet while blocking outbound traffic from the Backend subnet. Option B is incorrect because the described NSG configuration includes a default deny outbound rule for the Frontend subnet, which would block the web servers' ability to download updates from the internet without an explicit allow rule. Options A and C introduce unnecessary complexity and cost, and option C does not address the outbound internet requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a network virtual appliance (NVA) for outbound inspection and configure RDP access via a jump box.
Why it's wrong here
Using a network virtual appliance (NVA) and jump box is a valid approach but adds unnecessary complexity and cost for this simple scenario. Azure-native services like Azure Firewall or properly configured NSGs can meet the requirements more efficiently.
- ✗
Create an NSG for the Frontend subnet with an inbound rule allowing RDP from 203.0.113.0/24, and a default deny for outbound. Then create an NSG for the Backend subnet with a default deny outbound rule.
Why it's wrong here
This option includes a default deny outbound rule for the Frontend subnet, which would block the web servers from accessing the internet for updates. To meet the requirement, an explicit outbound allow rule for internet access is needed. Therefore, this configuration fails to satisfy all requirements.
- ✗
Create a site-to-site VPN from the IT department to Azure and use Azure Bastion for RDP access.
Why it's wrong here
A site-to-site VPN and Azure Bastion provide secure inbound RDP access, but they do nothing to control the web servers' outbound internet access. The requirement to allow specific outbound traffic from the Frontend subnet while blocking the Backend subnet remains unaddressed, because neither component is an egress firewall or NAT gateway. Additionally, forcing all IT-department RDP traffic over a VPN tunnel into Azure adds unnecessary complexity and cost for a single small subscription, when Azure Firewall DNAT rules could achieve the same inbound connectivity more directly.
- ✓
Deploy Azure Firewall in the virtual network and configure DNAT rules for RDP and outbound rules for internet access.
Why this is correct
Azure Firewall with DNAT rules allows RDP access from the IT department IP range (203.0.113.0/24) to the web servers. Outbound rules can be configured to allow internet access from the Frontend subnet while blocking outbound traffic from the Backend subnet, meeting all requirements efficiently and securely.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.