AZ-500 Default NSG Rules Practice Question
A company has a virtual network in Azure with a subnet that hosts a web application. They want to allow inbound HTTPS traffic only from a specific source IP range (198.51.100.0/24). They are using Network Security Groups (NSGs) associated with the subnet. What is the minimal set of inbound security rules required?
⚠ Common exam trap
The trap is that candidates assume the default deny rule implicitly blocks all unwanted traffic, but they forget that NSGs also have default allow rules for virtual network and Azure Load Balancer traffic. These default allow rules have higher priority than the default deny rule, so traffic from those sources would be allowed unless explicitly denied. Therefore, to restrict traffic to a specific external IP range, an explicit deny rule is needed to override those default allows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Two inbound rules: one to allow HTTPS, and one to deny all other traffic
Network Security Groups (NSGs) contain default inbound security rules: AllowVNetInBound (priority 65000) and AllowAzureLoadBalancerInBound (priority 65001). These default rules would permit HTTPS traffic from sources within the virtual network or from Azure Load Balancer, violating the requirement to allow HTTPS only from the specific IP range 198.51.100.0/24. Therefore, an explicit deny-all rule must be added with a higher priority (lower numerical value) than the default allow rules to block all other traffic, including that from VNet and Azure Load Balancer. The minimal set is: one rule to allow HTTPS from 198.51.100.0/24 (high priority), and one rule to deny all inbound traffic from any source (at a slightly lower priority but still above the default rules). Option A is insufficient because it relies on the default deny rule (priority 65500), which is processed after the default allow rules, so VNet and Load Balancer traffic would still be permitted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
One inbound rule: Allow TCP port 443 from source '198.51.100.0/24'
Why it's wrong here
Incorrect. A single allow rule is insufficient because NSG default rules AllowVNetInBound and AllowAzureLoadBalancerInBound would still permit HTTPS traffic from within the virtual network and from Azure Load Balancer, violating the restriction to only the specified external IP range.
- ✓
Two inbound rules: one to allow HTTPS, and one to deny all other traffic
Why this is correct
Correct. The minimal set is two rules: an allow rule for HTTPS from 198.51.100.0/24 with high priority, and a deny-all inbound rule with sufficiently high priority to override the default allow rules, ensuring only traffic from the specified IP range is allowed.
- ✗
Three inbound rules: allow HTTPS, allow RDP for management, and deny all
Why it's wrong here
Including an RDP allow rule is not only extraneous but harmful to the security posture. The stated requirement is to permit only HTTPS from 198.51.100.0/24; no management access was requested, so adding an RDP (TCP 3389) allow rule violates the 'minimal set' criterion and exposes an additional attack surface. Even if a deny-all rule is present, the RDP allow rule with a higher priority (lower numeric value) would override that deny for RDP traffic, potentially allowing management access from unintended sources depending on the rule's source. Moreover, any additional rule increases configuration complexity and makes the NSG harder to audit, directly contradicting the best practice of least privilege.
- ✗
One inbound rule: Allow TCP port 443 from source 'Any' and a separate rule to deny from '198.51.100.0/24'
Why it's wrong here
This configuration either fails to block the intended deny target or blocks the intended allow target, depending on rule priority. In Azure NSGs, rules are processed in priority order (lower number = higher priority), and the first match is applied; if the 'Allow TCP 443 from Any' rule has higher priority than the 'Deny from 198.51.100.0/24' rule, the deny is never evaluated for that IP, so traffic from that IP is allowed. Conversely, if the deny rule has higher priority, it will block all HTTPS traffic from 198.51.100.0/24, which is precisely the source you meant to allow. In both scenarios, the configuration violates the requirement to allow HTTPS only from 198.51.100.0/24 and simultaneously permits all other sources, so this is incorrect.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.