AZ-500 Secure networking Practice Question
A company has a virtual network with a subnet hosting Azure VMs. They want to restrict all inbound traffic to only allow HTTPS (port 443) from the internet, but also allow SSH (port 22) only from a specific management IP address range (e.g., 203.0.113.0/24). Which Azure service should they use to achieve this filtering?
⚠ Common exam trap
Candidates often choose Azure Firewall because they think it is required for any IP-based filtering, but NSGs are the correct and simpler service for subnet-level inbound port and source IP filtering without needing a centralized firewall appliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network Security Group (NSG) rule
A Network Security Group (NSG) rule is the correct choice because NSGs provide stateful, granular inbound and outbound filtering at the subnet or NIC level. You can create a rule to allow HTTPS (TCP/443) from any source (Internet) and a separate rule to allow SSH (TCP/22) only from the specific management IP range 203.0.113.0/24, while implicitly denying all other inbound traffic. NSGs are the native Azure service for this type of traffic filtering and do not require additional cost or deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall requires a User Defined Route to redirect traffic through it for inspection, which adds unnecessary routing complexity and cost for a simple inbound filtering requirement on a single subnet. It is tempting because it is a dedicated, centralised firewall service that would be correct for scenarios demanding egress filtering, application-level rules, or centralised logging across multiple virtual networks.
- ✓
Network Security Group (NSG) rule
Why this is correct
An NSG rule provides stateful, Layer 4 packet filtering directly at the subnet or network interface level. You can create an inbound rule to allow HTTPS (443) from 'Any' source and a separate rule to allow SSH (22) only from your specific management IP range, blocking all other unsolicited inbound traffic. This is the simplest, most cost-effective solution for basic port-and-source filtering on a single subnet, as it requires no additional routing or virtual appliances. NSGs are enforced by the Azure network stack, and each rule is evaluated in priority order, giving you precise control over permitted traffic.
- ✗
Azure DDoS Protection
Why it's wrong here
Azure DDoS Protection is a cloud-scale mitigation service designed to absorb volumetric, protocol, and resource-layer distributed denial-of-service attacks. It operates at the Azure network edge and does not inspect or filter traffic based on destination ports or source IP addresses, so it cannot restrict inbound HTTPS or SSH to only specific sources. While it can protect your VMs from being overwhelmed by attack traffic, it complements rather than replaces network access controls like NSG rules. For a simple inbound filtering requirement on a single subnet, it is entirely possible that DDoS Protection would not even be enabled by default, and using it here would not achieve the stated port- and source-based filtering goal.
- ✗
Azure Bastion
Why it's wrong here
Azure Bastion is a fully managed PaaS service that provides secure, browser-based RDP and SSH connectivity to your VMs directly through the Azure portal, using TLS. It acts as a jump host that eliminates the need for public IP addresses on your VMs, but it does not inspect, filter, or block inbound internet traffic destined to the subnet's workload ports. Rather, Bastion itself is accessed from the portal, and traffic to the VMs still needs to be controlled with NSG rules that allow entry from the Bastion subnet. Therefore, while it improves management-plane security by hiding your VMs' management endpoints, it is not a substitute for an NSG rule that filters inbound HTTPS and SSH from external source IPs.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.