Question 639 of 194
Allow Inbound HTTP/HTTPS to an Azure VM Using NSG
You have an Azure virtual machine that hosts a web application on port 443 and a management interface on port 8443. You need to allow inbound HTTPS traffic from the internet to port 443, and allow inbound traffic on port 8443 only from the company's office public IP range (203.0.113.0/24). You want to use a managed service that provides basic DDoS protection at no additional cost. What should you use?
Quick Answer
The answer is a Network Security Group (NSG). An NSG is the correct choice because it is a free, managed Azure service that provides basic DDoS protection at no additional cost, allowing you to define granular inbound security rules to allow inbound HTTP/HTTPS to an Azure VM using NSG. Specifically, you can create a rule permitting HTTPS traffic on port 443 from any source, and a separate rule restricting management traffic on port 8443 solely to your company’s office public IP range (203.0.113.0/24), meeting both requirements without extra charges. On the Microsoft Azure Security Engineer Associate AZ-500 exam, this scenario tests your understanding of cost-effective network security controls versus premium services like Azure Firewall or DDoS Protection Standard—a common trap is assuming you need a paid service for basic DDoS protection, but NSGs include it by default. Remember the memory tip: “NSG is free, DDoS is included, rules are granular, costs are excluded.”
⚠ Common exam trap
The trap here is that candidates often over-engineer the solution by choosing a paid, advanced service (like Application Gateway or Azure Firewall) when a simple, free NSG with basic DDoS protection fully satisfies the requirements, especially since the question explicitly states 'at no additional cost'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network Security Group (NSG)
A Network Security Group (NSG) is the correct choice because it is a free, managed Azure service that provides basic DDoS protection at no additional cost. NSGs allow you to define inbound security rules to permit HTTPS traffic (port 443) from any source and restrict management traffic (port 8443) to a specific public IP range (203.113.0.0/24). This meets all requirements without incurring extra charges for advanced services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Application Gateway with WAF
Why it's wrong here
Azure Application Gateway is a Layer 7 load balancer that includes Web Application Firewall (WAF), but it is a paid service with additional cost. It is not required for basic IP/port filtering.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is a global load balancer and application delivery controller. It is a paid service and introduces unnecessary complexity for simple inbound traffic filtering to a single VM.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall, while a managed service offering advanced network filtering and threat intelligence, is a premium service with associated costs, failing the requirement for "basic DDoS protection at no additional cost". This basic protection is inherent to all Azure Public IP addresses. Azure Firewall would be a suitable choice for scenarios demanding centralised, granular network security across multiple workloads, outbound traffic filtering, or integration with threat intelligence feeds, where its cost is justified by advanced security needs beyond simple inbound port rules.
- ✓
Network Security Group (NSG)
Why this is correct
An NSG can be associated with the VM's subnet or network interface. You can create rules to allow inbound HTTPS on port 443 from any source, and allow inbound on port 8443 only from the office IP range. NSGs are free and the default DDoS Protection Basic is included at no additional cost.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You have an Azure virtual machine that hosts a web application. You need to allow inbound HTTP (80) and HTTPS (443) traffic from the internet to this VM only. You also need to allow outbound traffic to the internet from the VM. You want to use a managed Azure service with minimal configuration. What should you use?
easy- A.Azure Application Gateway
- B.Azure Firewall
- ✓ C.Network Security Group (NSG)
- D.Azure Bastion
Why C: A Network Security Group (NSG) is the correct choice because it is a managed Azure service that provides a stateful, layer-3/4 firewall for filtering inbound and outbound traffic to a virtual machine. With minimal configuration, you can create inbound rules to allow HTTP (TCP/80) and HTTPS (TCP/443) from the internet (source 'Internet' or 'Any') and an outbound rule to allow all traffic to the internet (default outbound rule already allows this). NSGs are directly associated with a VM's subnet or network interface, making them the simplest managed solution for this scenario.
Last reviewed: Jun 11, 2026
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.