AZ-500 Secure networking Practice Question
A company has an Azure virtual network with a single subnet that hosts web servers. The security team needs to allow inbound HTTPS traffic from the internet to the web servers, but block all other inbound traffic. They want to use a single Azure resource to accomplish this at the subnet level. Which resource should they configure?
⚠ Common exam trap
It's easy for candidates to confuse Azure Firewall (a centralized, stateful service) with a simple subnet-level ACL, or they mistakenly think an Application Security Group can independently filter traffic, when in fact it only works as a source or destination in an NSG rule.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network Security Group (NSG)
A Network Security Group (NSG) is the correct resource because it can be associated with a subnet to filter inbound traffic at Layer 3/4. By creating a rule that allows TCP port 443 (HTTPS) from the Internet service tag and a default deny-all rule, the NSG blocks all other inbound traffic while permitting HTTPS. This meets the requirement of a single Azure resource operating at the subnet level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is a centralised, managed network security service operating at the virtual network perimeter, not directly at a specific subnet's ingress/egress. Configuring it for a single subnet would necessitate routing all traffic through it, which is not what "at the subnet level" implies for direct application. It is tempting as a firewall solution, but it is designed for broader, centralised protection across multiple subnets or virtual networks, offering advanced threat protection and FQDN filtering for an entire network's traffic flow.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is a global, edge-based Application Delivery Network (ADN) that operates at Layer 7 outside the Azure virtual network. It cannot associate with or filter traffic at a subnet's network interface because it is not an inline network-layer firewall; instead, it forwards user traffic from edge points of presence (PoPs) directly to backend clients over the internet. Even though Azure Front Door includes a Web Application Firewall (WAF), that protection is applied at the global edge, not to subnet-level ingress within a virtual network. Therefore, it does not satisfy the requirement of restricting traffic into the specific subnet.
- ✓
Network Security Group (NSG)
Why this is correct
An NSG contains inbound and outbound security rules that can be associated with a subnet or a network interface. By creating an allow rule for HTTPS (TCP 443) from Internet and a default deny-all rule, the requirement is met efficiently.
- ✗
Application Security Group (ASG)
Why it's wrong here
An Application Security Group (ASG) is merely a logical object that groups virtual machine network interfaces by application role; it contains no firewall logic or traffic inspection capabilities by itself. It is consumed only as a source or destination in Network Security Group (NSG) rules, meaning it can help simplify rule management but does not actually allow or deny packets. Configuring an ASG would not restrict Internet traffic to the web subnet unless you also create an NSG rule that references it, so it cannot fulfill the subnet-level filtering requirement on its own.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.