Configure NSG Explicit Deny Inbound Rule
A company has an Azure virtual network with a subnet hosting internal web applications. The security team needs to allow inbound HTTPS traffic only from the company's corporate network IP range (203.0.113.0/24). All other inbound traffic must be denied. They want to use a network security group (NSG) associated with the subnet. Which inbound security rule configuration meets this requirement?
Quick Answer
The answer is two inbound rules: an Allow HTTPS rule from 203.0.113.0/24 with priority 100, followed by a Deny All from Any rule with priority 110. This configuration is correct because NSGs evaluate rules in priority order, with lower numbers processed first. The explicit Allow rule matches HTTPS traffic from the corporate IP range, and the subsequent explicit Deny rule catches all other inbound traffic before the default implicit deny rule ever applies. On the Microsoft Azure Security Engineer Associate AZ-500 exam, this scenario tests your understanding of how explicit deny rules override the default implicit deny, and a common trap is assuming a single Allow rule is sufficient—without an explicit deny, the implicit rule only blocks traffic that doesn’t match any rule, but it does not prevent accidental allow from other sources if a higher-priority rule is misconfigured. A useful memory tip: “Explicit deny, priority high—catch all traffic, don’t let it slip by.”
⚠ Common exam trap
A common mix-up: candidates assume the default deny rule is sufficient, but Azure explicitly requires an explicit deny rule to override the default implicit allow for outbound traffic or to ensure logging and control for inbound traffic, and they may misorder rules by placing the deny before the allow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Two inbound rules: Allow HTTPS from 203.0.113.0/24 with priority 100, and Deny All from Any with priority 110.
NSGs process rules in priority order, and the default implicit deny rule only applies if no explicit rule matches. By placing an explicit 'Deny All from Any' rule with a higher priority number (110) after the explicit 'Allow HTTPS' rule (priority 100), traffic from 203.0.113.0/24 on HTTPS is allowed, and all other inbound traffic is explicitly denied, ensuring no unintended implicit allow or bypass.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
One inbound rule: Allow HTTPS from 203.0.113.0/24 with priority 100. No other rules. Rely on the default deny-all rule.
Why it's wrong here
The default deny-all rule has priority 65000, which is lower than the allow rule. But any other traffic will be denied by the default rule. However, if there are other allow rules (like default allow vnet inbound), they may allow traffic from other sources. The scenario requires denying all other traffic, so a custom deny rule is needed to override any potential allow rules.
- ✓
Two inbound rules: Allow HTTPS from 203.0.113.0/24 with priority 100, and Deny All from Any with priority 110.
Why this is correct
The allow rule (priority 100) permits HTTPS from the corporate IP. The deny rule (priority 110) blocks all other inbound traffic. Since the deny rule has a lower priority number (higher priority) than any default rules, it effectively blocks everything except the allowed HTTPS traffic.
- ✗
Two inbound rules: Deny All from Any with priority 100, and Allow HTTPS from 203.0.113.0/24 with priority 110.
Why it's wrong here
The deny rule with priority 100 would block all traffic, including the HTTPS traffic from the corporate IP, because the deny rule is evaluated first (lower number = higher priority). The allow rule would never be applied.
- ✗
One inbound rule: Deny All from Any with priority 100. No allow rules. Use application security groups.
Why it's wrong here
This would block all inbound traffic, including HTTPS from the corporate network, which is not allowed. ASGs do not change the need for allow rules.
Visual reference
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has an Azure virtual network with a subnet hosting web servers. The security policy requires that all inbound HTTP traffic must be sourced from a specific IP address range (203.0.113.0/24). All other inbound traffic must be denied. The subnet is associated with a network security group (NSG). Which set of inbound rules should they configure?
medium- ✓ A.Allow HTTP from 203.0.113.0/24 (priority 100), then Deny all inbound (priority 200)
- B.Deny all inbound (priority 100), then Allow HTTP from 203.0.113.0/24 (priority 200)
- C.Allow HTTP from any (priority 100), then Deny all inbound (priority 200)
- D.Only Allow HTTP from 203.0.113.0/24 (priority 100) with no explicit deny
Why A: NSG rules are evaluated in priority order (lowest number first). The Allow rule for HTTP from 203.0.113.0/24 at priority 100 permits the desired traffic, and the subsequent Deny all inbound rule at priority 200 blocks all other traffic, including HTTP from any other source. This satisfies the security policy of allowing only HTTP from the specified IP range and denying everything else.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.