AZ-500 Secure networking Practice Question
A company has an Azure virtual network with a subnet hosting web servers. The security policy requires that all inbound HTTP traffic must be sourced from a specific IP address range (203.0.113.0/24). All other inbound traffic must be denied. The subnet is associated with a network security group (NSG). Which set of inbound rules should they configure?
⚠ Common exam trap
Candidates often think a single Allow rule with no explicit Deny is sufficient, forgetting that NSGs have default implicit allow rules (e.g., AllowVNetInBound) that would permit other traffic unless explicitly denied.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Allow HTTP from 203.0.113.0/24 (priority 100), then Deny all inbound (priority 200)
NSG rules are evaluated in priority order (lowest number first). The Allow rule for HTTP from 203.0.113.0/24 at priority 100 permits the desired traffic, and the subsequent Deny all inbound rule at priority 200 blocks all other traffic, including HTTP from any other source. This satisfies the security policy of allowing only HTTP from the specified IP range and denying everything else.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Allow HTTP from 203.0.113.0/24 (priority 100), then Deny all inbound (priority 200)
Why this is correct
This rule set works because NSG rules are processed in ascending priority order, and a lower numeric priority (100) is evaluated before a higher one (200). The specific allow rule for HTTP from 203.0.113.0/24 is matched first, permitting only that source and port, after which the deny-all rule at priority 200 blocks any inbound traffic that did not match the earlier allow. Critically, Azure's default inbound rules (AllowVnetInBound and AllowAzureLoadBalancerInBound) remain in effect unless explicitly denied, so the explicit deny-all is necessary to close those implicit allowances and enforce a true allowlist. The ordering ensures the desired traffic is accepted before the catch-all deny blocks everything else.
- ✗
Deny all inbound (priority 100), then Allow HTTP from 203.0.113.0/24 (priority 200)
Why it's wrong here
This configuration is incorrect because the deny-all rule at priority 100 is evaluated before the HTTP allow rule at priority 200, and NSG processing stops at the first rule that matches the packet. Since the deny-all rule matches every inbound packet, all HTTP traffic from 203.0.113.0/24 is blocked immediately, and the allow rule is never reached. Even though the allow rule is more specific in terms of source and port, priority takes precedence over specificity in Azure NSGs, so this ordering effectively creates a total inbound block. The intended allowlist behavior is completely defeated because no traffic from the specified range can pass.
- ✗
Allow HTTP from any (priority 100), then Deny all inbound (priority 200)
Why it's wrong here
This rule order is wrong because the allow rule at priority 100 does not restrict the source address: it permits HTTP from any source, meaning the subnet is open to the entire internet for port 80. The deny-all rule at priority 200 then blocks all non-HTTP traffic, but it cannot undo the overly permissive HTTP allowance because the allow rule was already matched first. The result violates the intended policy of limiting HTTP access only to 203.0.113.0/24, and it exposes the web servers to unauthorized clients. To correctly implement the requirement, the source prefix in the allow rule must be the specific 203.0.113.0/24 range, not "any."
- ✗
Only Allow HTTP from 203.0.113.0/24 (priority 100) with no explicit deny
Why it's wrong here
Incorrect. Without an explicit deny rule to block other traffic, the default NSG rule (allow inbound from virtual network and load balancer) would allow other traffic not explicitly denied. To deny all other inbound, an explicit deny-all rule is needed.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.