A company has an Azure virtual network with a subnet that hosts a public web application. They want to allow inbound HTTPS traffic (port 443) only from the source IP range 203.0.113.0/24, and block all other inbound traffic. They associate a network security group (NSG) with the subnet. What is the minimum number of inbound security rules required in the NSG to achieve this?

0 (no additional rules needed because the default rules block all inbound traffic)

The default rules block traffic from the internet, so no HTTPS traffic would be allowed. An explicit allow rule is required.

2 (one allow rule for HTTPS and one deny rule for all other traffic)

An explicit deny rule is unnecessary because the NSG already includes a default deny all inbound rule. Adding an explicit deny would be redundant.

3 (one allow HTTPS, one allow for Azure Load Balancer health probes, and one deny all)

The default rules already allow Azure Load Balancer health probes. No additional rule is needed for that, and the explicit deny is still redundant.

What does this AZ-500 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: 1 — Network Security Groups include default inbound rules that allow traffic within the virtual network and from Azure load balancers, but they implicitly deny all other inbound traffic unless a permit rule is added. To allow HTTPS from the specific range, only one inbound allow rule is needed: a rule with priority, source IP range 203.0.113.0/24, destination port 443, protocol TCP, and action Allow. The default deny all rule handles blocking all other traffic, so no explicit deny rule is required.

What should I do if I get this AZ-500 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.