AZ-500 Practice Question: NSGs have default rules that cannot be removed.
A company has an Azure virtual network with a subnet that hosts a web application. They want to allow inbound HTTPS traffic from any source on the internet (0.0.0.0/0) and block all other inbound traffic. They associate a network security group (NSG) with the subnet. What is the minimum number of inbound security rules required to achieve this?
⚠ Common exam trap
The trap here is that candidates often forget about the default NSG rules, especially the 'DenyAllInbound' rule, and incorrectly assume they must add an explicit deny rule to block all other traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
One inbound rule allowing HTTPS from Internet.
An NSG includes a set of default security rules that already block all inbound traffic not explicitly allowed. By adding a single inbound rule that allows HTTPS (TCP port 443) from the Internet (0.0.0.0/0), the default deny rule (DenyAllInbound) will block all other inbound traffic. Therefore, only one custom inbound rule is required to achieve the stated goal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
One inbound rule allowing HTTPS from Internet, and one inbound rule DenyAllInbound.
Why it's wrong here
The DenyAllInbound rule is redundant because every NSG includes an unremovable default rule named DenyAllInbound at priority 65500 that blocks all inbound traffic not explicitly allowed by a higher-priority rule. Adding your own deny rule does not change the effective outcome because the default deny already applies, and it can mislead future administrators into thinking traffic is denied only by their rule. Therefore, the explicit DenyAllInbound should be omitted; a single HTTPS allow rule is sufficient.
- ✓
One inbound rule allowing HTTPS from Internet.
Why this is correct
An NSG's default inbound security rules include a low-priority DenyAllInbound rule at priority 65500 that blocks any traffic not matched by a higher-priority allow rule. By creating one inbound allow rule for HTTPS (TCP 443) with a priority such as 100, legitimate HTTPS traffic to the web tier is permitted while all other inbound traffic is implicitly denied. Because the default deny rule is always evaluated last, this single rule fully satisfies the requirement and no other rules are necessary.
- ✗
Two inbound rules: one allowing HTTPS from Internet, one allowing HTTP from Internet.
Why it's wrong here
Adding an HTTP (TCP 80) allow rule in addition to HTTPS unnecessarily exposes the web tier to unencrypted traffic. HTTP transmits data in plaintext, making it susceptible to interception and tampering, and it violates the principle of least privilege because only HTTPS is required. The default deny rule remains in effect for all other ports, so the only effect of this extra rule is to permit insecure traffic on port 80. Thus, the second rule should be removed, keeping only the HTTPS allow.
- ✗
Two inbound rules: one allowing HTTPS from Internet, one allowing RDP from Internet.
Why it's wrong here
Permitting RDP (TCP 3389) from the internet directly to the web tier's subnet is a serious security vulnerability. The default deny rule would correctly block this traffic if no allow rule were present; adding an RDP allow rule creates a direct administrative attack surface and violates the recommendation to manage VMs via a bastion host, Azure Bastion, or a VPN. RDP should never be exposed to the internet, especially on a subnet hosting a public web application. Only the HTTPS rule is appropriate.
Visual reference
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 617-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.