AZ-500 NSGs have default inbound and outbound rules. Practice Question
A company has an Azure virtual network with a subnet that hosts a web application. The security team wants to allow inbound HTTPS traffic (port 443) from the internet to the web servers, but block all other inbound traffic. They have a network security group (NSG) associated with the subnet. What is the minimal set of inbound rules required?
⚠ Common exam trap
It's easy for candidates to think they must add an explicit deny rule to block all other traffic, not realizing that Azure NSGs already include a default deny-all inbound rule that is automatically applied at the lowest priority.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A rule allowing HTTPS from Internet, and no other rules (default deny all inbound).
Network security groups (NSGs) in Azure have a default deny-all inbound rule (rule 65500) that is automatically applied to all inbound traffic. Therefore, you only need to add an explicit allow rule for HTTPS (port 443) from the Internet. No additional deny rule is required because the default rule already blocks all other inbound traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A rule allowing HTTPS from Internet, and a default deny all rule.
Why it's wrong here
An NSG always includes built-in default inbound rules, including DenyAllInbound at the lowest priority (65500), so every packet that does not match a higher-priority allow rule is implicitly blocked. Adding an explicit 'default deny all rule' is redundant and does not change behavior; it also misrepresents the model, because no such user-defined rule is required. The minimal, correct configuration is only the HTTPS allow rule, relying on the pre-existing default deny to block everything else.
- ✓
A rule allowing HTTPS from Internet, and no other rules (default deny all inbound).
Why this is correct
The default DenyAllInbound rule in every NSG already blocks all inbound traffic from the Internet, so adding only an inbound rule that allows HTTPS (TCP 443) from the Internet source service tag is sufficient. Because NSG rules are evaluated in priority order, HTTPS traffic matches the allow rule before reaching the default deny rule, while all other inbound traffic is implicitly denied. This is the minimal viable configuration because no additional deny rules are needed.
- ✗
A rule allowing HTTPS from Internet, and a rule explicitly denying all other inbound traffic.
Why it's wrong here
An explicit rule denying all other inbound traffic is functionally redundant: the built-in DenyAllInbound default rule already drops any inbound packet that does not match an allow rule, regardless of source or port. Adding such a rule increases rule count and management overhead without changing the security outcome, and it can create confusion about which deny rule is authoritative. The correct answer remains a single HTTPS allow rule, letting the implicit default deny handle everything else.
- ✗
A rule allowing HTTPS from any source, and a rule denying all other traffic with lower priority.
Why it's wrong here
This approach is wrong for two independent reasons: sourcing HTTPS from 'any source' is overly permissive because it also permits traffic from other virtual networks and on-premises networks, not just the Internet, violating least-privilege access; and the lower-priority deny-all rule is unnecessary because the default DenyAllInbound rule already blocks all unmatched inbound traffic. Additionally, if the allow rule has a higher priority, the deny rule never even evaluates for HTTPS traffic, so it adds no protection. A correct rule should use the Internet service tag and omit the explicit deny.
Visual reference
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.