AZ-500 Secure networking Practice Question

Correct answer & explanation

The NSG rule denies traffic to 'Internet' service tag, but the NIC is attached to a subnet that may also have an NSG that allows outbound traffic. Additionally, the rule specifies 'Tcp' protocol with ports 80 and 443, but HTTPS uses TCP port 443. The rule should block it. However, Azure VMs have a default outbound access via SNAT; if the VM is using a public IP or has a default route, the NSG should block. The most likely issue is that the NSG is applied to the NIC but not to the subnet, and the subnet's default NSG (or lack thereof) allows traffic. But the commands show NSG applied to NIC. Another possibility: the rule priority is 100, but maybe there is a higher priority allow rule? The commands do not show any allow rule. Actually, the problem may be that the NSG rule's protocol is 'Tcp' but the outbound traffic might be using UDP? Unlikely. The correct answer is that the NSG is not associated with the subnet; NIC-level NSG works, but the rule's destination is 'Internet' tag, which should work. The most plausible answer is that the VM has a public IP and the NSG rule is outbound, but maybe the VM is using a different port (e.g., 443 is blocked but 80 is allowed? No). Wait, the commands do not create a VM; they create a NIC and NSG, but the NIC is not attached to a VM? Actually, the commands create a VNet, subnet, NIC, NSG, and attach NSG to NIC. They do not create a VM. But the stem says 'creates a VM with a single NIC' assuming the NIC is used for a VM. The real issue: the NSG rule denies TCP to Internet on ports 80 and 443, but the VM may be using a different protocol (e.g., HTTP/HTTPS uses TCP). The most likely reason: the NSG is applied at the NIC level, but the subnet may have a separate NSG that allows the traffic, and NSG rules are evaluated at both levels (subnet first, then NIC). If the subnet NSG allows, the traffic is allowed. The commands do not apply an NSG to the subnet. Therefore, the default subnet NSG (if any) or no NSG on subnet means no filtering at subnet level. However, the NIC NSG should still block. Actually, Azure NSG evaluation: subnet NSG is evaluated first, then NIC NSG. If subnet NSG has no rule, it defaults to allow all. So the traffic would be allowed by subnet NSG default allow, and then NIC NSG denies, but the overall is deny? Actually, security rules are evaluated and the first match applies. If subnet NSG has no rule (default deny inbound, default allow outbound), the default outbound allow would match and allow the traffic before the NIC NSG rule is evaluated. That's the catch: default outbound allow in subnet NSG lets traffic out, and the NIC NSG deny rule is not evaluated because a match already occurred. So the correct answer is that the subnet has no NSG, and its default outbound rule allows all traffic.

Key principle: Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.