AZ-500 Secure networking Practice Question
Network Topology
Refer to the exhibit. A security administrator runs the Azure CLI commands to create a VM with a single NIC and applies an NSG rule to deny outbound TCP traffic to the Internet on ports 80 and 443. However, the VM can still access websites on the Internet. What is the most likely reason?
⚠ Common exam trap
Watch out — candidates often assume NIC-level NSG rules always take precedence over subnet-level NSG rules, but in reality, subnet-level rules are evaluated first and can allow traffic that NIC-level rules would deny.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NSG rule is applied at the NIC level, but the subnet's NSG (if any) has a default outbound allow rule that takes precedence.
When an NSG is associated with both a subnet and a NIC, effective security rules are evaluated in order of priority, and subnet-level NSG rules are evaluated before NIC-level NSG rules. If the subnet has a default outbound allow rule (or a higher-priority allow rule), it will permit outbound TCP traffic to the Internet on ports 80 and 443, overriding the deny rule applied at the NIC level. The VM can still access websites because the subnet NSG's default outbound allow rule takes precedence over the NIC-level deny rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The NSG rule uses the 'Internet' service tag incorrectly; it should specify an IP range.
Why it's wrong here
The 'Internet' service tag is valid for outbound rules to the internet.
- ✗
The NSG is not associated with the NIC because the command did not specify the NIC correctly.
Why it's wrong here
The command 'az network nic update' with --network-security-group associates the NSG to the NIC.
- ✓
The NSG rule is applied at the NIC level, but the subnet's NSG (if any) has a default outbound allow rule that takes precedence.
Why this is correct
If the subnet has no NSG, the default outbound allow rule permits traffic, and the NIC NSG rule is not evaluated because the first match (subnet default allow) applies.
- ✗
The NSG rule should be an inbound rule to block outbound traffic.
Why it's wrong here
Outbound traffic is controlled by outbound rules; inbound rules are for incoming traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.