Question 381 of 194
Azure Inbound Traffic Filtering: NSG and Azure Firewall
Which TWO Azure services can be used to filter inbound internet traffic to a virtual network? (Choose two.)
Quick Answer
The answer is Network Security Group (NSG) and Azure Firewall. NSGs filter inbound internet traffic at the subnet or network interface level using stateful rules, while Azure Firewall provides centralized, enterprise-grade filtering with threat intelligence and application rules across the virtual network. On the Microsoft Azure Security Engineer Associate AZ-500 exam, this tests your ability to distinguish between network-layer controls and other Azure services; a common trap is confusing Azure Front Door (a global load balancer) or VPN Gateway (encryption only) with filtering tools. Remember that NSGs are your first line of defense for granular traffic control, while Azure Firewall handles broader policy enforcement and logging. A useful memory tip: think “NSG for the neighborhood, Firewall for the whole city” — NSGs protect specific subnets or NICs, whereas Azure Firewall secures the entire virtual network perimeter.
⚠ Common exam trap
The trap here is that candidates may overlook NSGs because they are a basic security feature, thinking only a dedicated firewall service can filter inbound traffic. However, NSGs are perfectly capable of filtering inbound internet traffic at the network layer. Another common mistake is selecting Azure Bastion, which is a secure jump box for management traffic, not a general traffic filter.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Firewall
Both Azure Firewall and Network Security Groups (NSGs) can filter inbound internet traffic to a virtual network. Azure Firewall provides centralized, stateful filtering at Layers 3-7 with features like threat intelligence and application rules. NSGs are distributed, stateful packet filters that apply to subnets or NICs, filtering traffic based on source/destination IP, port, and protocol rules, and are commonly used to block inbound internet traffic at the subnet boundary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Firewall
Why this is correct
Correct. Azure Firewall can filter inbound internet traffic using network and application rules at Layers 3-7.
- ✗
Azure Bastion
Why it's wrong here
Incorrect. Azure Bastion provides secure RDP/SSH access to VMs without exposing them to the internet, but it does not filter general inbound traffic.
- ✗
Azure Front Door
Why it's wrong here
Incorrect. Azure Front Door is a global load balancer and application delivery controller; it can filter traffic based on WAF policies but is not primarily designed to filter all inbound internet traffic to a virtual network.
- ✓
Network security group (NSG)
Why this is correct
Correct. NSGs filter inbound traffic at the subnet or NIC level using rules based on IP, port, and protocol.
- ✗
VPN gateway
Why it's wrong here
Incorrect. VPN gateway handles encrypted traffic between on-premises and Azure, not general inbound internet traffic filtering.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to block inbound traffic from the internet to a specific subnet except for TCP port 443. Which Azure service should you use?
easy- A.Azure Web Application Firewall (WAF)
- B.Azure Firewall
- ✓ C.Network security group (NSG)
- D.Azure DDoS Protection
Why C: Network security groups (NSGs) are the correct choice because they provide stateful filtering of inbound and outbound traffic at the subnet or NIC level. By creating an inbound security rule that denies all traffic from the Internet (source 'Internet' service tag) and a higher-priority allow rule for TCP port 443, you can precisely block all inbound internet traffic except HTTPS. NSGs are the native Azure service for granular subnet-level access control lists (ACLs).
Last reviewed: Jul 4, 2026
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.