AZ-500 Secure networking Practice Question
You are deploying a web application in Azure that must be accessible only from your corporate network via HTTPS. You have an Azure Application Gateway with a Web Application Firewall (WAF) policy. Your corporate network uses public IP addresses from a specific range. Which configuration should you use to restrict access?
⚠ Common exam trap
Test-takers frequently confuse network-layer controls (NSGs) with application-layer controls (WAF custom rules) and assume an NSG on the gateway subnet is the correct way to restrict access, but NSGs block traffic before the WAF can inspect it, breaking the intended security model.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a WAF policy with a custom rule to allow traffic only from the corporate IP range and deny all other traffic.
Azure Application Gateway's WAF policy supports custom rules that can inspect source IP addresses and allow or deny traffic based on them. By creating a custom rule with a condition matching the corporate public IP range and setting the action to 'Allow', then adding a default 'Deny' rule, you restrict access exclusively to that range over HTTPS. This approach works at the application layer (Layer 7) and is independent of network-level controls, making it the most direct and supported method for IP-based restriction on the gateway itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure a WAF policy with a custom rule to allow traffic only from the corporate IP range and deny all other traffic.
Why this is correct
A WAF policy attached to the Application Gateway can use custom rules to match on the source IP address of incoming requests. You would create a rule that permits traffic only from your corporate IP CIDR range and a subsequent (or lower-priority) rule that denies all other traffic, effectively whitelisting the corporate network. Since WAF operates at Layer 7, this restriction works alongside HTTPS termination or pass-through and does not affect the transport-level encryption.
- ✗
Create a network security group (NSG) on the subnet hosting the application gateway and allow only the corporate IP range.
Why it's wrong here
An NSG applied to the App Gateway's subnet filters traffic between Azure resources on that subnet, not traffic arriving at the gateway's public frontend IP. The public IP is owned by the gateway's frontend configuration and is outside the scope of the subnet-level NSG, so it would not block clients from reaching the HTTPS endpoint. Worse, a restrictive NSG on that subnet can intercept backend health probes and management traffic, potentially breaking gateway functionality.
- ✗
Use Azure Front Door with a WAF policy and geo-filtering to allow only your country.
Why it's wrong here
Azure Front Door's WAF geo-filtering matches on the two-letter country code derived from the client IP's geolocation, not on the exact CIDR ranges of your corporate network. This would allow traffic from any IP within the same country, including non-corporate locations, and deny any corporate IPs that are geolocated elsewhere. Additionally, introducing Front Door changes the network path and adds a CDN layer that isn't required for a simple IP-based access restriction on an existing Application Gateway.
- ✗
Set up a private endpoint for the application gateway and disable public access.
Why it's wrong here
Application Gateway does not have a 'private endpoint' feature; private endpoints are supported for Azure PaaS services such as Storage or SQL Database, not for managed gateway resources. You could assign a private frontend IP to the gateway and remove the public IP, but that would require every corporate user to have direct network connectivity into the virtual network (via VPN or ExpressRoute) rather than simply allowing the corporate IP over HTTPS. Disabling public access in that manner also prevents access from the public internet entirely, which is not the same as restricting to a specific corporate IP range.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.