AZ-500 Secure networking Practice Question
You have an Azure virtual machine that hosts a custom web application. You need to restrict inbound internet traffic to only HTTPS (port 443) from any source. Which Azure resource should you configure?
⚠ Common exam trap
Watch out — candidates often confuse Azure Firewall with NSGs, thinking a full firewall is required for any traffic filtering, but for simple port-based restrictions on a single VM, an NSG is the correct and cost-effective choice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network Security Group (NSG)
A Network Security Group (NSG) is the correct choice because it acts as a distributed, stateful firewall that filters inbound and outbound traffic at the subnet or network interface level. By creating an inbound security rule allowing TCP port 443 from any source (0.0.0.0/0) and denying all other inbound traffic, you can restrict internet traffic to HTTPS only. NSGs are the native Azure resource for controlling network traffic to VMs without additional cost or complexity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Application Security Group (ASG)
Why it's wrong here
Application Security Groups (ASGs) are logical containers that group virtual machines or NICs by workload or role, enabling you to define granular security policies within a network security group (NSG). An ASG does not itself evaluate or filter traffic; it only serves as a source or destination attribute in an NSG rule. To allow HTTPS from the Internet to your custom web app, you would still need an NSG with an inbound rule referencing the ASG as the destination, but the ASG alone cannot block or permit any traffic. Therefore, selecting ASG is incorrect because it is not a standalone traffic-filtering resource.
- ✗
Azure Bastion
Why it's wrong here
Azure Bastion is a fully managed platform-as-a-service (PaaS) resource that provides secure RDP and SSH connectivity to virtual machines directly through the Azure portal over a private IP address. It is designed to substitute for exposing a public RDP/SSH port; it does not filter or inspect inbound application traffic like HTTPS to a web app. Since your requirement is to allow inbound HTTPS to a custom web application, Azure Bastion is irrelevant and would not provide the necessary access control, making it an incorrect choice.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall operates at the network and application layers but requires explicit rule configuration for HTTPS inspection and does not natively provide a simple, global "allow HTTPS from any source" rule without also permitting other traffic if misconfigured. It is tempting because it can filter inbound traffic, yet the correct resource—a network security group (NSG)—directly controls inbound port access at the subnet or NIC level with a single security rule. Azure Firewall would be correct if you needed centralised logging, threat intelligence integration, or application-layer filtering across multiple virtual networks.
- ✓
Network Security Group (NSG)
Why this is correct
A Network Security Group (NSG) is a stateful traffic-filtering resource that you can associate with a virtual machine's NIC or a virtual network subnet to allow or deny inbound and outbound traffic based on rules. To allow HTTPS from the Internet to your custom web app, you would add an inbound security rule with source set to 'Internet', destination set to the VM's IP (or its NIC/ASG), protocol set to TCP, and destination port set to 443. NSGs are the correct and simplest resource for this scenario because they enforce security rules directly at the network interface or subnet level, blocking any traffic that does not match an explicit allow rule. This is why NSG is the correct answer.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 617 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.