AZ-500 Secure networking Practice Question
You have an Azure virtual machine that hosts a web application. You need to allow inbound HTTP (80) and HTTPS (443) traffic from the internet to this VM only. You also need to allow outbound traffic to the internet from the VM. You want to use a managed Azure service with minimal configuration. What should you use?
⚠ Common exam trap
The trap here is that candidates often overthink and choose Azure Firewall or Application Gateway for simple traffic filtering, forgetting that an NSG is the most lightweight, cost-effective, and minimal-configuration managed service for basic inbound/outbound access control on a single VM.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network Security Group (NSG)
A Network Security Group (NSG) is the correct choice because it is a managed Azure service that provides a stateful, layer-3/4 firewall for filtering inbound and outbound traffic to a virtual machine. With minimal configuration, you can create inbound rules to allow HTTP (TCP/80) and HTTPS (TCP/443) from the internet (source 'Internet' or 'Any') and an outbound rule to allow all traffic to the internet (default outbound rule already allows this). NSGs are directly associated with a VM's subnet or network interface, making them the simplest managed solution for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Application Gateway
Why it's wrong here
Azure Application Gateway is a layer-7 load balancer and Web Application Firewall designed to route inbound HTTP/HTTPS traffic to backend pools based on URL paths, host headers, or other L7 attributes. For a single VM needing basic per-VM connectivity rules, it introduces significant operational overhead—you must configure listeners, routing rules, and health probes—and it does not manage outbound internet access from the VM. Therefore, while it could technically proxy incoming web traffic, it is not the minimal, direct security control required here.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is not the appropriate choice here because it is designed for centralised network security across multiple workloads or virtual networks, not for securing a single VM directly with minimal configuration. Implementing it for a lone VM would introduce unnecessary routing complexity and cost. However, it is tempting as a managed firewall service, and would be the correct option for enterprise-grade scenarios requiring advanced, centralised traffic filtering, threat intelligence, and policy enforcement for an entire network.
- ✓
Network Security Group (NSG)
Why this is correct
A Network Security Group (NSG) is the correct, lightweight choice because it acts as a stateful, distributed packet filter that you can attach directly to the VM's NIC or its subnet. You can define allow/deny rules for inbound HTTP/HTTPS (e.g., ports 80/443) while relying on the default outbound internet access that NSGs permit unless you explicitly block it. It is free, requires no additional infrastructure, and its simplicity aligns perfectly with the requirement to secure a single VM hosting a web application.
- ✗
Azure Bastion
Why it's wrong here
Azure Bastion is a fully managed platform-as-a-service offering that provides secure, browser-based RDP and SSH connectivity to virtual machines over the Azure portal. It does not filter general application traffic such as HTTP/HTTPS, nor does it govern outbound internet access from the workload—it only mediates interactive administrative sessions. Deploying Bastion for this requirement would be both functionally irrelevant and an unnecessary cost, as it is not a network security control for application data plane traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.