AZ-500 Secure networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure Bastion

  Why it's wrong here

  Azure Bastion is a fully managed PaaS service that provides secure inbound RDP/SSH connectivity to Azure VMs directly from the Azure portal over TLS. It is not deployed inline in the network path and has no ability to inspect, filter, or block outbound traffic from VMs to the internet. Because it only facilitates control-plane access (port 443 to the Bastion host) and never carries data-plane traffic, it cannot enforce an outbound internet blocking policy.

• ✓

  Azure Firewall

  Why this is correct

  Azure Firewall is a managed, stateful firewall service that acts as a central egress filter in a hub VNet. By creating a route table with a default route (0.0.0.0/0) to the firewall's private IP, all outbound VM traffic can be forced through it. Azure Firewall supports application rules with fully qualified domain names (FQDNs) and network rules with IP/port/protocol, allowing you to deny all outbound internet traffic while selectively permitting only specific FQDNs. This makes it the appropriate solution for the requirement to block outbound internet access except for approved destinations.

• ✗

  Network Security Groups (NSGs)

  Why it's wrong here

  Network Security Groups (NSGs) filter traffic at layers 3 and 4 using source/destination IP addresses, protocol, and port numbers. They cannot inspect application-layer payloads or evaluate FQDNs, so you cannot create a rule that blocks all outbound internet access except a specific domain. Even if you used service tags or IP address ranges, dynamic CDNs and changing endpoints would make such IP-based rules incomplete and fragile. Thus, NSGs alone are insufficient for outbound FQDN-based filtering and denial-of-internet scenarios.

• ✗

  Azure Virtual Network NAT

  Why it's wrong here

  Azure Virtual Network NAT is a managed outbound SNAT service that translates your VMs' private IP addresses to one or more public IP addresses for outbound access to the internet. It is a purely connectivity-enabling component: it does not include any rule engine, allow/deny logic, or application-layer inspection capability. Once NAT is configured, all outbound traffic is forwarded to its public IP without any ability to selectively block destinations. Therefore, it can never be used to deny or control outbound internet access; it only provides address translation.

Go deeper

Related to this question