Design security solutions for infrastructure →mediumMultiple ChoiceObjective-mapped

NSG Not Denying Internet Traffic to Azure SQL

Exhibit

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.Network/networkSecurityGroups",
      "apiVersion": "2023-09-01",
      "name": "nsg-db",
      "properties": {
        "securityRules": [
          {
            "name": "DenySQLFromInternet",
            "properties": {
              "protocol": "Tcp",
              "sourcePortRange": "*",
              "destinationPortRange": "1433",
              "sourceAddressPrefix": "Internet",
              "destinationAddressPrefix": "VirtualNetwork",
              "access": "Deny",
              "priority": 100,
              "direction": "Inbound"
            }
          }
        ]
      }
    }
  ]
}

Refer to the exhibit. The NSG is applied to a subnet containing Azure SQL databases. You notice that traffic from the internet to the databases is not being denied. What is the most likely reason?

Quick Answer

The answer is that the destinationAddressPrefix should be '*' instead of 'VirtualNetwork'. This is because Azure SQL databases are Platform-as-a-Service (PaaS) resources that, by default, have a public endpoint and do not reside within a virtual network; the 'VirtualNetwork' tag only covers IP addresses within the virtual network’s address space, so an NSG rule using that tag cannot match or deny internet traffic destined for the SQL database’s public endpoint. On the Microsoft Cybersecurity Architect exam, this question tests your understanding of how NSG service tags and address prefixes interact with Azure PaaS services—a common trap is assuming that all Azure resources are inside a virtual network, when in fact many PaaS services require private endpoints or service endpoints to be reachable via VNet traffic. Remember that for internet-bound or internet-originating traffic to PaaS services, the destination prefix must be '*' (all traffic) or the specific public IP range, not a virtual network tag. Memory tip: "PaaS is public by default—use a star to block from afar."

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The destinationAddressPrefix should be '*' instead of 'VirtualNetwork'

The Deny rule has destinationAddressPrefix set to 'VirtualNetwork', which only matches traffic destined to IPs within the virtual network. Azure SQL databases are PaaS services with public endpoints; internet traffic does not have a destination in the VNet, so the rule never applies. Changing destinationAddressPrefix to '*' would deny all inbound internet traffic. Option A is incorrect because Allow rules cannot deny traffic. Option C is incorrect because priority 100 is high (lower number = higher priority), so the Deny rule would be evaluated before any lower priority Allow rules. Option D is incorrect because the direction must be Inbound to block incoming traffic.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The rule should be Allow to deny traffic
Why it's wrong here
Deny is correct for blocking.
✓
The destinationAddressPrefix should be '*' instead of 'VirtualNetwork'
Why this is correct
SQL databases are not in a VNet by default; use '*' to cover all destinations.
✗
The priority of the Deny rule is too low (100)
Why it's wrong here
Priority 100 is high; lower numbers are higher priority.
✗
The direction should be Outbound
Why it's wrong here
Inbound is correct for incoming traffic to the database.

Visual reference

Go deeper

1 more way this is tested on SC-100

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Refer to the exhibit. The NSG is applied to a subnet containing a web server. The web server is not receiving HTTP traffic. What is the most likely cause?

medium

A.The DenyAllOther rule has a lower priority than AllowHTTP
B.The rule direction is Inbound, but the traffic is outbound
✓ C.The sourceAddressPrefix 'Internet' does not include all source IPs
D.The priority of the AllowHTTP rule is too low (100)

Why C: The 'Internet' service tag in Azure NSG rules only includes public IP address ranges. If the HTTP traffic originates from a private IP address—such as from an on-premises network connected via VPN or ExpressRoute, or from a peered VNet—it will not match the 'Internet' tag and will be dropped by the default deny rule. Therefore, the most likely cause is that the source address prefix does not cover the actual source IPs of the incoming traffic.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.

NSG Not Denying Internet Traffic to Azure SQL

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question

1 more way this is tested on SC-100