Design solutions that align with security best practices and priorities →mediumMultiple ChoiceObjective-mapped

SC-100 Network Security Group (NSG) rule priority Practice Question

Exhibit

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.Network/networkSecurityGroups",
      "apiVersion": "2020-06-01",
      "name": "nsg-web",
      "properties": {
        "securityRules": [
          {
            "name": "AllowHTTP",
            "properties": {
              "protocol": "Tcp",
              "sourcePortRange": "*",
              "destinationPortRange": "80",
              "sourceAddressPrefix": "*",
              "destinationAddressPrefix": "*",
              "access": "Allow",
              "priority": 100,
              "direction": "Inbound"
            }
          },
          {
            "name": "DenyAll",
            "properties": {
              "protocol": "*",
              "sourcePortRange": "*",
              "destinationPortRange": "*",
              "sourceAddressPrefix": "*",
              "destinationAddressPrefix": "*",
              "access": "Deny",
              "priority": 200,
              "direction": "Inbound"
            }
          }
        ]
      }
    }
  ]
}

Refer to the exhibit. You are reviewing an ARM template that deploys a network security group (NSG) for a web application. The NSG allows inbound HTTP traffic from any source and then denies all other inbound traffic. However, after deployment, you find that HTTP traffic is being blocked. What is the most likely cause?

⚠ Common exam trap

Candidates often overlook that NSG rules are evaluated in priority order (lower number = higher priority). A deny-all rule with a priority lower than the allow rule will block the intended traffic.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The DenyAll rule has a higher priority than the AllowHTTP rule, so it takes precedence.

The DenyAll rule has a higher priority (lower priority number) than the AllowHTTP rule, so it is evaluated first and blocks all traffic, including HTTP. To fix this, the AllowHTTP rule should have a higher priority (lower number) than the DenyAll rule.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The AllowHTTP rule uses sourcePortRange '*' which conflicts with the DenyAll rule.
Why it's wrong here
In an inbound NSG rule, sourcePortRange '*' is a valid wildcard meaning the rule applies to packets from any source port, which is standard for inbound web traffic because the client's ephemeral source port is unpredictable. Using '*' here does not create a conflict with the DenyAll rule; rule precedence is determined solely by the priority number, not by port range specifications. The only way AllowHTTP would 'conflict' with DenyAll is if their destination port ranges overlap and DenyAll has a better (lower) priority, so blaming sourcePortRange '*' is incorrect.
✗
The NSG is not associated with the subnet or network interface where the web server is deployed.
Why it's wrong here
If the NSG were not associated, the default Azure security rules would apply, which include a 'DenyAllInbound' rule that blocks internet HTTP traffic. However, the question assumes the NSG was created and associated, making rule priority a more direct cause.
✓
The DenyAll rule has a higher priority than the AllowHTTP rule, so it takes precedence.
Why this is correct
In Azure, NSG rules are evaluated in ascending priority order, where smaller numbers are processed first and the first matching rule determines the outcome. If DenyAll has a numerically lower priority (e.g., 100) than AllowHTTP (e.g., 200), then incoming TCP port 80 HTTP traffic matches DenyAll first, and since its action is Deny, the packet is dropped before AllowHTTP is ever considered. This explicit numeric precedence is the direct cause of the HTTP failure, making the higher priority of DenyAll the definitive reason.
✗
The DenyAll rule uses protocol '*' which blocks all traffic including HTTP.
Why it's wrong here
In Azure NSG rules, the protocol wildcard '*' matches all protocols, including TCP where HTTP runs, so it indeed matches HTTP traffic. However, the protocol specification alone does not cause the blocking; NSG evaluation is based on priority order, and a lower-priority AllowHTTP rule for destination port 80 would still permit traffic if its priority number were smaller. Because the DenyAll rule's action is what ultimately applies for the match, the blocking is primarily a result of priority ordering, not merely the use of the '*' protocol wildcard.

Go deeper

SC-100 Network Security Group (NSG) rule priority Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question