Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Refer to the exhibit.
```json
{
  "id": "my-policy",
  "name": "Block external sharing",
  "type": "microsoft.network/networkmanager/securityadminrules",
  "properties": {
    "description": "Block all external sharing",
    "priority": 100,
    "direction": "Inbound",
    "access": "Deny",
    "sourceAddressRanges": ["Internet"],
    "sourcePortRanges": ["*"],
    "destinationAddressRanges": ["10.0.0.0/24"],
    "destinationPortRanges": ["445"],
    "protocols": ["TCP"]
  }
}
```

Refer to the exhibit. You are a security administrator for a company using Azure Virtual Network Manager. You have deployed the security admin configuration shown. What is the impact of this rule?

⚠ Common exam trap

Many exam-takers confuse a specific port deny rule (SMB on port 445) with a general 'deny all' rule, or incorrectly assume the rule affects outbound traffic because they misread the direction or priority logic.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

It blocks inbound SMB traffic from the internet to the subnet.

This security admin configuration in Azure Virtual Network Manager creates a rule that denies inbound traffic on port 445 (SMB) from the 'Internet' service tag to the target subnet. Since the rule has a priority of 100 (lowest number = highest priority) and the action is 'Deny', it overrides any lower-priority or default allow rules, effectively blocking inbound SMB traffic from the internet to the subnet. The rule does not affect outbound traffic or other protocols like RDP unless they are explicitly specified.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
It blocks inbound SMB traffic from the internet to the subnet.
Why this is correct
This rule correctly identifies that Server Message Block (SMB) communication primarily uses TCP port 445. By setting the direction to 'Inbound' and the source to 'Internet' (or a broad public IP range), the rule effectively denies any attempts from external networks to establish an SMB connection with resources within the protected subnet. Blocking inbound SMB from the internet is a critical security measure to prevent common exploits and ransomware attacks that target this protocol.
✗
It blocks outbound traffic from the subnet to the internet.
Why it's wrong here
This statement is incorrect because the rule's direction is explicitly set to 'Inbound'. An 'Inbound' rule governs traffic originating from outside the network and attempting to enter the protected subnet. To block outbound traffic, which originates from within the subnet and attempts to exit to the internet, a separate rule with the direction set to 'Outbound' would be required. Therefore, this specific rule has no effect on traffic leaving the subnet.
✗
It denies all traffic from the internet to the subnet.
Why it's wrong here
This assertion is inaccurate because the rule is highly specific, targeting only TCP traffic on destination port 445. While it does deny inbound traffic from the internet, it does so exclusively for the SMB protocol. Traffic on other ports, such as HTTP (port 80), HTTPS (port 443), or RDP (port 3389), would not be affected by this particular rule and would still be permitted unless explicitly denied by other, distinct network security group rules. Thus, it does not deny all traffic.
✗
It blocks inbound RDP traffic from the internet.
Why it's wrong here
This option is incorrect because Remote Desktop Protocol (RDP) typically operates on TCP port 3389, not port 445. The rule in question is configured to deny traffic specifically on port 445, which is associated with SMB. Consequently, this rule would have no impact on inbound RDP traffic from the internet, as RDP connections would attempt to use port 3389 and would therefore bypass the denial specified for port 445. Separate rules are needed to manage RDP access.

Visual reference

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question