Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Network Security Groups Filter Azure VM Traffic
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is deploying a new virtual machine (VM) in Azure to host an internal accounting application. The administrator needs to ensure that only authorized incoming traffic on specific ports is allowed to reach the VM, while all other unauthorized inbound network connections are blocked.
Which Azure networking component should the administrator configure to filter traffic based on source IP address, port, and protocol?
Explanations
Virtual Network Peering
Virtual Network Peering
What Virtual Network Peering Is
Virtual Network Peering is an Azure networking feature that connects two or more virtual networks (VNets) seamlessly. When VNets are peered, resources located in different virtual networks can communicate directly with each other using private IP addresses as if they were part of the same physical network.
Why It Doesn't Meet the Requirement
While virtual network peering enables inter-VNet connectivity, it does not filter, restrict, or block traffic based on port, IP address, or protocol. Peering merely establishes a routing path across Microsoft's high-speed backbone infrastructure. To enforce access control or filter packets traveling between peered networks, administrators must still implement Network Security Groups or firewall appliances.
Key Characteristics and Limitations
- Connectivity Mechanism: Designed solely to bridge separate address spaces across the same or different Azure regions.
- No Native Packet Filtering: Does not inspect packets or enforce allow/deny access rules based on transport-layer ports.
- Transitive Routing Limitation: Peering is non-transitive by default, meaning VNet A peered to VNet B cannot automatically communicate with VNet C through VNet B without additional routing appliances.
- Low Latency and High Bandwidth: Traffic stays completely within the Microsoft backbone and never traverses the public internet.
This Answer Would Be Correct If
The organization needed to establish private, high-performance network communication between virtual machines deployed across two separate Azure Virtual Networks without utilizing public IP addresses or VPN gateways.
Custom Route Table
Custom Route Table
What a Route Table Is
A Route Table (utilizing User-Defined Routes, or UDRs) is a networking component in Azure that allows administrators to control and override default Azure system routing paths. Route tables dictate the next-hop destination for packets leaving a subnet, directing traffic to targets like a virtual network gateway, internet, or a Network Virtual Appliance (NVA).
Why It Doesn't Meet the Requirement
Route tables determine where packets travel (routing direction), not whether individual packets are permitted or dropped based on security rules, port numbers, or transport protocols. While a route table can steer traffic toward an inspection appliance like Azure Firewall, the route table itself does not evaluate or enforce layer-4 filtering rules.
Key Characteristics and Limitations
- Path Control: Modifies traffic routing between subnets, virtual networks, and on-premises environments.
- Next-Hop Definition: Routes packets to specific destinations based on Classless Inter-Domain Routing (CIDR) prefix matching.
- No Protocol/Port Filtering: Does not analyze port numbers, connection states, or application protocols.
- Subnet Scope: Applied at the subnet boundary to enforce directional traffic flow.
This Answer Would Be Correct If
The organization needed to force all outbound internet traffic from a backend database subnet to route through a central firewall or network virtual appliance before leaving the virtual network.
Network Security Group (NSG)
Network Security Group (NSG)
What Network Security Groups Are
An Azure Network Security Group (NSG) is a core security component used to filter network traffic to and from Azure resources within an Azure Virtual Network (VNet). An NSG contains a list of security rules that allow or deny inbound and outbound network traffic based on several criteria: source and destination IP addresses, source and destination port ranges, and protocol (such as TCP or UDP).
How It Meets the Requirement
In this scenario, the organization needs to restrict access so that only traffic over authorized ports reaches the virtual machine hosting the accounting application. An NSG addresses this requirement by allowing administrators to define custom inbound security rules with specific priorities that permit designated traffic (e.g., HTTPS on port 443 or specific management ports) while relying on default or custom deny rules to block all other incoming traffic.
Key Advantages and Capabilities
- Granular Traffic Filtering: Allows defining multi-layer rules specifying source, destination, port ranges, and protocol (TCP, UDP, ICMP, or Any).
- Flexible Association: Can be associated directly with a subnet, a VM's network interface (NIC), or both to provide defense-in-depth security.
- Stateful Packet Inspection: NSGs are stateful; when an inbound connection is permitted, return outbound traffic for that session is automatically allowed regardless of outbound rules.
- Rule Prioritization: Evaluates rules sequentially based on a numeric priority score (100 to 4096), processing lower numbers first.
- Built-in Default Rules: Includes baseline platform rules to safely govern intra-virtual network traffic, load balancer health probes, and internet outbound connectivity.
Why This Is Optimal
Network Security Groups provide an integrated, native, and cost-effective mechanism for layer-4 network access control on Azure VMs. Unlike routing or addressing services, NSGs are specifically designed to serve as a distributed firewall boundary around subnets and virtual machine network interfaces.
Public IP Address
Public IP Address
What a Public IP Address Is
A Public IP Address in Azure provides external, internet-routable addressing to cloud resources. It allows inbound communication from the public internet to reach an Azure service, such as a virtual machine, and allows outbound communication directly from that resource to internet endpoints.
Why It Doesn't Meet the Requirement
A public IP address is an addressing and connectivity resource, not a security or filtering mechanism. Assigning a public IP address to a virtual machine's network interface makes the VM publicly accessible from the internet, but it does not evaluate, allow, or deny specific traffic based on port, source, or protocol rules.
Key Characteristics and Limitations
- Inbound/Outbound Reachability: Enables direct communication between public internet endpoints and Azure workloads.
- No Filtering Logic: Does not possess rule sets, priority lists, or access-control evaluation logic.
- Exposure Risk: Assigning a public IP address directly to a VM increases exposure if proper security controls (such as NSGs or firewalls) are not placed around it.
- Static or Dynamic Allocation: Can be assigned statically to retain an IP address indefinitely or dynamically upon resource startup.
This Answer Would Be Correct If
The requirement was to assign a dedicated, internet-reachable identifier to a front-end virtual machine so that external users could access a public web application.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Monitor
Describe the resources required for virtual machines
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Managed Disks
Describe the resources required for virtual machines
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Memory Optimized Virtual Machines
Describe the resources required for virtual machines
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Virtual Machine Scale Sets
Describe the resources required for virtual machines
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Functions and Azure SignalR Service
Describe serverless
IntermediateAZ-204 Developing Solutions for Microsoft Azure Exam
Azure Blob System Properties vs User-Defined Metadata
Set and retrieve properties and metadata
Last updated Validated