nerdexam
Microsoft

AZ-500 · Question #50

Hotspot Question You have an Azure subscription named Sub1. You create a virtual network that contains one subnet. On the subnet, you provision the virtual machines shown in the following table…

The correct answer is The number of NSGs you should create is 2. = Yes; The number of network security rules you should create is 3. = Yes. The optimal solution requires 2 NSGs: one applied to the subnet containing VM3 and VM4 (or just VM4's NIC) and one applied to the subnet or NICs for VM1 and VM2 to allow inbound Internet traffic. With 2 NSGs you need 3 rules total: (1) an inbound rule on the VM4 NSG allowing…

Submitted by minji_kr· Mar 6, 2026Implement and manage virtual networking - specifically configuring Network Security Groups (NSGs) and security rules to control inbound and outbound traffic in Azure Virtual Networks, aligning with the AZ-104 'Configure and manage virtual networking' domain objective.

Question

Hotspot Question You have an Azure subscription named Sub1. You create a virtual network that contains one subnet. On the subnet, you provision the virtual machines shown in the following table. Currently, you have not provisioned any network security groups (NSGs). You need to implement network security to meet the following requirements: - Allow traffic to VM4 from VM3 only. - Allow traffic from the Internet to VM1 and VM2 only. - Minimize the number of NSGs and network security rules. How many NSGs and network security rules should you create? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:

Exhibits

AZ-500 question #50 exhibit 1
AZ-500 question #50 exhibit 2

Answer Area

  • The number of NSGs you should create is 2.Yes
  • The number of network security rules you should create is 3.Yes

Explanation

The optimal solution requires 2 NSGs: one applied to the subnet containing VM3 and VM4 (or just VM4's NIC) and one applied to the subnet or NICs for VM1 and VM2 to allow inbound Internet traffic. With 2 NSGs you need 3 rules total: (1) an inbound rule on the VM4 NSG allowing traffic from VM3 only, (2) an inbound rule on the VM1/VM2 NSG allowing traffic from the Internet, and (3) a deny rule to block other traffic - though Azure's default deny rules may reduce the need for explicit deny rules, making 3 custom rules sufficient to meet all requirements while minimizing rule count. By strategically placing NSGs at the subnet or NIC level and leveraging default deny behavior, you achieve all security requirements with the minimum number of NSGs and rules.

Topics

#Network Security Groups#Azure Virtual Networks#Network Security Rules#Subnet Security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice