Case Study 2 - Contoso, Ltd Overview Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York. The company hosts its entire server…

Important Caveat The question references specific NSG rule tables and VM/subnet assignments that are not included in the text you provided. Without those tables, I cannot give definitive Yes/No answers. However, I can explain exactly how to reason through each statement - this…

Submitted by mike_84· Mar 6, 2026Secure networking

Question

Case Study 2 - Contoso, Ltd Overview Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York. The company hosts its entire server infrastructure in Azure. Contoso has two Azure subscriptions named Sub1 and Sub2. Both subscriptions are associated to an Azure Active Directory (Azure AD) tenant named contoso.com. Technical requirements Contoso identifies the following technical requirements: Deploy Azure Firewall to VNetWork1 in Sub2. Register an application named App2 in contoso.com. Whenever possible, use the principle of least privilege. Enable Azure AD Privileged Identity Management (PIM) for contoso.com Existing Environment Azure AD Contoso.com contains the users shown in the following table. Contoso.com contains the security groups shown in the following table. Sub1 Sub1 contains six resource groups named RG1, RG2, RG3, RG4, RG5, and RG6. User2 creates the virtual networks shown in the following table. Sub1 contains the locks shown in the following table. Sub1 contains the Azure policies shown in the following table. Sub2 Sub2 contains the virtual machines shown in the following table. All virtual machines have the public IP addresses and the Web Server (IIS) role installed. The firewalls for each virtual machine allow ping requests and web requests. Sub2 contains the network security groups (NSGs) shown in the following table. NSG1 has the inbound security rules shown in the following table. NSG2 has the inbound security rules shown in the following table. NSG3 has the inbound security rules shown in the following table. NSG4 has the inbound security rules shown in the following table. NSG1, NSG2, NSG3, and NSG4 have the outbound security rules shown in the following table. Contoso identifies the following technical requirements: Deploy Azure Firewall to VNetwork1 in Sub2. Register an application named App2 in contoso.com. Whenever possible, use the principle of least privilege. Enable Azure AD Privileged Identity Management (PIM) for contoso.com. Hotspot Question You are evaluating the security of the network communication between the virtual machines in Sub2. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Exhibits

Answer Area

From VM1, you can successfully ping the public IP address of VM2.
From VM1, you can successfully ping the private IP address of VM3.
From VM1, you can successfully ping the public IP address of VM5.

Explanation

Important Caveat

The question references specific NSG rule tables and VM/subnet assignments that are not included in the text you provided. Without those tables, I cannot give definitive Yes/No answers. However, I can explain exactly how to reason through each statement - this is the skill the exam is testing.

Framework for Evaluating NSG-Based Ping Questions

Core Concepts You Must Apply

1. NSG Rule Evaluation

Rules are processed by priority (lowest number first)
First matching rule wins - processing stops
Default rules at the end: AllowVnetInBound, AllowAzureLoadBalancerInBound, DenyAllInBound
ICMP (ping) must be explicitly permitted - it does not automatically pass just because HTTP/RDP is allowed

2. Public IP vs. Private IP Traffic Path

Traffic Type	Path
VM1 -> VM2 public IP	Leaves VNet -> Internet -> re-enters via VM2's NIC -> hits VM2's NSG inbound rules
VM1 -> VM3 private IP	Stays inside VNet -> hits VM3's NSG inbound rules with source tag `VirtualNetwork`

This distinction matters because NSG rules filter differently depending on whether traffic is tagged as Internet or VirtualNetwork.

3. OS Firewall vs. NSG The case study states all VM firewalls allow ping. So OS-level blocking is not the issue - focus entirely on NSG rules.

How to Answer Each Statement

Statement 1: VM1 -> ping public IP of VM2

What to check:

VM2's associated NSG inbound rules
Look for a rule that allows ICMP (protocol = ICMP or Any) from source Internet or *
If no such rule exists before a DenyAll, the answer is No

Key concept: Traffic to a public IP is tagged as Internet source. Most NSGs in exam scenarios only explicitly allow TCP 80/443/3389 - ICMP is denied by the default DenyAllInBound rule.

Statement 2: VM1 -> ping private IP of VM3

What to check:

VM3's associated NSG inbound rules
Look for a rule allowing ICMP from source VirtualNetwork or the specific subnet/IP of VM1
The default AllowVnetInBound rule does allow all traffic from the VNet tag - but only if no higher-priority rule denies it first

Key concept: If NSG3 has a high-priority Deny Any rule for inbound traffic before the AllowVnetInBound default, pings from within the same VNet are still blocked.

Statement 3: VM1 -> ping public IP of VM5

What to check:

VM5's associated NSG (or whether VM5 has an NSG at all)
If VM5 has no NSG, or its NSG has a rule Allow ICMP Any, the answer is Yes
Also check if VM5 is on a subnet with a subnet-level NSG

Key concept: No NSG = all traffic flows. A missing or permissive NSG is often the "Yes" scenario in exam questions.

Memory Tips

Scenario	Remember
Public IP ping	Think "Internet source tag" - most NSGs deny ICMP from Internet by default
Private IP ping	Think "`AllowVnetInBound`" - allowed by default unless overridden by a higher-priority Deny rule
No NSG on VM	Traffic is unrestricted - always "Yes" for ping
OS firewall	The case study explicitly says all VMs allow ping - eliminate this as a factor

To get the definitive answers, locate the NSG inbound rule tables for NSG2 (applied to VM2), NSG3 (applied to VM3), and whichever NSG applies to VM5 - then trace each ping through the priority-ordered rules looking for an Allow ICMP or Allow Any match before a Deny.

Topics

#Network Security Groups#Azure Networking#Network Connectivity#Firewall Rules

Community Discussion

No community discussion yet for this question.

Full AZ-500 Practice