nerdexam
Microsoft

AZ-700 · Question #229

You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a subnet named Subnet1. You deploy an instance of Azure Application Gateway v2 named AppGw1 to Subnet1. You…

The correct answer is B. an inbound rule that has a priority of 4096 and blocks all internet traffic. To restrict Azure Application Gateway v2 to only load balance traffic originating from VNet1, an inbound NSG rule with a low priority (high number) should be added to block all internet traffic.

Submitted by dimitri_ru· Apr 18, 2026

Question

You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a subnet named Subnet1. You deploy an instance of Azure Application Gateway v2 named AppGw1 to Subnet1. You create a network security group (NSG) named NSG1 and link NSG1 to Subnet1. You need to ensure that AppGw1 will only load balance traffic that originates from VNet1. The solution must minimize the impact on the functionality of AppGw1. What should you add to NSG1?

Options

  • Aan outbound rule that has a priority of 4096 and blocks all internet traffic
  • Ban inbound rule that has a priority of 4096 and blocks all internet traffic
  • Can inbound rule that has a priority of 100 and blocks all internet traffic
  • Dan outbound rule that has a priority 100 and blocks all internet traffic

How the community answered

(71 responses)
  • A
    10% (7)
  • B
    83% (59)
  • C
    4% (3)
  • D
    3% (2)

Why each option

To restrict Azure Application Gateway v2 to only load balance traffic originating from VNet1, an inbound NSG rule with a low priority (high number) should be added to block all internet traffic.

Aan outbound rule that has a priority of 4096 and blocks all internet traffic

An outbound rule would control traffic leaving the Application Gateway, not traffic entering it from the internet.

Ban inbound rule that has a priority of 4096 and blocks all internet trafficCorrect

To ensure AppGw1 only load balances traffic from VNet1 and not the internet, an inbound NSG rule is required to block internet traffic. A priority of 4096 is a low priority (high number), meaning it will be evaluated after default rules and any higher-priority custom rules, thus allowing necessary Application Gateway management and health probe traffic while explicitly blocking general internet traffic.

Can inbound rule that has a priority of 100 and blocks all internet traffic

An inbound rule with priority 100 is a high priority (low number) and could inadvertently block essential Application Gateway management or health probe traffic, impacting its functionality.

Dan outbound rule that has a priority 100 and blocks all internet traffic

An outbound rule would control traffic leaving the Application Gateway, which is not the requirement for restricting inbound traffic origination.

Concept tested: Application Gateway VNet-only traffic restriction via NSG

Source: https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-nsg-waf-policy

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-700 Practice