nerdexam
Microsoft

AZ-900 · Question #247

A company has an Azure infrastructure deployed. Three virtual machines (VMs) are deployed to Azure as a three-tiered architecture. All three VMs host different items, with one hosting a front- end web

The correct answer is B. To ensure that only the front-end VM is publicly accessible over port 80 C. To ensure that all three VMs are accessible over port 222. Network Security Groups (NSGs) can be used to control inbound and outbound network traffic to VMs, specifically to allow public web access to the front-end VM on port 80 and RDP access to all VMs on port 222.

Submitted by emma.c· Mar 5, 2026Describe Azure Architecture and Services

Question

A company has an Azure infrastructure deployed. Three virtual machines (VMs) are deployed to Azure as a three-tiered architecture. All three VMs host different items, with one hosting a front- end web application, one hosting a Microsoft SQL Server database and one hosting a business application programming interface (API). For public access, only the front-end web application be available and should be accessible over HTTP on port 80. All three VMs must be accessible over Remote Desktop Protocol (RDP) on port 222. There should be only one account able to access the VMs usning RDP, and it should be yours. Can you determine how Network Security Groups (NSGs) will be used in this scenario? Identify the two ways NSG rules can be used. (Choose two)

Options

  • ATo ensure that only your account can use RDP to access the VMs
  • BTo ensure that only the front-end VM is publicly accessible over port 80
  • CTo ensure that all three VMs are accessible over port 222
  • DReviewed by executive management before being released to the public

How the community answered

(56 responses)
  • A
    9% (5)
  • B
    73% (41)
  • D
    18% (10)

Why each option

Network Security Groups (NSGs) can be used to control inbound and outbound network traffic to VMs, specifically to allow public web access to the front-end VM on port 80 and RDP access to all VMs on port 222.

ATo ensure that only your account can use RDP to access the VMs

NSGs filter traffic based on IP address, port, and protocol, not based on user accounts. User account authentication happens at the OS level, not the network layer.

BTo ensure that only the front-end VM is publicly accessible over port 80Correct

NSG rules can be configured on the network interface or subnet of the front-end VM to allow inbound HTTP traffic on port 80 from the internet, restricting public access to only this VM for web requests.

CTo ensure that all three VMs are accessible over port 222Correct

NSG rules can be applied to the network interfaces or subnets of all three VMs to allow inbound RDP traffic on port 222 from a specified source (e.g., your IP address), enabling remote management.

DReviewed by executive management before being released to the public

NSGs are network security controls, not part of a management review or release process for applications.

Concept tested: Configuring Network Security Group (NSG) rules for VM traffic control

Source: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-900 Practice