Microsoft SC-500 Practice Test 20

Question 190

For a new inbound TCP flow, the SAME Azure NSG has a matching custom Deny rule at priority 100 and a matching Allow rule at priority 200. There is no earlier admin-rule decision. What is the NSG outcome?

The connection is permitted if the subnet is in an ASG, because ASG membership overrides an explicit matching NSG Deny.
The priority 100 Deny matches first and blocks the flow; the overlapping priority 200 Allow is not evaluated.
Azure evaluates both rules and takes whichever has the later creation timestamp, regardless of its numeric priority.
The priority 200 Allow overrides Deny because Allow is considered more permissive regardless of priority.

Explanation

Correct Answer

NSG custom rules are processed from lower numeric priorities to higher numbers and stop on the first match. The Deny at 100 therefore terminates the inbound decision before the rule at 200 can permit traffic.

Incorrect Answers

Application security groups can be used as source or destination selectors within NSG rules. They do not grant immunity from an explicit Deny rule that matches the flow.

Rule creation time is not the documented NSG precedence mechanism. Azure uses the rule priority and packet five-tuple; this scenario specifies a unique earlier Deny.

Allow and Deny are not resolved by a blanket allow-wins preference. An Allow at a numerically higher priority value is never reached once the earlier Deny matches the same packet.

Question 191

An application tier uses many Azure VM network interfaces whose private IP addresses change after scale operations. Security wants stable NSG rules based on web-tier membership rather than rewriting individual VM IPs. Which design should be used?

Keep static source/destination IPs and reauthorize a broad Any rule every time autoscaling replaces a VM.
Permit outbound internet access for the entire subnet; outbound reachability automatically creates application-tier inbound security groups.
Define an application security group for the tier, assign the intended NICs to it, and reference that ASG as source or destination in the appropriate NSG rules.
Grant Azure RBAC Network Contributor to each workload identity; Azure resource roles then automatically segment TCP flows by VM role.

Explanation

Correct Answer

An ASG represents a logical set of NICs and can be used in supported NSG source/destination conditions. As the tier scales, maintain the NIC membership and validate effective rules rather than relying on transient host addresses.

Incorrect Answers

Static addresses make rules brittle under scale and widening to Any creates avoidable cross-tier access. The stated stable application role is a better match for ASG-based policy.

Outbound rules govern new egress flows and do not define app-tier grouping of network interfaces. They cannot replace role-based NSG selectors for private-IP changes.

Azure RBAC controls who can manage resources, not the packet-level source and destination filters evaluated by NSGs. Network Contributor on an identity does not create a TCP security segment.

Question 192

Policy prohibits a public IP or any direct internet-facing SSH rule on a production Azure VM. Administrators must initiate browser-hosted SSH from the Azure portal to that VM over its private IP. Which deployment meets this architecture?

Enable JIT openings to the VM public SSH port for short windows, and retain its public IP to preserve the existing connection path.
Keep the VM public SSH rule set to Internet/Any, but require a complex local password before accepting connections.
Place the VM NIC in a management application security group while retaining the existing always-open public SSH rule.
Deploy Azure Bastion for the VNet, connect through the Azure portal to the VM private IP, and remove direct public VM SSH exposure.

Explanation

Correct Answer

Azure Bastion provides portal-based SSH/RDP connectivity to an Azure VM over its private IP, without assigning a public IP to the target VM or allowing public inbound SSH. Deploy the appropriately sized and secured Bastion service and remove the VM public SSH exposure to meet this architecture.

Incorrect Answers

Just-in-time access can narrowly open supported management ports for an approved source and time, but this particular policy forbids a VM public IP and any direct internet-facing SSH path. JIT alone does not deliver the specified browser-hosted private-IP connection architecture.

Stronger passwords do not close the broad internet-exposed SSH attack surface. The VM would still have a publicly reachable TCP 22 endpoint, contrary to the explicit no-public-IP and no-direct-public-SSH requirement.

Application security groups are NSG rule matching groups for NICs; assigning membership is not a managed private-IP SSH gateway. Leaving the permanent public SSH Any rule also violates the required network boundary.

Question 193

An Azure VM subnet has NSG rules denying unsolicited internet-initiated inbound connections, but a VM can still initiate new HTTPS sessions to public websites. No explicit custom outbound deny was deployed. What explains the behavior?

An Azure Virtual Network Manager admin Deny is always installed by default for all new internet egress, so the traffic must be spoofed.
NSGs evaluate outbound rules separately; the default AllowInternetOutBound can permit new egress unless a more specific outbound restriction applies.
Because an NSG is stateful, any failed unsolicited inbound TCP flow creates a state entry that grants unrestricted outbound internet access.
NSG inbound Deny rules automatically deny every new outbound flow and the observed HTTPS traffic proves the subnet NSG was not applied.

Explanation

Correct Answer

An NSG has independent inbound and outbound rule sets. The documented default outbound AllowInternetOutBound can match new internet connections; add approved egress Deny or narrow Allow controls according to the required policy.

Incorrect Answers

Virtual Network Manager does not automatically impose a global outbound Deny for every new VNet. Security admin rules require an applicable configuration and targeted deployment.

Stateful inspection allows reply packets for a permitted flow, not arbitrary new connections based on failed inbound traffic. The VM can initiate HTTPS because outbound rules permit it.

Inbound restrictions prevent unsolicited connection initiation toward the VM, not all traffic the VM initiates. This observation does not by itself prove the inbound policy is missing.

Question 194

A network flow is blocked despite an ASG-based NSG rule intended to allow it. Select TWO tests that examine NIC ASG membership and the rule match actually evaluated for that flow.

Review only the NSG rule description without testing NIC membership or the packet’s actual source, destination, direction and port.
Verify matching NSG direction, source/destination and port in effective rules.
Use supported ASGs to group NICs by application role for NSG rules.
Restrict SSH source paths and prefer approved management access such as Bastion/JIT.
Check that the VM's NIC belongs to the intended application security group.

Explanation

Correct Answer

Check the effective network security rules for the target NIC and verify the ASG source/destination, traffic direction, priority and port match.

An NSG rule referencing an application security group matches the NICs actually associated with that ASG; an omitted NIC will not match the intended group.

Incorrect Answers

Rule descriptions are not effective packet evaluations. The actual direction, endpoints, protocols and ports must be examined.

ASGs are a useful abstraction, but simply adopting group-based rule design does not demonstrate current membership for the failing NIC.

Bastion/JIT is a management-access design, not the required diagnosis of this application traffic’s ASG rule evaluation.

Question 195

A VM establishes an allowed outbound TCP connection, but its reply packets appear missing after the team changed an NSG rule. An engineer wants a new bidirectional Allow Any rule. Which investigation respects NSG statefulness without weakening the subnet?

Change only the priority of an unrelated inbound rule without checking whether the affected TCP flow matches it.
Allow all internet egress and ingress permanently to guarantee a valid response even when another firewall or route is blocking it.
Inspect the connection’s effective inbound/outbound NSG and admin rules, distinguish newly initiated flows from existing flow records, and verify routes or other stateful inspection devices before a narrow fix.
Add an explicit inbound Allow Any for every response packet because NSGs never track established flow state.

Explanation

Correct Answer

Use actual source/destination/port details and effective rule evaluation, noting that changes commonly affect new flows rather than already established connections. If the NSG permits the flow, check return routing and independent inspection controls.

Incorrect Answers

NSG priority affects matching rules, not a rule unrelated to the packet. Modifying it without a flow-level diagnosis may have no effect and could unintentionally alter unrelated network traffic.

Broad ingress/egress allowances do not repair an asymmetric route or separate firewall. The proper goal is to determine which component or stateful flow rule causes the response failure.

Azure NSGs are stateful: response traffic for a permitted established flow normally does not require a separate opposite-direction Allow. An inbound Allow Any is an unjustified broadening and may not address another device dropping replies.

Question 196

A central network team must block a prohibited management TCP port across dozens of ordinary Azure VNets even if local workload teams add permissive NSG rules. Which centrally deployed control enforces the restriction?

Create and deploy an Azure Virtual Network Manager security admin configuration with a matching Deny rule to network groups containing the targeted VNets.
Change only the NSG on one representative VM and assume its configuration is inherited automatically by every VNet.
Create a standard Azure Virtual Network Manager Allow security admin rule for the prohibited port, expecting local NSGs to enforce the deny.
Create an Azure Policy audit-only assignment and assume the audit finding immediately drops already permitted packets on every VNet.

Explanation

Correct Answer

Azure Virtual Network Manager applies security admin rules to VNets within the manager scope and deployed network groups. A matching Deny is evaluated before NSGs and terminates the flow, giving central enforcement against permissive local rules.

Incorrect Answers

A VM-local or subnet NSG does not propagate its rules to unrelated VNets. Individually maintaining hundreds of rules cannot satisfy centrally enforced guardrails against local exceptions.

A regular security admin Allow continues into NSG evaluation; it does not deny access. Its purpose is to permit the matching traffic to proceed to local NSG checks.

Azure Policy audit effects identify noncompliance but do not operate as packet filters. The request specifically needs a network security admin Deny deployed to the correct VNets and regions.

Question 197

A workload’s NIC NSG contains a matching inbound Allow, but Azure Network Watcher effective security rules show an Azure Virtual Network Manager security admin Deny for the same traffic. Where should remediation begin?

Raise the priority of the local NIC NSG Allow above its other NIC NSG rules, without examining the inherited admin configuration.
Remove the NSG from the NIC so the AVNM Deny no longer applies to the virtual network.
Replace the matching admin Deny with a normal admin Allow without checking the central policy owner, affected network group or exception process.
Investigate the higher-precedence AVNM admin Deny and its authorized central scope or exception; changing a lower-precedence NSG Allow cannot override that terminating decision.

Explanation

Correct Answer

Effective security rules expose the administered rule path. Admin Deny is evaluated ahead of NSG rules; inspect network-group membership, deployment and central policy, then request a narrowly justified central exception if authorized.

Incorrect Answers

NSG rule priority is internal to the NSG processing stage. A higher-precedence security admin Deny already terminates evaluation before the local NIC Allow can run.

Security admin rules are applied at VNet scope and do not depend on a NIC NSG being present. Detaching the NSG also removes local protection without lifting the admin Deny.

An admin policy change may be the correct centrally authorized exception, but unreviewed conversion to Allow can create policy gaps. Diagnose the Deny scope and central owner before making any exception.

Question 198

An explicitly approved centralized break-glass service must connect to a management VNet even where its local NSG would deny the particular source and port. The organization accepts a narrowly scoped bypass. Which AVNM action actually terminates later NSG filtering?

Use a security admin Deny to represent the approved management exception and rely on the local NSG to allow later.
Use an authorized security admin Always Allow rule scoped to the exact required sources, destinations and ports; audit the exception because it bypasses later NSG evaluation.
Create a regular security admin Allow and assume it cannot be denied by a lower-precedence NSG.
Leave the admin configuration unchanged and edit only an NSG rule description to state that management access is guaranteed.

Explanation

Correct Answer

Always Allow terminates security admin and subsequent NSG evaluation for the matched traffic, so it can intentionally bypass local denies. This is a high-impact centrally governed exception and should be narrowly targeted, time-reviewed and monitored.

Incorrect Answers

A matching admin Deny terminates traffic as blocked before NSGs run; it is not an exception mechanism and cannot be reversed by a local Allow.

A normal admin Allow permits traffic to continue to NSG rule evaluation, where the stated NSG Deny may still block it. It cannot guarantee reachability under the requirement.

Changing a description has no packet-processing effect and the NSG deny remains active. The scenario requires a documented security admin action that explicitly bypasses subsequent evaluation.

Question 199

A network architect claims that every Azure Virtual Network Manager security admin Allow makes local NSG Deny rules ineffective. A test flow matches a regular admin Allow, then matches an NSG Deny. What is the correct result?

Any matching admin Allow automatically creates a return-flow state permitting future new connections even after an NSG Deny.
Regular admin Allow proceeds to NSG evaluation, so the matching NSG Deny can block; only an authorized Always Allow bypasses subsequent NSG checks.
A regular admin Allow terminates packet evaluation just like Always Allow, so the NSG Deny is ignored.
The local NSG is evaluated first, and its Deny causes the admin Allow to be skipped, because admin rules always have lower priority.

Explanation

Correct Answer

Azure evaluates admin rules before local NSGs. An admin Allow passes the traffic onward to NSGs; if a matching NSG Deny exists, that traffic is blocked. Always Allow and Deny are the terminating admin actions.

Incorrect Answers

Connection tracking does not transform a denied new flow into an authorized state. A matching NSG Deny prevents the flow despite the earlier regular Allow.

The explicit distinction in Microsoft’s AVNM model is that regular Allow does not suppress NSG processing. Confusing it with Always Allow could lead a designer to misstate the effective security policy.

The processing order is reversed in this explanation. Central admin policies are evaluated ahead of subnet or NIC NSGs, even though a regular Allow then hands off to those NSGs.

Question 200

An Azure Virtual Network Manager security admin Deny was deployed to one region, but a newly created ordinary workload VNet in another expected region is missing the policy. What should be inspected before changing individual NSGs?

Replace the security admin Deny with Always Allow across all regions so the missing VNet receives a configuration sooner.
Add the rule to an unrelated VNet NSG and assume that new VNet is protected because both VNets share a subscription.
Verify the new VNet is in the intended network group and manager scope, and that the security admin configuration is deployed to its region; allow for documented propagation delay.
Inspect only the currently attached NIC NSG, since AVNM network-group membership and regional security configuration deployment are irrelevant.

Explanation

Correct Answer

Security admin rules require correct network-group membership, manager scope and regional deployment. A newly added VNet can also see short eventual-consistency delay; confirm the effective rules before concluding an admin rule failed.

Incorrect Answers

Always Allow is a bypass, not a remediation for a missing Deny deployment. Broadening it would reverse the intended protection across the enterprise.

NSG assignments do not create an AVNM deployment for a different VNet. A local workaround may leave the new workload outside centrally managed security policy and create inconsistent enforcement.

NIC NSGs are a separate downstream layer. AVNM admin rules are applied to VNets in selected network groups after regional deployment, so those dimensions must be checked first.

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests

Microsoft SC-500 Practice Test 18 - 10 Questions (Last Reviewed 27-Oct-2026)
Microsoft SC-500 Practice Test 19 - 10 Questions (Last Reviewed 26-Oct-2026)
Microsoft SC-500 Practice Test 20 - 10 Questions (Last Reviewed 25-Oct-2026)
Microsoft SC-500 Practice Test 21 - 10 Questions (Last Reviewed 24-Oct-2026)
Microsoft SC-500 Practice Test 22 - 10 Questions (Last Reviewed 23-Oct-2026)

Pass Your Microsoft SC-500 Exam Easy!

Question 190

Explanation

Correct Answer

Incorrect Answers

Question 191

Explanation

Correct Answer

Incorrect Answers

Question 192

Explanation

Correct Answer

Incorrect Answers

Question 193

Explanation

Correct Answer

Incorrect Answers

Question 194

Explanation

Correct Answer

Incorrect Answers

Question 195

Explanation

Correct Answer

Incorrect Answers

Question 196

Explanation

Correct Answer

Incorrect Answers

Question 197

Explanation

Correct Answer

Incorrect Answers

Question 198

Explanation

Correct Answer

Incorrect Answers

Question 199

Explanation

Correct Answer

Incorrect Answers

Question 200

Explanation

Correct Answer

Incorrect Answers

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests