You have a Windows VM that must be administered via RDP. The VM is in a subnet with an NSG that currently allows RDP from the internet. You want to move to a more secure solution using Azure Bastion. You have enabled Bastion in the same VNet. You need to ensure that RDP is only possible through Bastion, and that direct RDP from the internet is blocked. What should you do?

Keep the existing NSG rule and add a rule that allows RDP from the Bastion subnet.

Change the NSG rule to allow RDP from the Azure Bastion service tag.

Remove the NSG rule that allows RDP from the internet, and add a rule that allows RDP from the Bastion subnet's address prefix.

Remove the VM's public IP address to block direct RDP.

You have multiple virtual networks in your organization, each with its own NSGs. You need to enforce a consistent baseline security policy across all virtual networks, such as blocking inbound RDP from the internet, without having to manually configure each NSG. What should you use?

Use Azure Policy to assign a built-in policy that blocks RDP from the internet.

Use Azure Firewall in each virtual network and configure a rule to block RDP.

Use Azure Virtual Network Manager to create a security admin rule that denies inbound RDP from the internet and apply it to all virtual networks.

Create a custom NSG and associate it to each virtual network's subnets.

Microsoft Certified:Azure Network Engineer Associate

Domain 5Objective 1

Implement and Manage Network Security Groups AZ-700 Practice Questions (Page 2)

Part of the Design and implement Azure network security services domain, which accounts for 15–20% of the AZ-700 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 2–4 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

10concepts

15–20%of the exam

Questions 6–10

6expert · hard
You have a Windows VM that must be administered via RDP. The VM is in a subnet with an NSG that currently allows RDP from the internet. You want to move to a more secure solution using Azure Bastion. You have enabled Bastion in the same VNet. You need to ensure that RDP is only possible through Bastion, and that direct RDP from the internet is blocked. What should you do?
Select an answer first
7foundation · easy
You need to create an application security group (ASG) in the Azure portal. Which resource must you select first?
Select an answer first
8application · medium
You have multiple virtual networks in your organization, each with its own NSGs. You need to enforce a consistent baseline security policy across all virtual networks, such as blocking inbound RDP from the internet, without having to manually configure each NSG. What should you use?
Select an answer first
9foundation · easy
You need to verify whether a specific IP flow is allowed or denied by an NSG. Which Network Watcher tool should you use?
Select an answer first
10foundation · easy
You are creating a network security group (NSG) in the Azure portal. Which Azure resource must exist before you can create the NSG?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-700

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-700” is a trademark of its owner, used for identification only.

Implement and Manage Network Security Groups AZ-700 Practice Questions (Page 2)

Questions 6–10

You need to create an application security group (ASG) in the Azure portal. Which resource must you select first?

You have multiple virtual networks in your organization, each with its own NSGs. You need to enforce a consistent baseline security policy across all virtual networks, such as blocking inbound RDP from the internet, without having to manually configure each NSG. What should you use?

You need to verify whether a specific IP flow is allowed or denied by an NSG. Which Network Watcher tool should you use?

You are creating a network security group (NSG) in the Azure portal. Which Azure resource must exist before you can create the NSG?

Keep studying — Design and implement Azure network security services