You have a subnet that contains domain controllers. You need to allow inbound traffic from the corporate network on TCP 389 (LDAP) and TCP 445 (SMB) to the domain controllers, but block all other inbound traffic from the internet. You also need to ensure that the domain controllers can communicate with each other on any port. What is the most efficient way to configure the NSG?

Create a separate NSG for each rule and associate them all to the subnet.

Use Azure Firewall instead of an NSG to filter traffic.

Create one NSG with inbound rules allowing TCP 389 and TCP 445 from the corporate network, a rule allowing traffic from the subnet itself, and a deny-all rule for the rest.

Create two NSGs: one for the subnet and one for the NICs, and add the rules to both.

You have a three-tier application with web servers, application servers, and database servers. You need to configure NSG rules so that only web servers can communicate with application servers on TCP 443, and only application servers can communicate with database servers on TCP 1433. You want to minimize the number of NSG rules and make it easy to add new servers to each tier. What should you do?

Use service tags for each tier in the NSG rules.

Create three ASGs (Web, App, DB), add the NICs of each tier to the respective ASG, and create NSG rules using the ASGs as source and destination.

Create one NSG and associate it to all subnets, then add rules using IP addresses.

Create three separate NSGs and associate each to the subnet of each tier, then add rules using IP addresses.

You have an NSG associated to a subnet that contains a database VM. The NSG has a rule that allows inbound traffic from a specific application subnet on port 1433. Users report that they cannot connect to the database from the application subnet. You verify that the application subnet is correctly configured and that the VM is running. What should you do to troubleshoot the issue?

Check the effective routes on the database VM's NIC.

Review the NSG's effective security rules to confirm the rule is applied.

Restart the database VM to refresh the network configuration.

Use IP flow verify to test the connection from a VM in the application subnet to the database VM on port 1433.

You have multiple VMs in different subnets that run the same web application. You need to create a security rule that allows traffic to all of these VMs on TCP 443, but you want to avoid maintaining a list of individual IP addresses or updating the rule whenever a new VM is added. What should you do?

Create an application security group (ASG), add the NICs of the web VMs to the ASG, and reference the ASG as the destination in an NSG rule.

Use a service tag for the web application in the NSG rule.

Add each VM's private IP address to the NSG rule's destination address prefixes.

Create a second NSG and associate it to each web VM's subnet, then add a rule allowing TCP 443 to the subnet.

You have enabled virtual network flow logs for an NSG and are analyzing the logs in Log Analytics. You notice that a large number of flows are being denied by a rule named 'DenyAll'. You need to identify which specific source IP addresses are generating the most denied traffic. What should you do?

Open the NSG in the Azure portal and view the 'DenyAll' rule's metrics.

Use IP flow verify for each potential source IP.

Use the NSG diagnostic logs to see which rule was evaluated.

Run a KQL query on the flow log table that groups by SourceIP and counts the number of records where the action is 'Denied'.

Microsoft Certified:Azure Network Engineer Associate

Domain 5Objective 1

Implement and Manage Network Security Groups AZ-700 Practice Questions (Page 5)

Part of the Design and implement Azure network security services domain, which accounts for 15–20% of the AZ-700 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 2–4 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

10concepts

15–20%of the exam

Questions 21–25

21application · medium
You have a subnet that contains domain controllers. You need to allow inbound traffic from the corporate network on TCP 389 (LDAP) and TCP 445 (SMB) to the domain controllers, but block all other inbound traffic from the internet. You also need to ensure that the domain controllers can communicate with each other on any port. What is the most efficient way to configure the NSG?
Select an answer first
22expert · medium
You have a three-tier application with web servers, application servers, and database servers. You need to configure NSG rules so that only web servers can communicate with application servers on TCP 443, and only application servers can communicate with database servers on TCP 1433. You want to minimize the number of NSG rules and make it easy to add new servers to each tier. What should you do?
Select an answer first
23application · medium
You have an NSG associated to a subnet that contains a database VM. The NSG has a rule that allows inbound traffic from a specific application subnet on port 1433. Users report that they cannot connect to the database from the application subnet. You verify that the application subnet is correctly configured and that the VM is running. What should you do to troubleshoot the issue?
Select an answer first
24application · medium
You have multiple VMs in different subnets that run the same web application. You need to create a security rule that allows traffic to all of these VMs on TCP 443, but you want to avoid maintaining a list of individual IP addresses or updating the rule whenever a new VM is added. What should you do?
Select an answer first
25application · medium
You have enabled virtual network flow logs for an NSG and are analyzing the logs in Log Analytics. You notice that a large number of flows are being denied by a rule named 'DenyAll'. You need to identify which specific source IP addresses are generating the most denied traffic. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-700

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-700” is a trademark of its owner, used for identification only.

Implement and Manage Network Security Groups AZ-700 Practice Questions (Page 5)

Questions 21–25

You have enabled virtual network flow logs for an NSG and are analyzing the logs in Log Analytics. You notice that a large number of flows are being denied by a rule named 'DenyAll'. You need to identify which specific source IP addresses are generating the most denied traffic. What should you do?

Keep studying — Design and implement Azure network security services