What information is required to create a security rule in a Network Security Group?

Virtual machine name, size, and admin password

Encryption type, key vault, and certificate

Resource group, location, and subscription

Source, destination, port, protocol, and action

A web application is deployed on Azure Application Gateway. The security team wants to block requests that match known attack patterns, but they also need to allow custom rules for specific URL paths. What should they configure?

Network Security Groups with URL rules

Azure DDoS Protection with custom rules

Azure Firewall with application rules

Azure WAF with managed rule sets and custom rules

A network administrator needs to allow inbound RDP traffic to a management VM from only the corporate public IP range, while denying all other inbound traffic. What should they configure?

Azure Bastion with IP restrictions

Azure DDoS Protection with a rule

An NSG with an inbound rule allowing RDP from the corporate IP range and a deny-all rule

At which levels can a Network Security Group be applied?

Virtual machine and storage account

Subscription and resource group

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 3Objective 1

Describe Core Infrastructure Security Services in Azure SC-900 Practice Questions (Page 6)

Part of the Describe the capabilities of Microsoft security solutions domain, which accounts for 35–40% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~7–12 in this domain), expect 2–3 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

12concepts

35–40%of the exam

12 Concepts in This Objective

Azure DDoS Protection Overview
Azure DDoS Protection Tiers
Azure Firewall Functionality
Azure Firewall Policy Management
Azure Web Application Firewall (WAF) Features
Azure WAF Deployment
Azure Virtual Networks Segmentation
Network Security Groups (NSGs) Function
NSG Rule Configuration
Azure Bastion Service
Azure Key Vault Overview
Azure Key Vault Integration

Questions 26–30

26application · medium
A gaming company expects high-traffic events and wants to protect its public-facing application from large-scale DDoS attacks. They also need to ensure that legitimate users are not blocked during an attack. Which Azure service should they enable?
Select an answer first
27foundation · easy
What information is required to create a security rule in a Network Security Group?
Select an answer first
28expert · hard
A web application is deployed on Azure Application Gateway. The security team wants to block requests that match known attack patterns, but they also need to allow custom rules for specific URL paths. What should they configure?
Select an answer first
29application · medium
A network administrator needs to allow inbound RDP traffic to a management VM from only the corporate public IP range, while denying all other inbound traffic. What should they configure?
Select an answer first
30foundation · easy
At which levels can a Network Security Group be applied?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.