NSG and VNet practice questions with answers
Fifteen free NSG and virtual network practice questions with explained answers, built as short packet-tracing and subnet-sizing scenarios. A network security group is an ordered list of allow and deny rules that Azure applies to traffic in a virtual network, and a subnet is the address range inside the network where resources receive their IPs. The topic is tested in AZ-104, SC-500 and, at concept level, SC-900.
How to use these questions
Attempt each question before opening the explanation. For rule questions, sort the rules by priority number first and walk the packet through them in that order, as Azure does. For sizing questions, calculate the total with 2 to the power of (32 minus the prefix) and subtract the five addresses Azure reserves. Note the constraint word in the stem (inbound or outbound, new or existing, least). The guide NSG rule evaluation in Azure covers the theory.
Warm-up: priorities, defaults and sizes
Question 1. A subnet NSG has these inbound rules. 100 allows TCP 22 from 10.0.0.0/8. 110 denies TCP 8080 from the VirtualNetwork tag. 120 allows TCP 8080 from 10.0.1.0/24. The virtual network is 10.0.0.0/16. A VM at 10.0.1.5 connects to TCP 8080 on a VM in the subnet. What happens?
- A. Allowed by rule 120 because it names the exact source subnet
- B. Allowed by the default AllowVNetInBound rule
- C. Denied by rule 110
- D. Denied by the default DenyAllInbound rule
Show answer
Answer: C
Rules are evaluated from the lowest priority number and evaluation stops at the first match. The source 10.0.1.5 is inside the VirtualNetwork tag, so rule 110 matches and denies before rule 120 is reached. Rule 100 is for port 22 and does not match. The default rules at 65000 and above are never consulted because a custom rule matched.
Question 2. You are adding a new inbound rule to an NSG. Which priority value is valid?
- A. 50
- B. 4096
- C. 4097
- D. 65000
Show answer
Answer: B
Custom rule priorities range from 100 to 4096, and two rules in the same direction cannot share a number. 4096 is therefore valid. 50 and 99 are below the minimum, and 4097 is above the maximum. Default rules occupy 65000 and above and are not available for custom rules.
Question 3. An NSG is associated with a subnet and contains only the default rules. A VM in the subnet has a web server on TCP 80. A client on the internet connects to it through a public IP address. What happens to the inbound connection?
- A. It is denied by DenyAllInbound
- B. It is allowed because TCP 80 is a well-known port
- C. It is allowed by AllowInternetOutBound
- D. It is allowed by AllowAzureLoadBalancerInBound
Show answer
Answer: A
No custom rule allows it, the VirtualNetwork and load balancer default allows do not match an internet source, and DenyAllInbound at priority 65500 drops it. A rule must be added to allow TCP 80 from the internet. Outbound defaults do not matter for an inbound connection.
Question 4. An inbound rule allows TCP 443 from the internet to a web VM. The outbound rules of the NSG are the defaults, and no custom outbound rules exist. Does the web server need an outbound rule so that its responses reach the client?
- A. Yes, a matching outbound rule is always required
- B. Yes, but only for TCP 443
- C. No, because NSGs only evaluate inbound traffic
- D. No, because NSGs are stateful
Show answer
Answer: D
NSGs are stateful: when a connection is allowed in one direction, the return traffic of that connection is allowed automatically. No separate outbound rule is needed. The default outbound rules would allow internet-bound traffic in any case, but the stateful behaviour is the reason, and a mirror rule is not required.
Question 5. A subnet must hold 45 VM network interfaces. What is the smallest IPv4 prefix that can hold them, given the five addresses Azure reserves in each subnet?
- A. /25
- B. /26
- C. /27
- D. /28
Show answer
Answer: B
Usable addresses are 2^(32 minus prefix) minus 5. A /26 has 64 addresses and 59 usable, which fits 45. A /27 has 32 addresses and 27 usable, which does not. A /25 has 123 usable and fits, but is not the smallest. A /28 has only 11 usable addresses.
Scenarios: tracing packets and combining NSGs
Question 6. A subnet NSG has two inbound rules. 100 allows TCP 443 from the Internet tag. 200 denies TCP 443 from 198.51.100.0/24, a partner range that must be blocked, but partner hosts still connect. Other internet clients must keep access. What is the fix?
- A. Change the priority of the deny rule to 90
- B. Change the priority of the deny rule to 100
- C. Delete the default DenyAllInbound rule
- D. Change the priority of the allow rule to 250
Show answer
Answer: D
Rule 100 matches partner addresses first because they fall in the Internet tag, so the deny at 200 is never reached. Moving the allow to a number higher than 200, such as 250, lets the deny run first. A priority of 90 is below the minimum of 100, and changing the deny to 100 duplicates a priority already used in that direction. Deleting DenyAllInbound is not possible and would not help.
Question 7. A subnet NSG allows TCP 443 from the internet at priority 100. The NIC of the web VM in that subnet has its own NSG containing only the default rules. Clients cannot reach the VM on TCP 443. What is the cause?
- A. The NIC NSG denies the traffic through its default DenyAllInbound rule
- B. The subnet NSG rule is overridden by the NIC NSG default allow
- C. NSGs on a NIC are only evaluated for outbound traffic
- D. The default outbound rules block the response
Show answer
Answer: A
For inbound traffic Azure evaluates the subnet NSG first and then the NIC NSG, and both must allow the packet. The NIC NSG has no rule that allows internet traffic, so DenyAllInbound drops it there. The subnet rule is correct, a NIC NSG cannot be merged into the subnet NSG, and outbound rules are irrelevant to a new inbound connection.
Question 8. A VM in a subnet has no custom NSG rules at all, only the defaults. The VM downloads updates from a website on the internet over TCP 443. What happens?
- A. It is denied by DenyAllOutBound
- B. It is allowed by AllowVNetOutBound
- C. It is allowed by AllowInternetOutBound
- D. It is denied because no outbound rule names TCP 443
Show answer
Answer: C
The default rule AllowInternetOutBound (priority 65001) allows outbound traffic to the internet, so the connection succeeds. DenyAllOutBound sits at 65500 and is reached only if nothing earlier matches. AllowVNetOutBound covers only destinations inside the virtual network. Outbound traffic is not closed by default, unlike inbound traffic from the internet.
Question 9. VNet-A and VNet-B are peered. A VM in VNet-A must not reach TCP 1433 on VMs in VNet-B, but the default rules are in place everywhere. What is the simplest way to block that traffic?
- A. Add a custom inbound deny rule for TCP 1433 from the VNet-A address range in the VNet-B NSG
- B. Delete the default AllowVNetInBound rule
- C. Resize the VMs in VNet-B
- D. Delete the peering and recreate it with a different name
Show answer
Answer: A
The VirtualNetwork tag includes peered networks, so AllowVNetInBound allows the traffic by default. A custom deny rule for TCP 1433 from the VNet-A range, with a priority number lower than 65000, is evaluated first and blocks it. Deleting peering would break other traffic, the default allow cannot be removed, and changing the VM size has no effect on filtering.
Question 10. An outbound NSG has rule 100 allowing TCP 443 to the Storage service tag and rule 200 denying all traffic to the Internet tag. A VM connects over TCP 443 to an Azure Storage endpoint, then to a public website that is not part of Azure Storage. What happens?
- A. Both connections are allowed
- B. Both connections are denied
- C. The storage connection is allowed and the website connection is denied
- D. The website connection is allowed and the storage connection is denied
Show answer
Answer: C
The storage connection matches rule 100 first and is allowed. The website does not match the Storage tag, so rule 100 is skipped and rule 200 denies it. Both connections being allowed ignores rule 200, and both being denied ignores that rule 100 comes first. Reversing the results ignores the order and the tag.
Edge cases and traps
Question 11. A subnet uses the range 10.20.4.64/27. Which of these addresses can be assigned to a VM?
- A. 10.20.4.66
- B. 10.20.4.94
- C. 10.20.4.95
- D. 10.20.4.96
Show answer
Answer: B
A /27 has 32 addresses, from 10.20.4.64 to 10.20.4.95. Azure reserves the first four addresses and the last one: .64 is the network address, .65 is the default gateway, .66 and .67 map the Azure DNS addresses, and .95 is the last address of the range. So .94 is the last usable address, and .96 lies outside the subnet.
Question 12. Users report that one specific connection from 10.1.4.4 to a VM on TCP 3389 fails. You must find out which NSG rule allows or denies that exact packet, without changing anything. Which tool should you use?
- A. An application security group
- B. A new NSG on the subnet
- C. A service tag
- D. IP flow verify in Network Watcher
Show answer
Answer: D
IP flow verify in Azure Network Watcher tests one specific packet (source, destination, port, protocol) against the effective rules and names the rule that decides. Application security groups group VMs for use in rules but do not test traffic. A flow log analysis is retrospective and a new NSG would change the configuration.
Question 13. An administrator removes the NSG rule that allowed SSH to a VM while an administrator is connected over SSH. Which statement is accurate?
- A. The session is terminated immediately
- B. New SSH connections are still allowed until the VM restarts
- C. The existing session stays connected, but new SSH connections are denied
- D. NSG changes apply only after 24 hours
Show answer
Answer: C
NSG rule changes apply only to new connections. Microsoft Learn states that when you remove a rule that allowed a connection, existing connections remain uninterrupted, while a new SSH connection attempt is blocked. The session is therefore not cut at once, the removed rule no longer allows new connections, and no VM restart or delay is involved.
Question 14. For outbound traffic from a VM that has an NSG on its NIC and another on its subnet, in which order does Azure evaluate them?
- A. NIC NSG first, then subnet NSG
- B. Subnet NSG first, then NIC NSG
- C. Both together, and the most permissive result wins
- D. Only the subnet NSG, because the NIC NSG applies to inbound traffic
Show answer
Answer: A
Outbound traffic is evaluated first by the NSG on the NIC and then by the NSG on the subnet, the reverse of inbound, and both must allow it. The subnet is not checked first for outbound traffic, and the two NSGs are not merged into one list or evaluated in parallel with the most permissive winning.
Question 15. An Azure Virtual Network Manager security admin rule denies inbound TCP 22 from the Internet for a virtual network. An NSG on a subnet in that network has a rule at priority 100 that allows TCP 22 from the Internet. What happens to an internet SSH connection?
- A. Allowed, because the NSG rule has priority 100
- B. Allowed, because NSG rules always override network-wide rules
- C. Allowed by AllowVNetInBound
- D. Denied by the security admin rule
Show answer
Answer: D
Security admin rules from Azure Virtual Network Manager are evaluated before NSG rules, and a deny ends evaluation, so the NSG allow is never reached. The lower priority number of the NSG rule is not compared with the admin rule, the NSG does not override it, and the traffic is not allowed by the default rules.
Where to go next
Review the theory in NSG rule evaluation in Azure, then continue with Azure storage practice questions and ACL practice questions, which train the same first-match logic. The free 20-question AZ-104 practice test mixes this topic with the rest of the exam, and multiple-choice exam tips cover how to handle the constraint words.