Correct Answer: Create an Allow rule for the specific IP at priority 100, and a Deny rule for Any source at priority 200
NSG rules are processed in priority order (lowest number first). Default rules (priority 65000+) allow VNet inbound traffic. To block VNet traffic while allowing one IP, you must c...
Correct Answer
Create an Allow rule for the specific IP at priority 100, and a Deny rule for Any source at priority 200
Why This Answer Is Correct
NSG rules are processed in priority order (lowest number first). Default rules (priority 65000+) allow VNet inbound traffic. To block VNet traffic while allowing one IP, you must create a specific Allow rule (e.g., priority 100) for the IP, followed by a broader Deny rule (e.g., priority 200) targeting port 22. You cannot delete default rules.
This question evaluates your knowledge of Network Security Groups — a core concept tested in Microsoft Certified: Azure Network Engineer Associate (AZ-700). Understanding Network Security Groups is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.