You need to explicitly deny traffic from a specific IP address to your Azure Virtual Machines instances. Can Network Security Groups (NSG) natively handle explicit deny rules?

Direct Answer (Verified)Reviewed by Sunny (Senior Cloud Engineer)

Correct Answer: No, use Azure Firewall or equivalent for explicit deny rules

Network Security Groups (NSG) typically support allow rules only. Azure Firewall support both allow and deny rules, making them suitable for blocking unwanted IP addresses....

📋Part of Microsoft Certified: Azure Fundamentals (AZ-900) · Azure Certification Practice

Real Exam ScenarioAzure Firewall

You need to explicitly deny traffic from a specific IP address to your Azure Virtual Machines instances. Can Network Security Groups (NSG) natively handle explicit deny rules?

✓ Correct Answer & ExplanationAzure Firewall

Correct Answer

No, use Azure Firewall or equivalent for explicit deny rules

Why This Answer Is Correct

Network Security Groups (NSG) typically support allow rules only. Azure Firewall support both allow and deny rules, making them suitable for blocking unwanted IP addresses.

📚 What This Question Tests

This question evaluates your knowledge of Azure Firewall — a core concept tested in Microsoft Certified: Azure Fundamentals (AZ-900). Understanding Azure Firewall is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.

All Microsoft Certified: Azure Fundamentals (AZ-900) Questions →Browse All Azure Exams →

You need to explicitly deny traffic from a specific IP address to your Azure Virtual Machines instances. Can Network Security Groups (NSG) natively handle explicit deny rules?

You need to explicitly deny traffic from a specific IP address to your Azure Virtual Machines instances. Can Network Security Groups (NSG) natively handle explicit deny rules?

📚 What This Question Tests

More Azure Firewall Practice Questions