← SimulationsGuided PBQ Practice

45:00Question 1 of 1

Guided PBQ Practice

Microsoft AzureMentor support

Overall Progress

20%

Hadari Guide· Helping with: Allow HTTPS traffic

Hadari Guide

Guided practice

Task 2 of 5

Allow HTTPS traffic

On the Allow-HTTPS row, set the service and protocol that match secure web traffic.

Why this matters: An NSG filters traffic by rules; this one must let HTTPS reach the web server.

Good cloud habit: Allow only the traffic a workload needs — open specific services and ports, not everything.

How to approach this · learn the concept

Identify which service value means HTTPS and which protocol carries it, then set those two cells.

What is an NSG rule?

An NSG rule matches source, destination, service, protocol, and priority, then allows or denies the traffic. Lower priority numbers are evaluated first.

Watch out: Matching the wrong protocol — HTTPS runs over TCP, not UDP.

Task 1 of 2

Configure the inbound security rules for the NSG named web-nsg

Select the correct values from the dropdowns to complete each rule.

How an NSG rule works

Each rule matches traffic by source, port/service, and protocol, then allows or denies it. Lower priority numbers are evaluated first.

Priority	Name	Service	Action
100	Allow-HTTPS	Guided highlight: Work here.	Allow
200	Deny-SSH		Deny
300	Allow-RDP-Corp		Allow
4096	Deny-All		Deny

Traffic check · Inbound

2 of 4 flows behave as the scenario intends

Rules are evaluated in priority order — the lowest number is checked first, and the first matching rule decides the traffic. Your table below is evaluated live.

HTTPS 443 traffic from the internet (should reach the workload)
BlockedNot as intended yet
Deny-All (priority 4096, Deny) controls this traffic, so it is blocked.
Why? Rule-by-rule evaluation
1. 100Allow-HTTPS (Allow) — No service is configured on this rule yet, so it cannot match any traffic.
2. 200Deny-SSH (Deny) — No service is configured on this rule yet, so it cannot match any traffic.
3. 300Allow-RDP-Corp (Allow) — No service is configured on this rule yet, so it cannot match any traffic.
4. 4096Deny-All (Deny) — No higher-priority rule matched, so the default deny rule blocks this traffic.
SSH 22 attempt from the internet (should be blocked)
BlockedAs the scenario intends
Deny-All (priority 4096, Deny) controls this traffic, so it is blocked.
Why? Rule-by-rule evaluation
1. 100Allow-HTTPS (Allow) — No service is configured on this rule yet, so it cannot match any traffic.
2. 200Deny-SSH (Deny) — No service is configured on this rule yet, so it cannot match any traffic.
3. 300Allow-RDP-Corp (Allow) — No service is configured on this rule yet, so it cannot match any traffic.
4. 4096Deny-All (Deny) — No higher-priority rule matched, so the default deny rule blocks this traffic.
RDP 3389 from the approved network 10.0.0.0/8 (should reach the workload)
BlockedNot as intended yet
Deny-All (priority 4096, Deny) controls this traffic, so it is blocked.
Why? Rule-by-rule evaluation
1. 100Allow-HTTPS (Allow) — No service is configured on this rule yet, so it cannot match any traffic.
2. 200Deny-SSH (Deny) — No service is configured on this rule yet, so it cannot match any traffic.
3. 300Allow-RDP-Corp (Allow) — No service is configured on this rule yet, so it cannot match any traffic.
4. 4096Deny-All (Deny) — No higher-priority rule matched, so the default deny rule blocks this traffic.
RDP 3389 from the open internet (should be blocked)
BlockedAs the scenario intends
Deny-All (priority 4096, Deny) controls this traffic, so it is blocked.
Why? Rule-by-rule evaluation
1. 100Allow-HTTPS (Allow) — No service is configured on this rule yet, so it cannot match any traffic.
2. 200Deny-SSH (Deny) — No service is configured on this rule yet, so it cannot match any traffic.
3. 300Allow-RDP-Corp (Allow) — No service is configured on this rule yet, so it cannot match any traffic.
4. 4096Deny-All (Deny) — No higher-priority rule matched, so the default deny rule blocks this traffic.

Task 2 of 2

Complete the Bicep template to deploy the NSG rules

Visual rule → Bicep property

Bicep is Azure's infrastructure-as-code language. Each blank below maps one property of the same Allow-HTTPS rule you built above — fill them one at a time.

NSG namename· which NSG this template deploys
NSG regionlocation· the Azure region the NSG lives in
Rule prioritypriority· the order rules are evaluated (lowest first)
Rule protocolprotocol· which transport protocol the rule matches
Rule actionaccess· whether matching traffic is allowed or denied

Bicep · main.bicepsample values · no real deploy

resource webNsg 'Microsoft.Network/networkSecurityGroups@2023-04-01' = {

name:

location:

properties: {

securityRules: [

{

name: 'Allow-HTTPS'

properties: {

priority:

protocol:

access:

direction: 'Inbound'

}

]

}

Step Score

2 / 10

Partial credit — each requirement you satisfy adds to your step score.

Task Progress

Rule Priority Set (complete)
HTTPS Rule Configured (incomplete)
SSH Rule Verified (incomplete)
RDP Source Restricted (incomplete)
Bicep Template Completed (incomplete)

What we're checking

Rule priorities are valid Azure values
Action matches the rule intent
Administrative source range is restricted correctly
Bicep syntax is valid

Mentor

Guided

This is guided practice — work each requirement with support available. Map every requirement to the rule that satisfies it, then set the protocol, port, and action to match. Use the Need a hand? control at the top for step-by-step help, or revisit the lesson if a concept is unclear.

Review NSG basics in Study Hub →

Review your answers, then submit.

This is guided practice — submitting shows detailed feedback for each requirement, and you can return to editing to correct your work.

Save & Exit