CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Navigating Azure Security: Access Management with NSGs
Discover how to effectively restrict access to Azure resources using Network Security Groups in our AZ-500 exam question walkthrough.
In the Azure Security Engineer Associate exam, candidates often trip over questions about access management features. Knowing the right tool for the job is crucial. This question tests your understanding of how to restrict access based on traffic source.
The question
In a recent review, your organization identified that it needs to restrict access to specific Azure resources based on the source of the traffic. Which Azure feature should you use to manage this requirement effectively?
- A. Azure Policy.
- B. Network Security Groups (NSGs).
- C. Azure Role-Based Access Control (RBAC).
- D. Azure Resource Manager (ARM) templates.
Think before you scroll
Take a moment to consider the purpose of each option. You need to restrict access based on traffic source, so think about which feature specifically manages network traffic and can create rules based on source IP addresses.
The answer
The correct option is B. Network Security Groups (NSGs). NSGs allow you to create rules that filter inbound and outbound traffic based on source and destination IP addresses, ports, and protocols. This capability directly addresses the requirement to manage access based on traffic source.
Why the other options lose
- A. Azure Policy: While Azure Policy helps enforce compliance across resources, it does not directly manage network traffic. Policies can control broader aspects of Azure resources but lack the specificity needed for traffic filtering.
- C. Azure Role-Based Access Control (RBAC): RBAC is about managing permissions and access to Azure resources, not network traffic. It determines who can access what, but it does not control how traffic is routed to those resources.
- D. Azure Resource Manager (ARM) templates: ARM templates are used for deploying and managing Azure resources through code. They focus on infrastructure as code and do not pertain to traffic management or access restrictions.
The concept behind it
Understanding how to manage network traffic is essential for Azure Security Engineers. NSGs are specifically designed for this purpose, allowing you to define granular rules based on IP addresses and protocols. This ensures that only authorized traffic reaches your resources, enhancing security.
Exam trap to remember
Remember: Network Security Groups (NSGs) are your go-to for managing network traffic based on source and destination rules. Don't confuse them with access management tools like RBAC.