Cloud Server Access Control Without Subnet-Wide Impact
Short answer
D A network security group can be attached to an individual server's network interface to allow or deny traffic for that server only, leaving other resources in the same subnet unaffected.
Question
Key Takeaways
The question tests whether you can match a security control's attachment scope to a per-server requirement; the trap is choosing an ACL that filters at the subnet boundary.
This N10-009 item tests the scope of cloud access controls. A network security group (D) is correct because it can filter traffic for one server's NIC while leaving other resources in the same subnet unaffected.
Common mistake: Option C, an access control list, is tempting because ACLs do filter traffic, but a network ACL is applied to the whole subnet and would therefore affect every resource sharing it, not just the target server.
Expert Analysis
Scope decides the control
The stem does not ask which cloud construct can filter traffic in general; it asks which control can be aimed at one server while leaving the rest of the subnet untouched. That makes scope the governing principle. In cloud networking, controls are applied at different boundaries: a VPC defines the virtual network, a network ACL is normally a subnet-level stateless filter, and a security group or network security group is an instance/NIC-level stateful filter. The narrower the attachment point, the less collateral effect on peers.
Why D fits
A network security group (D) can be associated with a virtual machine's network interface, so its inbound and outbound rules apply to that server only. Traffic to and from other resources in the same subnet remains governed by their own rules. This precisely satisfies the requirement for specific servers without affecting other resources in the same subnet.
Why the others miss
A cloud NAT gateway (A) performs outbound address translation and does not provide per-server inbound access control. A VPC (B) is the broader network container; placing a server in a VPC does not isolate it from its subnet peers. An access control list (C) is the closest distractor because ACLs do filter traffic, but a network ACL is applied at the subnet boundary—tightening it would affect every resource sharing that subnet, contrary to the requirement. The supplied comment makes the same distinction: NSGs operate at the virtual NIC or VM level and filter traffic to and from specific servers or instances without impacting other resources in the same subnet.
Exam takeaway
Read for the requirement of per-server filtering within a shared subnet. If the control must be per-instance, choose the security group or NSG; if the requirement is subnet-wide, an ACL may be appropriate. Answer: D.
Official Reference
- https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
- https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works
- https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html
These links open the official vendor documentation in a new tab.
Exam Strategy
For cloud access-control questions, underline the scope words: specific server, same subnet, or without affecting others. Then rank each option by its attachment boundary—NIC/instance, subnet, VPC, or gateway—and discard choices that operate above the required scope. This technique eliminates subnet ACLs and broad VPC constructs whenever the stem asks for per-server filtering.
Frequently Asked Questions
Why is a network security group better than a subnet ACL for this requirement?
Does a cloud NAT gateway control inbound access to a cloud server?
Could a VPC be used to isolate one server from others in the same subnet?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
ERB14 👍 1 Answered DNetwork Security Group (NSG): Operates at the virtual network interface (NIC) or virtual machine level. It allows you to filter network traffic to and from specific servers/instances independently, without impacting other resources residing in the same subnet.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All N10-009 Questions
Access 100 questions with complete answers and detailed explanations.
View Full N10-009 Practice Test →