A backend VM must accept TCP 8443 only from the web tier. The subnet NSG already has a deny-all inbound rule at priority 200. The administrator adds an allow rule for the web tier at priority 300, but the connection still fails. What should be changed?

Change the allow rule protocol from TCP to Any.

The failure is caused by rule priority, not protocol selection. Changing the protocol alone will not override an earlier deny rule.

Move the VM to a different subnet so the rule can apply.

Subnet placement does not change NSG evaluation. The same priority behavior applies in any subnet where the NSG is attached.

Add a route table entry for TCP 8443 to bypass the NSG.

Route tables control next-hop selection, not packet filtering. They cannot override an NSG deny decision.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Change the allow rule to a lower priority number than 200. — The allow rule must have a lower numeric priority than the deny-all rule. Azure NSGs evaluate rules from the lowest number to the highest, and the first matching rule wins. If the deny-all inbound rule is priority 200, an allow rule at 300 is never reached. Moving the allow rule ahead of the deny rule is the correct fix for this access issue. Why others are wrong: Changing protocol does not help when a lower-numbered deny rule already matches. Moving the VM to another subnet does not bypass NSG logic. Route tables influence forwarding decisions only; they do not control whether the NSG allows or blocks a packet.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.