AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The NIC NSG always overrides the subnet NSG.

  Why it's wrong here

  No single NSG is granted blanket precedence; instead, Azure defines an evaluation order that applies both rule sets. For inbound traffic, the subnet NSG is processed first, followed by the NIC NSG, but any deny produced by the second NSG still blocks the flow. For outbound traffic, the NIC NSG is checked first and then the subnet NSG. Thus the NIC NSG does not override the subnet NSG; effective security rules are the combined result of both, and the actual allow/deny outcome depends on the specific matching rules, not on a fixed hierarchy of association.

  When this WOULD be correct

  This would be correct if the question stated that the NIC NSG has a higher priority than the subnet NSG and that only the NIC NSG is evaluated for inbound traffic, such as in a scenario where the subnet NSG is not applied to the NIC.

• ✗

  Inbound traffic is allowed as long as one NSG has an allow rule.

  Why it's wrong here

  This is incorrect because NSG evaluation is not a simple OR across layers. Each NSG is evaluated independently in priority order, and the first matching rule within that NSG determines that layer's action; a matching deny in any applicable NSG immediately blocks the traffic. An allow rule in the NIC NSG cannot overcome a deny rule in the subnet NSG, nor can a subnet allow overcome a higher-priority NIC deny, so one allow is insufficient to guarantee inbound access.

  When this WOULD be correct

  This option would be correct in a scenario where the question specifies that NSGs are evaluated in a 'union' manner, such as in a hypothetical environment where multiple NSGs are combined and any allow rule permits traffic, or in a context where only one NSG is applied and the other is ignored.

• ✓

  The effective rules are determined by evaluating both NSGs together, and a deny in either applicable path can block access.

  Why this is correct

  When both a subnet NSG and a NIC NSG apply to the same virtual machine, Azure aggregates their rules into the effective security rules for the interface. Evaluation does not simply take the least-restrictive rule; instead, a traffic flow must not violate a deny rule at either layer. Therefore, if a deny rule in the subnet NSG matches, the NIC allow rule cannot rescue the flow, and vice versa, so both NSGs must permit the traffic for it to be allowed.

• ✗

  Subnet NSGs apply only to outbound traffic.

  Why it's wrong here

  A subnet NSG is a stateful firewall rule set that applies to the subnet interface as a whole, filtering both inbound traffic (from the internet, other subnets, or peered networks) and outbound traffic (to any destination). The same NSG can have inbound and outbound security rules with separate priorities and actions. Therefore, limiting subnet NSGs to outbound traffic ignores their primary role in controlling inbound access to all resources placed in that subnet.

  When this WOULD be correct

  If the question asked about the default behavior of a subnet NSG when no explicit inbound rules are defined, but outbound rules are configured, then a candidate might incorrectly think subnet NSGs only apply to outbound traffic. However, this is never correct; subnet NSGs always apply to both directions.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question