AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create an inbound allow rule for TCP 443 with priority 300.

  Why it's wrong here

  A priority of 300 places this allow rule below the existing deny-all at priority 200 in the evaluation order. When an inbound HTTPS packet arrives, the NSG first checks rules in priority sequence; the deny-all matches all inbound traffic, including port 443, and denies it, so rule evaluation stops before the allow rule is ever reached. Thus the allow rule is ineffective — it must have a numerically lower priority value than the deny rule to take precedence.

  When this WOULD be correct

  This option would be correct if the existing deny-all rule had a priority higher than 300 (e.g., 400) or if the question asked for a rule to allow traffic with a lower priority than the deny rule, but the deny rule was at a higher priority number (e.g., 100).

• ✓

  Create an inbound allow rule for TCP 443 with priority 100.

  Why this is correct

  Azure Network Security Group rules are evaluated in ascending order of priority, where a smaller numeric value means higher priority. This rule at priority 100 is evaluated before the deny-all at priority 200, and because it specifically matches TCP port 443 inbound, it will allow HTTPS traffic; once a matching rule is found, evaluation stops. This is the standard way to create an exception above a broad deny-all rule.

• ✗

  Change the deny-all rule to outbound instead of inbound.

  Why it's wrong here

  Moving the custom deny-all rule to the outbound direction does nothing to permit inbound HTTPS, because outbound rules apply only to traffic leaving the subnet. Inbound traffic from the internet would then fall to the default inbound rule DenyAllInBound, which is still a deny, so the connection remains blocked. Additionally, this change removes the deliberate restriction on inbound traffic, exposing the subnet to other unwanted inbound connections and potentially violating your security baseline.

  When this WOULD be correct

  If the question were about allowing outbound HTTPS traffic from the subnet while blocking inbound, changing a deny-all inbound rule to outbound would be incorrect; but if the NSG had an outbound deny-all rule blocking outbound HTTPS, you would need to add an outbound allow rule instead.

• ✗

  Add a route table entry for port 443 traffic to the VM subnet.

  Why it's wrong here

  Route tables, or user-defined routes, control the next hop for packets based on their destination IP address prefix — they operate at Layer 3 and do not filter based on TCP/UDP ports. Adding a route for port 443 is not a valid construct, and even if it were interpreted as a route for the VM's subnet, it would not override NSG allow or deny decisions. An NSG deny rule is a packet filter that blocks traffic at the network interface or subnet level, so any inbound packet is dropped before routing logic can direct it elsewhere.

  When this WOULD be correct

  You need to force HTTPS traffic from the internet to a specific VM through a network virtual appliance (NVA) for inspection. A route table entry with a next hop of the NVA's IP address would redirect traffic accordingly.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question