A subnet has an NSG with a custom inbound deny-all rule at priority 200. You need to allow HTTPS traffic to a VM in that subnet from any source. Which action should you take?

Create an inbound allow rule for TCP 443 with priority 300.

A lower-priority allow rule would still lose to the existing deny-all rule at priority 200.

Change the deny-all rule to outbound instead of inbound.

That would not solve the inbound HTTPS requirement and could weaken intended traffic controls.

Add a route table entry for port 443 traffic to the VM subnet.

Route tables control next hops, not allow or deny decisions for traffic permitted by an NSG.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Create an inbound allow rule for TCP 443 with priority 100. — NSG rules are processed by priority, and the lowest number wins. Because the deny-all inbound rule is at priority 200, any allow rule for HTTPS must have a lower number such as 100 to be evaluated first. The rule should also match inbound TCP traffic on port 443 from the desired source. Why others are wrong: Option A is evaluated after the deny rule, so it would not be effective. Option C changes the wrong direction and does not allow inbound HTTPS. Option D is unrelated because routing does not override NSG allow and deny decisions.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.