AZ-104 Implement and Manage Virtual Networking Practice Question
A subnet has an NSG with these inbound rules: priority 100 denies TCP 443 from Any, and priority 200 allows TCP 443 from an Application Security Group named WebFrontEnd. A backend VM in the subnet still does not accept traffic from the frontend tier. What should the administrator change?
⚠ Common exam trap
A common mix-up: candidates assume allow rules override deny rules or that more specific rules (like those using Application Security Groups) take precedence regardless of priority, but in Azure NSGs, priority order strictly determines which rule is applied first.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Move the allow rule to a lower priority number than the deny rule.
Network Security Group (NSG) rules are evaluated in priority order, with lower numbers evaluated first. Since the deny rule has priority 100 and the allow rule has priority 200, the deny rule is evaluated first and blocks TCP 443 traffic from any source, including the WebFrontEnd Application Security Group. To allow the frontend traffic, the allow rule must be moved to a lower priority number (e.g., 90) so it is evaluated before the deny rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the allow rule source from an Application Security Group to VirtualNetwork.
Why it's wrong here
Changing the allow rule's source from an Application Security Group to the VirtualNetwork service tag alters which source IPs the rule matches, but it does not affect the priority-based evaluation order. The core issue is that the deny rule at priority 100 is processed before the allow rule at priority 200, so the allow rule is never reached regardless of its source definition. Because NSG rules are evaluated in ascending numeric priority order and the first match terminates processing, modifying the source alone will not prevent the deny rule from blocking the traffic; the allow rule must have a lower priority number than the deny rule to be evaluated first.
When this WOULD be correct
If the question stated that the allow rule had a lower priority (higher number) than the deny rule, but traffic from the frontend tier was still not reaching the backend VM because the frontend VMs were not in the same virtual network as the backend subnet, then changing the source from an Application Security Group to VirtualNetwork would allow traffic from any VM in the virtual network.
- ✓
Move the allow rule to a lower priority number than the deny rule.
Why this is correct
NSG rules are processed by priority, and the lowest number wins. Because the deny rule at priority 100 is evaluated before the allow rule at 200, the traffic is blocked. The administrator should make the allow rule a smaller number than the deny rule or remove the conflicting deny rule.
- ✗
Attach a user-defined route to the subnet so traffic bypasses the NSG.
Why it's wrong here
User-defined routes (UDRs) operate at Layer 3 to control the next hop for traffic, but they do not supersede or bypass NSG filtering. An NSG is a stateful packet filter that evaluates inbound traffic based on priority-ordered rules, and this evaluation occurs at the subnet or network interface level before any routing decision is applied. Therefore, even if a UDR directs traffic to a different next hop, the NSG deny rule at priority 100 still matches and blocks the packet; the route never allows traffic to 'bypass' the NSG because NSG processing happens regardless of the effective route.
When this WOULD be correct
An administrator needs to force traffic from a subnet to go through a network virtual appliance (NVA) for inspection. In that scenario, a UDR is attached to the subnet to override the default system route and direct traffic to the NVA, ensuring traffic bypasses direct routing.
- ✗
Place the backend VM in a different availability set so the rule is evaluated differently.
Why it's wrong here
Availability sets are a VM placement construct used to provide high availability by distributing instances across fault domains and update domains, which reduces the impact of hardware failures and planned maintenance. They have no relationship to network security or NSG rule processing, because NSGs filter traffic at the network layer based on source/destination IPs, ports, and protocol, not on VM placement. Moving the backend VM to a different availability set would have zero effect on the NSG's inbound rule evaluation; the deny rule at priority 100 would still be matched first and block the traffic, so this option cannot resolve the problem.
When this WOULD be correct
In a scenario where a VM in an availability set is not receiving traffic due to a load balancer health probe failing because VMs in the same availability set are all down, moving the VM to a different availability set could restore connectivity by ensuring at least one healthy VM responds.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Move the allow rule to a lower priority number than the deny rule.Correct answer▾
Why this is correct
NSG rules are processed by priority, and the lowest number wins. Because the deny rule at priority 100 is evaluated before the allow rule at 200, the traffic is blocked. The administrator should make the allow rule a smaller number than the deny rule or remove the conflicting deny rule.
✗Change the allow rule source from an Application Security Group to VirtualNetwork.Wrong answer — click to see why▾
Why this is wrong here
The NSG rules are evaluated by priority order; the deny rule at priority 100 blocks all TCP 443 traffic before the allow rule at priority 200 is evaluated. Changing the source to VirtualNetwork does not resolve the priority issue.
★ When this WOULD be the correct answer
If the question stated that the allow rule had a lower priority (higher number) than the deny rule, but traffic from the frontend tier was still not reaching the backend VM because the frontend VMs were not in the same virtual network as the backend subnet, then changing the source from an Application Security Group to VirtualNetwork would allow traffic from any VM in the virtual network.
Why candidates choose this
Candidates may think that using an Application Security Group is too restrictive and that allowing traffic from the entire virtual network is a broader and safer approach, overlooking that the core issue is rule priority.
✗Attach a user-defined route to the subnet so traffic bypasses the NSG.Wrong answer — click to see why▾
Why this is wrong here
NSGs filter traffic based on rules; a user-defined route (UDR) controls traffic routing, not NSG filtering. Attaching a UDR does not bypass NSG rules, so it would not resolve the issue where a higher-priority deny rule blocks traffic.
★ When this WOULD be the correct answer
An administrator needs to force traffic from a subnet to go through a network virtual appliance (NVA) for inspection. In that scenario, a UDR is attached to the subnet to override the default system route and direct traffic to the NVA, ensuring traffic bypasses direct routing.
Why candidates choose this
Candidates may confuse NSG filtering with routing, thinking that changing the route can bypass security rules. They might also believe that UDRs can override all network controls, not just routing decisions.
✗Place the backend VM in a different availability set so the rule is evaluated differently.Wrong answer — click to see why▾
Why this is wrong here
Availability sets affect VM high availability, not NSG rule evaluation. NSG rules are evaluated based on priority and source/destination, not the VM's availability set membership.
★ When this WOULD be the correct answer
In a scenario where a VM in an availability set is not receiving traffic due to a load balancer health probe failing because VMs in the same availability set are all down, moving the VM to a different availability set could restore connectivity by ensuring at least one healthy VM responds.
Why candidates choose this
Candidates may confuse availability sets with network isolation or think that changing the VM's placement alters how NSG rules are applied, due to a misunderstanding of Azure networking and high availability concepts.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Network Security Groups (NSG)
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Network security
Network security is the practice of protecting a computer network from unauthorized access, misuse, malfunction, modification, destruction, or improper disclosure, ensuring the confidentiality, integrity, and availability of data and resources.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A subnet has an NSG with these inbound rules: priority 200 DenyAllInbound and priority 300 AllowHTTPSFromInternet. A VM in the subnet is still unreachable on TCP 443 from the internet. What should you do to make HTTPS work while keeping the deny rule in place?
medium- ✓ A.Move the allow HTTPS rule to a lower priority number such as 100 so it is evaluated before the deny rule.
- B.Create the same allow rule on the NIC-level NSG at priority 300 and leave the subnet NSG unchanged.
- C.Change the deny rule to protocol Any and keep the same priority so Azure evaluates the allow rule first.
- D.Add a route table entry for TCP 443 traffic so Azure sends it directly to the VM.
Why A: NSG rules are evaluated in priority order, with lower numbers evaluated first. Moving the allow HTTPS rule to priority 100 ensures it is processed before the DenyAllInbound rule at priority 200, allowing TCP 443 traffic from the internet while the deny rule remains in place for all other inbound traffic.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.