AZ-104 Implement and Manage Virtual Networking Practice Question
A subnet has an NSG with these inbound rules: priority 200 DenyAllInbound and priority 300 AllowHTTPSFromInternet. A VM in the subnet is still unreachable on TCP 443 from the internet. What should you do to make HTTPS work while keeping the deny rule in place?
⚠ Common exam trap
Watch out — candidates often think NSG rules are evaluated based on specificity (e.g., more specific rules override broader ones) rather than strictly by priority number, leading them to believe a higher-priority allow rule can override a lower-priority deny rule.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Move the allow HTTPS rule to a lower priority number such as 100 so it is evaluated before the deny rule.
NSG rules are evaluated in priority order, with lower numbers evaluated first. Moving the allow HTTPS rule to priority 100 ensures it is processed before the DenyAllInbound rule at priority 200, allowing TCP 443 traffic from the internet while the deny rule remains in place for all other inbound traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Move the allow HTTPS rule to a lower priority number such as 100 so it is evaluated before the deny rule.
Why this is correct
NSG rules are processed in order of priority, and the lowest number wins. Because the deny rule at 200 is evaluated before the allow rule at 300, HTTPS is blocked. Moving the allow rule to a lower priority number lets it match first while keeping the deny rule for all other inbound traffic.
- ✗
Create the same allow rule on the NIC-level NSG at priority 300 and leave the subnet NSG unchanged.
Why it's wrong here
Inbound traffic destined for a VM is evaluated first by the subnet NSG; only traffic that is allowed there reaches the NIC-level NSG. Because the deny rule at priority 200 exists on the subnet NSG and matches TCP 443, the packet is dropped before the NIC allow rule at priority 300 is ever considered. Additionally, a priority of 300 is numerically higher, meaning lower precedence even within a combined rule set, so this change cannot override the existing deny.
When this WOULD be correct
If the question stated that the subnet NSG has no deny rule, but the NIC-level NSG has a deny rule at priority 200, then creating an allow rule at priority 300 on the NIC-level NSG would be correct to allow HTTPS traffic while keeping the deny rule in place.
- ✗
Change the deny rule to protocol Any and keep the same priority so Azure evaluates the allow rule first.
Why it's wrong here
Rule evaluation order in an NSG is determined exclusively by the priority number, not by the protocol or any other rule attribute. Changing the deny rule to protocol Any makes it match every protocol, including HTTPS, while it retains the lower priority number (200) and therefore is still evaluated before the allow rule at 300. As a result, the deny rule will match first and block the traffic, so this modification makes the situation worse.
When this WOULD be correct
If the question stated that the deny rule was blocking HTTPS because it only allowed TCP traffic but the deny rule was set to protocol Any, and the allow rule was at a lower priority (e.g., 100), then changing the deny rule to protocol Any would not help. However, if the question asked how to ensure all traffic except HTTPS is denied, and the allow rule already had a lower priority, then setting the deny rule to protocol Any would be correct to block all other protocols.
- ✗
Add a route table entry for TCP 443 traffic so Azure sends it directly to the VM.
Why it's wrong here
User-defined routes (route table entries) specify a next hop based solely on the destination IP address prefix; they have no concept of TCP port or protocol, so a rule for 'TCP 443' is not a valid route condition. Even if you forced traffic toward the VM, the subnet NSG still filters all traffic entering the subnet, and its deny rule at priority 200 would still block the HTTPS request. A route can redirect network traffic but can never bypass an NSG deny rule.
When this WOULD be correct
In a scenario where traffic to a VM is failing because it is being routed to a different destination (e.g., a network virtual appliance) instead of directly to the VM, adding a route table entry to direct traffic to the VM's IP would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Move the allow HTTPS rule to a lower priority number such as 100 so it is evaluated before the deny rule.Correct answer▾
Why this is correct
NSG rules are processed in order of priority, and the lowest number wins. Because the deny rule at 200 is evaluated before the allow rule at 300, HTTPS is blocked. Moving the allow rule to a lower priority number lets it match first while keeping the deny rule for all other inbound traffic.
✗Create the same allow rule on the NIC-level NSG at priority 300 and leave the subnet NSG unchanged.Wrong answer — click to see why▾
Why this is wrong here
The subnet NSG's deny rule at priority 200 blocks all inbound traffic before the allow rule at priority 300 is evaluated. Adding an identical allow rule to the NIC-level NSG at priority 300 does not override the subnet NSG's deny rule because subnet NSG rules are evaluated before NIC NSG rules, and the deny rule already blocks the traffic.
★ When this WOULD be the correct answer
If the question stated that the subnet NSG has no deny rule, but the NIC-level NSG has a deny rule at priority 200, then creating an allow rule at priority 300 on the NIC-level NSG would be correct to allow HTTPS traffic while keeping the deny rule in place.
Why candidates choose this
Candidates may think that NIC-level NSG rules override subnet-level NSG rules, or that adding a rule at the same priority on the NIC will somehow bypass the subnet's deny rule, misunderstanding the order of evaluation (subnet NSG first, then NIC NSG).
✗Change the deny rule to protocol Any and keep the same priority so Azure evaluates the allow rule first.Wrong answer — click to see why▾
Why this is wrong here
Changing the deny rule to protocol Any does not affect evaluation order; NSG rules are evaluated by priority number, not protocol scope. The deny rule at priority 200 will still be evaluated before the allow rule at priority 300, blocking HTTPS traffic.
★ When this WOULD be the correct answer
If the question stated that the deny rule was blocking HTTPS because it only allowed TCP traffic but the deny rule was set to protocol Any, and the allow rule was at a lower priority (e.g., 100), then changing the deny rule to protocol Any would not help. However, if the question asked how to ensure all traffic except HTTPS is denied, and the allow rule already had a lower priority, then setting the deny rule to protocol Any would be correct to block all other protocols.
Why candidates choose this
Candidates may mistakenly think that Azure evaluates more specific rules (like protocol-specific) before broader ones, or that changing the deny rule's protocol scope somehow changes evaluation order, when in fact priority numbers alone determine order.
✗Add a route table entry for TCP 443 traffic so Azure sends it directly to the VM.Wrong answer — click to see why▾
Why this is wrong here
Route tables control traffic routing between subnets and networks, not firewall filtering. Since the VM is unreachable due to NSG rules blocking inbound traffic, adding a route table entry does not bypass NSG evaluation; NSGs always apply to traffic entering a subnet or NIC.
★ When this WOULD be the correct answer
In a scenario where traffic to a VM is failing because it is being routed to a different destination (e.g., a network virtual appliance) instead of directly to the VM, adding a route table entry to direct traffic to the VM's IP would be correct.
Why candidates choose this
Candidates may confuse routing with filtering, thinking that a route can override NSG rules or that Azure will prioritize route table entries over NSGs for traffic delivery.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Deny Assignments and Resource Locks Deep Dive
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
TCP
TCP (Transmission Control Protocol) is a core internet protocol that ensures data is sent reliably and in order between devices over a network.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.