A subnet NSG contains a deny inbound rule for TCP 3389 from Any at priority 100 and an allow inbound rule for TCP 3389 from 10.4.1.0/24 at priority 200. Admin workstations in 10.4.1.0/24 cannot connect by RDP. What change should the administrator make?

Replace the source IP range with an application security group in the allow rule.

Source grouping helps manageability, but it does not fix a higher-priority deny rule.

Change the protocol from TCP to Any in the allow rule.

The rule already matches RDP traffic; protocol broadening does not change priority order.

Add a user-defined route to the subnet so RDP traffic bypasses the NSG.

Routing changes do not bypass NSG filtering, because NSGs still evaluate the packet.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Lower the allow rule priority number so it is evaluated before the deny rule. — Azure NSG rules are processed in priority order, where the lowest number is evaluated first. In this case, the deny rule at priority 100 matches before the allow rule at 200, so the connection is blocked even though the source is permitted. The fix is to assign the allow rule a lower number than 100, such as 90, so the intended management subnet is permitted before the broader deny rule is applied. Why others are wrong: Changing the source object type or protocol does not overcome a rule that is already denied earlier in the list. A user-defined route changes next-hop selection, not security enforcement. The core issue is the rule order, so the correct remediation must adjust priority rather than the address, protocol, or routing layer.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.