A subnet NSG contains a deny RDP rule from Any at priority 200. The administrator must allow RDP from 10.8.0.0/24 to the virtual machines in that subnet. What should the administrator do?

Create an allow rule with a higher priority number than 200.

Higher priority numbers are evaluated later, so the deny rule would still block RDP traffic first.

Add a route table entry for TCP 3389.

Route tables choose next hops for traffic, but they do not permit or deny ports like an NSG does.

Disable the default security rules on the NSG.

Default rules are built in and are not the reason the custom deny rule blocks this traffic.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Create an allow rule with a lower priority number than 200. — Azure Network Security Groups evaluate rules from the lowest priority number to the highest. Because a deny RDP rule already exists at priority 200, the administrator must add an allow rule with a smaller number, such as 100, so it is processed first. The source should be restricted to 10.8.0.0/24, which keeps the access limited to the approved admin subnet while still permitting RDP. Why others are wrong: A higher priority number is evaluated after the deny rule, so it would not override the block. A route table cannot open or close TCP ports. Disabling default security rules is unnecessary here and does not address the custom deny rule that is already controlling the traffic flow.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.