AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create an allow rule with a higher priority number than 200.

  Why it's wrong here

  Setting an allow rule with a priority number greater than 200, such as 300, places it after the deny rule in the evaluation sequence. NSG processing stops at the first matching rule, so the deny rule at priority 200 matches RDP traffic from any source and blocks it before the later allow rule is ever examined. Because the deny rule is already in place at a lower numeric value, a higher-numbered allow rule can never override it. The only way to permit RDP is to insert an allow rule with a priority lower than 200.

  When this WOULD be correct

  This option would be correct if the question stated that the existing rule was an allow rule (not a deny rule) and the goal was to override it with a more specific deny rule. For example, 'A subnet NSG contains an allow RDP rule from Any at priority 200. The administrator must block RDP from 10.8.0.0/24. What should the administrator do?'

• ✓

  Create an allow rule with a lower priority number than 200.

  Why this is correct

  Azure NSGs process rules in ascending priority order, meaning the lowest numeric priority value is evaluated first and the first rule that matches traffic determines the outcome. To permit RDP TCP/3389 despite the deny rule at priority 200, add an allow rule with a lower number, such as 100, so it is matched before the deny. This allow rule can scope source IPs, service tags, or prefixes as needed, but it must have a numeric priority less than 200 to take precedence. If the allow rule has any higher number, it will never be reached because the deny rule already terminates processing.

• ✗

  Add a route table entry for TCP 3389.

  Why it's wrong here

  Route tables (user-defined routes) determine the next hop for traffic based on destination IP prefixes, not the allowed ports or protocols. They operate at layer 3 and do not inspect TCP/UDP port 3389, so adding an entry for TCP 3389 is meaningless in an NSG context. A route table entry cannot override NSG deny rules, and NSGs are evaluated after routing decisions are made. Traffic must pass the NSG rule process regardless of the route, so this option does not address the RDP block at all.

  When this WOULD be correct

  In a scenario where traffic to a subnet is being routed through a network virtual appliance (NVA) and you need to ensure RDP traffic from 10.8.0.0/24 reaches the NVA, adding a route table entry for TCP 3389 with the next hop as the NVA would be correct.

• ✗

  Disable the default security rules on the NSG.

  Why it's wrong here

  Disabling the default security rules, such as AllowVnetInBound or DenyAllInBound, has no effect on the custom deny rule at priority 200. Default rules are built-in and always evaluated last, after all custom rules, meaning they are not responsible for blocking RDP in this scenario. Even if you disabled every default rule, the deny at priority 200 would still match and block the traffic. Default rules are a safety net for base connectivity and cannot preempt a higher-priority custom rule.

  When this WOULD be correct

  In a scenario where default rules are blocking legitimate traffic that cannot be overridden by custom rules (e.g., a default deny rule with no higher priority), and the requirement is to permit all inbound traffic to the subnet, disabling default rules might be considered. However, this is rare and usually not recommended.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question