A subnet NSG contains these inbound rules: Priority 100 denies TCP 8443 from VirtualNetwork to any destination, Priority 110 allows TCP 8443 from AzureLoadBalancer to any destination, and Priority 200 allows TCP 8443 from ASG-Web to ASG-App. The app VM NIC has no additional inbound rules. Web servers are members of ASG-Web and the app VM is a member of ASG-App. The web tier still cannot connect to TCP 8443. What should the administrator change?

Replace ASG-Web with the VirtualNetwork service tag in the allow rule.

Using VirtualNetwork would broaden the rule to more sources, not narrow it. It would also still lose to the deny rule at priority 100 unless the rule order changes.

Add a route table that sends TCP 8443 traffic to the app subnet.

A route table controls next hop selection, not NSG filtering. Routing changes cannot override an inbound deny rule, so the connection would still be blocked.

Create a second NSG on the app NIC with an allow rule at priority 50.

A NIC-level allow rule cannot override a subnet-level deny that already matched traffic first. The effective decision is still deny when the subnet rule with the lower priority number applies.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Move the allow rule for ASG-Web to ASG-App to a priority lower than 100. — The deny rule at priority 100 is evaluated before the allow rule at priority 200, so traffic from the web tier is blocked before it can reach the intended allow. The fix is to place the specific allow rule ahead of the deny rule by giving it a lower priority number than 100. Because the rule uses ASG-Web and ASG-App, it remains narrowly scoped while still permitting the required application traffic. Why others are wrong: Changing the source to VirtualNetwork makes the rule less precise and still does not beat the higher-priority deny. A route table does not influence NSG allow/deny decisions, so it cannot solve the problem. Adding a NIC-level allow rule also fails if a subnet-level deny already matches first, because NSG evaluation stops at the first applicable rule.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.