A VM in a subnet has both a subnet-level NSG and a NIC-level NSG. The subnet NSG allows inbound TCP 22 from the VirtualNetwork service tag, but the NIC NSG denies inbound TCP 22 from the same source. An administrator says the subnet rule should be enough because it allows the traffic. What is the actual behavior?

The allow rule wins because subnet NSGs always override NIC NSGs.

Subnet NSGs do not automatically override NIC NSGs. Both scopes are evaluated, and a deny at either scope blocks the traffic.

The traffic is allowed because service tags bypass NIC-level rules.

Service tags simplify rule targeting, but they do not bypass evaluation or ignore a deny rule at another NSG scope.

The connection succeeds unless a route table sends the traffic elsewhere.

Routing affects the path, not the security decision. NSG denies are enforced independently of route table configuration.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: The traffic is blocked because a deny in either NSG is effective. — In Azure, packet filtering is effectively the result of both NSG scopes. A packet must be allowed by the relevant rules at the subnet and NIC levels. If either NSG has a matching deny rule, the traffic is blocked. In this scenario, the NIC-level deny on TCP 22 prevents access even though the subnet-level NSG allows it. Why others are wrong: Subnet NSGs do not override NIC NSGs. Service tags help define the source or destination, but they do not exempt traffic from another deny rule. Route tables determine where packets go, not whether the security rules permit them.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.