A VM in Azure cannot accept RDP connections from your office public IP. The subnet NSG already has an inbound deny-all rule at priority 200, and you added an allow rule for TCP 3389 from 198.51.100.25/32 at priority 300. What should you do to allow the connection?

Change the source to Internet so the allow rule matches more traffic.

This broadens access unnecessarily and still loses to the lower-priority deny rule.

Change the protocol from TCP to Any to bypass the deny rule.

The deny-all rule still matches first by priority, regardless of protocol selection.

Assign a public IP directly to the VM to override the subnet NSG behavior.

A public IP changes reachability, but it does not override NSG rule evaluation order.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Create or move the allow rule to priority 100 so it is evaluated before the deny rule. — Azure NSG rules are evaluated by priority, where the lowest numeric value wins. In this case, the deny-all inbound rule at priority 200 is processed before the allow rule at 300, so the traffic is blocked. Moving or creating the allow rule at a lower number, such as priority 100, ensures the RDP traffic from the office IP is permitted before the deny rule is reached. Why others are wrong: Changing the source to Internet does not fix the priority conflict and would expand exposure. Changing the protocol to Any still leaves the allow rule below the deny-all rule, so it remains ineffective. Adding a public IP affects how the VM is addressed, but NSGs still control whether the traffic is allowed.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.