AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Change the source to Internet so the allow rule matches more traffic.

  Why it's wrong here

  Changing the source to Internet broadens the matching scope, but priority dictates which rule acts on traffic. A deny-all rule with a numerically lower priority (higher importance) will still match first and block the RDP attempt, so the allow rule never gets evaluated. This also removes IP-based restricting, allowing any public address to attempt connection, creating a security risk without fixing the connectivity issue.

  When this WOULD be correct

  In a scenario where the NSG has no lower-priority deny rule blocking specific IPs, and you need to allow RDP from any public IP (e.g., for a jump server accessible from anywhere), setting the source to 'Internet' would be appropriate.

• ✓

  Create or move the allow rule to priority 100 so it is evaluated before the deny rule.

  Why this is correct

  NSG rules are evaluated in ascending priority order, meaning numeric 100 takes precedence over a higher-numbered deny rule such as 4096. By placing an allow rule for RDP (port 3389) from your office IP at priority 100, it is processed first and matches before the deny-all rule, permitting the connection. This is the standard method for overriding a broad deny rule while keeping security boundaries intact.

• ✗

  Change the protocol from TCP to Any to bypass the deny rule.

  Why it's wrong here

  Changing the protocol from TCP to Any affects the protocol match parameters, not the rule processing sequence. The deny-all rule at priority 4096 is still evaluated before any lower-priority allow rule, so even an allow rule covering Any protocol will never be reached. In fact, broadening protocol scope wastes effort because the deny rule still wins solely based on priority.

  When this WOULD be correct

  If the question described a scenario where the NSG allow rule for RDP uses TCP but the actual traffic uses a different protocol (e.g., UDP), then changing the protocol to Any could allow the connection. For example, if a VM requires RDP over UDP and the NSG only allows TCP, setting the protocol to Any would match both.

• ✗

  Assign a public IP directly to the VM to override the subnet NSG behavior.

  Why it's wrong here

  Assigning a public IP to the VM's NIC merely exposes the VM to the internet; it does not alter NSG evaluation. Traffic still enters the subnet and is filtered by subnet and NIC NSGs in priority order, so the existing deny-all rule with a lower priority value (e.g., 4096) still blocks port 3389. In fact, adding a public IP can increase attack surface without changing rule evaluation.

  When this WOULD be correct

  This would be correct if the VM is in a subnet without an NSG (or with an allow-all rule) but the VM's NIC has no public IP, and you need to enable inbound RDP from the internet by assigning a public IP and adding an NSG rule on the NIC.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question