A web tier and an app tier run in separate subnets. Each VM NIC is placed in an application security group named WebASG or AppASG. The administrator must allow only the web tier to reach the app tier on TCP port 8443 and block all other inbound traffic to the app tier. Which NSG rule should be created on the app subnet?

Allow TCP 8443 from the entire virtual network to the app subnet with a lower priority than the deny rule.

This would permit more traffic than required because every subnet in the VNet could reach the app tier.

Allow UDP 8443 from WebASG to AppASG with any priority below 65000.

The protocol is wrong because the application requires TCP, and NSG priority still must beat the deny rule.

Allow TCP 8443 from WebASG to AppASG with a priority higher number than the deny rule.

A higher numeric priority is evaluated later, so the deny rule would take effect first and block the traffic.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Allow TCP 8443 from WebASG to AppASG with a priority lower number than the deny rule. — The correct NSG design is to allow TCP 8443 from WebASG to AppASG and place that rule ahead of the deny-all inbound rule by using a lower priority number. Application security groups let you express the workload relationship cleanly without hardcoding IP addresses. This satisfies the least-privilege requirement and keeps the rest of the inbound traffic blocked. Why others are wrong: A broad virtual-network source is too permissive for the stated business requirement. UDP is the wrong protocol for the application flow. A rule with a numerically higher priority is evaluated after the deny-all rule, so it would never be reached for matching traffic.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.