Implement and Manage Virtual Networking →mediumMultiple SelectObjective-mapped

AZ-104 Implement and Manage Virtual Networking Practice Question

A web tier and API tier run in different subnets. The API subnet NSG currently has Deny-8443 from Any at priority 200 and Allow-8443-WebToApi from ASG-Web to ASG-Api at priority 300. Web requests on TCP 8443 are failing. Which two changes should the administrator make? Select two.

⚠ Common exam trap

The trap here is that candidates often forget that NSG rules are evaluated in priority order (lower number = higher priority) and that application security groups require explicit NIC assignment—they may assume the ASG rule works automatically or that changing the protocol or adding a route table can bypass a deny rule.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Move the allow rule to a lower priority number than 200.

B is correct because NSG rules are evaluated in priority order, with lower numbers having higher priority. The Deny-8443 rule at priority 200 is evaluated before the Allow-8443-WebToApi rule at priority 300, so the deny rule blocks the traffic. Moving the allow rule to a lower priority number (e.g., 100) ensures it is evaluated first, allowing the traffic. C is correct because the allow rule uses application security groups (ASGs); if the web and API NICs are not assigned to the respective ASGs, the rule will not match any traffic, effectively making it a no-op.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Move the allow rule to a higher priority number than 200.
Why it's wrong here
In NSG priority ordering, a higher numeric value means a lower evaluation precedence. Moving the allow rule above 200 (for example, to 300) causes the deny rule at 200 to be evaluated first, and because NSGs are processed sequentially until the first match, the deny action is taken immediately. The allow rule will never be examined for that traffic, so this change actually worsens the problem by keeping the deny rule supreme.
When this WOULD be correct
If the question described a scenario where the deny rule was at a lower priority (e.g., 300) and the allow rule at a higher priority (e.g., 200), moving the allow rule to a higher priority number (e.g., 400) would be correct to ensure the deny rule takes precedence.
✓
Move the allow rule to a lower priority number than 200.
Why this is correct
NSG rules are processed in ascending priority order, with lower numbers taking precedence. To allow traffic that is currently blocked by a deny rule at priority 200, the allow rule must be assigned a priority number lower than 200—for example, 100. Because NSG processing stops at the first matching rule, the allow rule at 100 will be evaluated and applied before the deny rule is ever reached, permitting the traffic.
✓
Ensure the web NICs are added to ASG-Web and the API NICs are added to ASG-Api.
Why this is correct
Application Security Groups (ASGs) let you group virtual machine NICs by workload, and NSG rules can reference these groups as sources or destinations. An NSG rule using ASG-Web and ASG-Api will only match when the corresponding network interfaces are actual members of those ASGs. If the web tier and API tier NICs are not correctly assigned to their respective ASGs, the allow rule will not match any traffic, leaving the lower-priority deny rule to block it.
✗
Change the rule protocol from TCP to Any.
Why it's wrong here
Changing the protocol from TCP to Any in the allow rule broadens the protocol match criteria, but it does not alter the critical factor: rule priority. Since the deny rule at priority 200 is still evaluated before an allow rule with priority greater than 200, the deny will still match and block the traffic regardless of protocol. Protocol is just one of the match conditions; it has no effect on the order in which rules are processed.
When this WOULD be correct
If the Deny-8443 rule had a protocol-specific condition (e.g., only blocking TCP) and the traffic was using a different protocol (e.g., UDP), changing the allow rule to Any would permit the traffic. For example, if the question stated that web requests were failing on UDP 8443 and the deny rule only blocked TCP, then changing the allow rule to Any would be correct.
✗
Attach a route table to the API subnet to override the deny behavior.
Why it's wrong here
User-defined route tables control the next-hop path for packets based on destination IP prefixes, not the hardware or software security filtering performed by NSGs. Even if you add a route that sends API subnet traffic elsewhere, the NSG still inspects the traffic as it enters or exits the subnet and applies its rules independently. Routing and NSG filtering operate at different layers, so a route table cannot override or bypass the explicit deny action in an NSG rule.
When this WOULD be correct
If the question described asymmetric routing or forced tunneling where traffic from the web tier to the API tier was being sent to a network virtual appliance (NVA) that dropped the packets, then adding a route table to direct traffic directly between subnets could resolve the issue.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

✓Move the allow rule to a lower priority number than 200.Correct answer▾

Why this is correct

NSG rules are processed in ascending priority order, with lower numbers taking precedence. To allow traffic that is currently blocked by a deny rule at priority 200, the allow rule must be assigned a priority number lower than 200—for example, 100. Because NSG processing stops at the first matching rule, the allow rule at 100 will be evaluated and applied before the deny rule is ever reached, permitting the traffic.

✗Move the allow rule to a higher priority number than 200.Wrong answer — click to see why▾

Why this is wrong here

In Azure NSGs, rules are processed in priority order with lower numbers evaluated first. A deny rule at priority 200 blocks traffic before the allow rule at priority 300 is evaluated, so moving the allow rule to a higher priority number (e.g., 400) would still be evaluated after the deny and thus never match.

★ When this WOULD be the correct answer

If the question described a scenario where the deny rule was at a lower priority (e.g., 300) and the allow rule at a higher priority (e.g., 200), moving the allow rule to a higher priority number (e.g., 400) would be correct to ensure the deny rule takes precedence.

Why candidates choose this

Candidates may mistakenly think that a higher priority number means higher precedence, or they may confuse the numeric priority scale (lower number = higher priority) with common ranking systems where higher numbers indicate greater importance.

✗Change the rule protocol from TCP to Any.Wrong answer — click to see why▾

Why this is wrong here

The Deny-8443 rule at priority 200 blocks all traffic on TCP 8443, and the Allow-8443-WebToApi rule at priority 300 is evaluated after the deny, so it never applies. Changing the protocol to Any does not resolve the priority order issue; the deny rule still blocks the traffic regardless of protocol.

★ When this WOULD be the correct answer

If the Deny-8443 rule had a protocol-specific condition (e.g., only blocking TCP) and the traffic was using a different protocol (e.g., UDP), changing the allow rule to Any would permit the traffic. For example, if the question stated that web requests were failing on UDP 8443 and the deny rule only blocked TCP, then changing the allow rule to Any would be correct.

Why candidates choose this

Candidates may think that if the deny rule blocks TCP, changing the allow rule to Any would bypass the protocol restriction, but they overlook that the priority order still prevents the allow rule from being evaluated.

✗Attach a route table to the API subnet to override the deny behavior.Wrong answer — click to see why▾

Why this is wrong here

Route tables control traffic routing between subnets, not NSG rule evaluation. The deny rule at priority 200 is blocking traffic before the allow rule at priority 300 is evaluated, so a route table cannot override NSG deny behavior.

★ When this WOULD be the correct answer

If the question described asymmetric routing or forced tunneling where traffic from the web tier to the API tier was being sent to a network virtual appliance (NVA) that dropped the packets, then adding a route table to direct traffic directly between subnets could resolve the issue.

Why candidates choose this

Candidates may confuse NSG rules with route tables, thinking that route tables can override NSG deny rules, or they may overcomplicate the problem by assuming a routing issue when it is actually a rule priority problem.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Visual reference

Go deeper

AZ-104 Implement and Manage Virtual Networking Practice Question

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question