A web tier and API tier run in different subnets. The API subnet NSG currently has Deny-8443 from Any at priority 200 and Allow-8443-WebToApi from ASG-Web to ASG-Api at priority 300. Web requests on TCP 8443 are failing. Which two changes should the administrator make? Select two.

Move the allow rule to a higher priority number than 200.

A higher priority number makes the allow rule evaluate later, so the deny rule would still win.

Change the rule protocol from TCP to Any.

Protocol flexibility will not help if the deny rule is still evaluated before the allow rule.

Attach a route table to the API subnet to override the deny behavior.

Route tables affect next-hop selection, not security filtering performed by the NSG.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Move the allow rule to a lower priority number than 200. — The deny rule at priority 200 is evaluated before the allow rule at 300, so the traffic is blocked regardless of the ASG-based permit. To fix the problem, the allow rule must have a lower priority number than the deny rule, and the source and destination NICs must actually belong to the referenced ASGs. Together, these changes make the intended 8443 flow match the allow rule first. Why others are wrong: Raising the allow rule priority makes it even less likely to match before the deny. Switching the protocol to Any does not solve priority or membership issues. Route tables do not bypass NSG enforcement, because NSGs filter traffic independently of routing decisions.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.