Implement and Manage Virtual Networking →hardMultiple ChoiceObjective-mapped

AZ-104 Implement and Manage Virtual Networking Practice Question

A Windows VM in Azure has a public IP address, but administrators on the internet cannot connect by using Remote Desktop. You confirm that the VM is running and the guest firewall allows RDP. What is the most likely Azure-side cause?

⚠ Common exam trap

Test-takers frequently assume the guest OS firewall is the only barrier for RDP, overlooking that Azure's NSG acts as a separate, mandatory network-level filter that must explicitly allow inbound TCP 3389 from the internet.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The NSG does not allow inbound TCP 3389

The most likely Azure-side cause is that a Network Security Group (NSG) associated with the VM's subnet or network interface is blocking inbound traffic on TCP port 3389 (RDP). Even if the VM is running and the guest OS firewall allows RDP, an NSG rule must explicitly permit inbound TCP 3389 from the internet (or a specific source) for Remote Desktop connections to succeed. Without such a rule, the NSG silently drops the packets before they reach the VM.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The NSG does not allow inbound TCP 3389
Why this is correct
RDP clients connect to Windows VMs over TCP port 3389. A network security group (NSG) acts as a distributed firewall; if the NSG associated with the VM's subnet or NIC has no inbound allow rule for port 3389 (or has an explicit deny), the default rule denying inbound internet traffic takes effect and drops the connection. Even with a public IP and a healthy VM, this NSG misconfiguration will make RDP time out. Therefore, a missing or blocking NSG rule on TCP 3389 is the direct cause of the RDP failure.
✗
The storage account uses LRS
Why it's wrong here
Locally redundant storage (LRS) replicates VM disks three times within a single datacenter, providing data durability in that datacenter. This redundancy level is purely a storage-level data protection property and has no influence on network configuration, firewall rules, or protocol connectivity to the VM. The VM's operating system disk may reside on a storage account using LRS, but that does not affect the TCP/IP path or RDP service availability. Therefore, selecting LRS as the cause of RDP failure is incorrect.
When this WOULD be correct
A question asks: 'Which storage replication option provides the lowest cost while protecting against server rack failures?' LRS would be correct because it replicates data within a single datacenter, offering resilience against local hardware failures at minimal cost.
✗
Azure Advisor is not enabled
Why it's wrong here
Azure Advisor is a free, built-in service that analyzes deployed resources and provides recommendations across cost, security, reliability, and performance. It does not enforce policies or manage network traffic, and enabling it has no effect on VM inbound connectivity. Since Advisor only runs after resources are provisioned and never sits in the data path, its status cannot block or permit RDP sessions. Thus, 'Azure Advisor is not enabled' is an incorrect explanation for the RDP connectivity problem.
✗
The VM is in an availability set
Why it's wrong here
An availability set is an Azure feature that spreads VMs across multiple fault domains and update domains to protect against datacenter failures and maintenance events. It exists in the control plane to meet high-availability SLAs and does not alter the data plane networking path to each VM. RDP traffic still arrives at the same public IP and traverses the same NSG rules regardless of whether the VM is in an availability set. Consequently, membership in an availability set has no bearing on Remote Desktop connectivity.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

✓The NSG does not allow inbound TCP 3389Correct answer▾

Why this is correct

RDP clients connect to Windows VMs over TCP port 3389. A network security group (NSG) acts as a distributed firewall; if the NSG associated with the VM's subnet or NIC has no inbound allow rule for port 3389 (or has an explicit deny), the default rule denying inbound internet traffic takes effect and drops the connection. Even with a public IP and a healthy VM, this NSG misconfiguration will make RDP time out. Therefore, a missing or blocking NSG rule on TCP 3389 is the direct cause of the RDP failure.

✗The storage account uses LRSWrong answer — click to see why▾

Why this is wrong here

Storage account replication type (LRS) affects data durability and availability, not network connectivity to a VM. It has no impact on RDP access.

★ When this WOULD be the correct answer

A question asks: 'Which storage replication option provides the lowest cost while protecting against server rack failures?' LRS would be correct because it replicates data within a single datacenter, offering resilience against local hardware failures at minimal cost.

Why candidates choose this

Candidates may confuse storage replication with high availability features, thinking LRS might cause connectivity issues due to lack of redundancy, but storage and network are separate concerns.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Visual reference

Go deeper

AZ-104 Implement and Manage Virtual Networking Practice Question

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question