AZ-104 Implement and Manage Virtual Networking Practice Question
You need to allow or deny traffic to and from resources in an Azure subnet based on source IP address, destination port, and protocol. Which Azure feature should you use?
⚠ Common exam trap
Test-takers frequently confuse route tables (which control traffic paths) with NSGs (which control traffic permissions), especially when the question mentions 'allow or deny traffic'—route tables never deny traffic, they only redirect it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A network security group
A network security group (NSG) is the correct Azure feature because it acts as a stateful, distributed firewall that filters traffic to and from Azure resources in a virtual network. NSGs contain security rules that allow or deny inbound and outbound traffic based on source/destination IP address, port, and protocol (TCP, UDP, or ICMP). This directly matches the requirement to control traffic based on source IP, destination port, and protocol.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A network security group
Why this is correct
A network security group (NSG) is the Azure resource that acts as a distributed virtual firewall for inbound and outbound traffic. It contains security rules that apply a priority, source/destination address, port, and protocol to explicitly allow or deny traffic at a subnet or network interface (NIC) level. By default, NSGs include built-in rules like allowing virtual network traffic and denying all internet-inbound traffic, but you can override these with custom rules. Associating an NSG with a subnet is the standard method for controlling traffic to and from resources inside that subnet.
- ✗
A route table
Why it's wrong here
A route table controls the next hop for packets at the network layer, determining the path traffic takes (e.g., to a virtual network, the internet, or a virtual appliance). It does not evaluate whether traffic is permitted; it only specifies where the traffic should be sent once it is allowed to flow. While routing traffic through an NVA (network virtual appliance) could incidentally enable filtering if that appliance is configured to do so, the route table itself never drops or blocks traffic based on security policies. Therefore, a route table alone is not the correct component for allowing or denying subnet traffic.
When this WOULD be correct
You need to control the next hop for traffic leaving a subnet, such as forcing all internet-bound traffic through a network virtual appliance. A route table with custom routes would be the correct answer.
- ✗
A private DNS zone
Why it's wrong here
A private DNS zone is used to provide name resolution for virtual machines and other resources within a virtual network, mapping hostnames to private IP addresses. It does not inspect, filter, or act on network packets in any way, so it has no capability to allow or deny actual traffic flows. Even if a malicious host is resolved to an IP via DNS, that's a resolution operation, not a traffic permission decision. Thus, a private DNS zone cannot be used to enforce ingress or egress filtering in a subnet.
When this WOULD be correct
You need to resolve a custom domain name (e.g., contoso.com) to private IP addresses within your Azure virtual network, ensuring that resources in the VNet can resolve the name without exposing it to the internet.
- ✗
Azure Advisor
Why it's wrong here
Azure Advisor is a personalized cloud consultant service that analyzes your Azure resources and provides recommendations for best practices around cost, security, reliability, and performance. It cannot alter traffic flows or enforce any security policy; it only produces actionable recommendations that you must implement manually. Because it has no data-plane access to network packets, it cannot be used to allow or deny traffic at a subnet level. Thus, Azure Advisor is completely unrelated to the required function of filtering subnet traffic.
When this WOULD be correct
You need to identify and implement recommendations to improve the security posture of your Azure resources, such as enabling network security groups or applying just-in-time VM access. Azure Advisor would provide the relevant security recommendations.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A network security groupCorrect answer▾
Why this is correct
A network security group (NSG) is the Azure resource that acts as a distributed virtual firewall for inbound and outbound traffic. It contains security rules that apply a priority, source/destination address, port, and protocol to explicitly allow or deny traffic at a subnet or network interface (NIC) level. By default, NSGs include built-in rules like allowing virtual network traffic and denying all internet-inbound traffic, but you can override these with custom rules. Associating an NSG with a subnet is the standard method for controlling traffic to and from resources inside that subnet.
✗A route tableWrong answer — click to see why▾
Why this is wrong here
Route tables control network traffic routing paths, not allow/deny rules based on source IP, destination port, or protocol. They determine where traffic goes, not whether it is permitted.
★ When this WOULD be the correct answer
You need to control the next hop for traffic leaving a subnet, such as forcing all internet-bound traffic through a network virtual appliance. A route table with custom routes would be the correct answer.
Why candidates choose this
Candidates may confuse routing (path selection) with filtering (permission), assuming that controlling routes can also block traffic, but route tables do not provide access control lists.
✗A private DNS zoneWrong answer — click to see why▾
Why this is wrong here
A private DNS zone is used for custom domain name resolution within a virtual network, not for filtering traffic based on source IP, port, or protocol.
★ When this WOULD be the correct answer
You need to resolve a custom domain name (e.g., contoso.com) to private IP addresses within your Azure virtual network, ensuring that resources in the VNet can resolve the name without exposing it to the internet.
Why candidates choose this
Candidates may confuse DNS with network security, thinking that DNS zones can control access by resolving names to different IPs, but they do not filter traffic.
✗Azure AdvisorWrong answer — click to see why▾
Why this is wrong here
Azure Advisor provides recommendations for best practices in cost, security, reliability, and performance, but it does not allow or deny traffic based on source IP, port, or protocol.
★ When this WOULD be the correct answer
You need to identify and implement recommendations to improve the security posture of your Azure resources, such as enabling network security groups or applying just-in-time VM access. Azure Advisor would provide the relevant security recommendations.
Why candidates choose this
Candidates may confuse Azure Advisor's security recommendations with actual traffic filtering capabilities, thinking it can directly control network access.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Network security
Network security is the practice of protecting a computer network from unauthorized access, misuse, malfunction, modification, destruction, or improper disclosure, ensuring the confidentiality, integrity, and availability of data and resources.
Key term
Security group
A security group is a virtual firewall that controls inbound and outbound traffic to AWS resources, such as EC2 instances, based on defined rules.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to control inbound and outbound traffic to resources in a subnet by allowing or denying traffic based on IP address, port, and protocol. Which Azure feature should you use?
medium- ✓ A.A network security group
- B.A route table
- C.A private DNS zone
- D.Azure Advisor
Why A: A network security group (NSG) is the correct Azure feature because it contains security rules that allow or deny inbound and outbound traffic at the subnet or network interface level based on source/destination IP address, port, and protocol (TCP, UDP, or Any). This directly matches the requirement to control traffic by these three parameters.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.