AZ-104 Implement and Manage Virtual Networking Practice Question
You need to allow RDP access from the internet to a Windows VM named VM-Admin01 in Azure. The VM already has a public IP address. Which additional configuration is required?
⚠ Common exam trap
It's easy for candidates to assume a public IP address alone is sufficient for inbound internet access, forgetting that Azure VMs are protected by a default-deny NSG that must explicitly allow inbound traffic like RDP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An NSG rule allowing inbound TCP 3389
An NSG (Network Security Group) rule allowing inbound TCP port 3389 is required to permit Remote Desktop Protocol (RDP) traffic from the internet to reach the Windows VM. Even though the VM has a public IP address, Azure NSGs act as a stateful firewall at the subnet or NIC level, and by default all inbound traffic is denied unless explicitly allowed. Without this rule, RDP connection attempts will be blocked.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A private DNS zone
Why it's wrong here
A private DNS zone is used to resolve custom domain names within a virtual network, not to control network traffic. It maps hostnames to IP addresses privately, but has no effect on inbound connectivity from the internet. RDP access is governed by network security rules and the VM's public IP, not by name resolution, so configuring a private DNS zone cannot enable RDP from the internet.
When this WOULD be correct
You need to enable custom domain name resolution for VMs in a virtual network, such as resolving 'vm-admin01.contoso.com' to a private IP within Azure.
- ✓
An NSG rule allowing inbound TCP 3389
Why this is correct
An NSG rule allowing inbound TCP 3389 is the correct solution because RDP uses port 3389, and Azure Network Security Groups filter traffic at the subnet or NIC level. Without an explicit inbound allow rule for TCP 3389, the default NSG rules deny all inbound internet traffic, so the VM remains unreachable. Associating the NSG with the VM's subnet or NIC and specifying source as 'Internet' and destination port 3389 as 'Allow' grants the required RDP access.
- ✗
A user-defined route to Azure Monitor
Why it's wrong here
A user-defined route (UDR) directs network traffic to a specific virtual appliance or Azure service, but routing to Azure Monitor would only affect outbound monitoring data flow, not inbound RDP connections. Additionally, Azure Monitor is a management service, not a destination for RDP sessions, and such a route would neither translate nor forward port 3389 traffic. Inbound internet traffic destined to the VM's public IP is controlled by NSG rules and the platform's load balancer routing, making this UDR ineffective for RDP access.
When this WOULD be correct
A question where you need to ensure that network traffic from a VM to Azure Monitor (e.g., for Log Analytics or diagnostics) goes through a specific network virtual appliance (NVA) or firewall, rather than the default internet route. For example: 'You need to route all traffic from a VM to Azure Monitor through a firewall for inspection.'
- ✗
A blob lifecycle management rule
Why it's wrong here
Blob lifecycle management automates the transition or deletion of blob data based on age or tiering conditions, such as moving blobs to cool or archive storage. It operates solely within Azure Storage accounts and has zero interaction with virtual machine networking or OS-level ports. Because RDP access depends on network pathing and firewall rules, a lifecycle management rule is completely unrelated and cannot be used to enable remote desktop connectivity.
When this WOULD be correct
You need to automatically move blobs in a storage account to cool or archive tier after a certain number of days to optimize costs. A lifecycle management rule would be the correct solution.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓An NSG rule allowing inbound TCP 3389Correct answer▾
Why this is correct
An NSG rule allowing inbound TCP 3389 is the correct solution because RDP uses port 3389, and Azure Network Security Groups filter traffic at the subnet or NIC level. Without an explicit inbound allow rule for TCP 3389, the default NSG rules deny all inbound internet traffic, so the VM remains unreachable. Associating the NSG with the VM's subnet or NIC and specifying source as 'Internet' and destination port 3389 as 'Allow' grants the required RDP access.
✗A private DNS zoneWrong answer — click to see why▾
Why this is wrong here
A private DNS zone resolves names within a virtual network, not for internet RDP access. RDP requires an NSG rule allowing inbound TCP 3389.
★ When this WOULD be the correct answer
You need to enable custom domain name resolution for VMs in a virtual network, such as resolving 'vm-admin01.contoso.com' to a private IP within Azure.
Why candidates choose this
Candidates may confuse DNS configuration with network security, thinking DNS is needed for name resolution to connect via RDP.
✗A user-defined route to Azure MonitorWrong answer — click to see why▾
Why this is wrong here
A user-defined route (UDR) to Azure Monitor is used to direct network traffic to Azure Monitor for diagnostics or monitoring, not to enable RDP access. RDP access requires an NSG rule allowing inbound TCP 3389, not a custom route.
★ When this WOULD be the correct answer
A question where you need to ensure that network traffic from a VM to Azure Monitor (e.g., for Log Analytics or diagnostics) goes through a specific network virtual appliance (NVA) or firewall, rather than the default internet route. For example: 'You need to route all traffic from a VM to Azure Monitor through a firewall for inspection.'
Why candidates choose this
Candidates may confuse routing (UDR) with security (NSG) or think that Azure Monitor is involved in managing network access, leading them to select a route-based solution for a connectivity problem.
✗A blob lifecycle management ruleWrong answer — click to see why▾
Why this is wrong here
A blob lifecycle management rule manages tiering or deletion of blob storage data, not network access to a VM. It has no relevance to enabling RDP connectivity.
★ When this WOULD be the correct answer
You need to automatically move blobs in a storage account to cool or archive tier after a certain number of days to optimize costs. A lifecycle management rule would be the correct solution.
Why candidates choose this
Candidates may confuse lifecycle management with other management tasks, or mistakenly think it applies to VM access policies due to the word 'management'.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.