AZ-104 Implement and Manage Virtual Networking Practice Question
You need to allow SSH access to only one Linux VM in a subnet that contains several application servers. The other VMs in the subnet must remain inaccessible from the internet. What is the best configuration?
⚠ Common exam trap
Test-takers frequently assume subnet-level NSG rules are sufficient for granular control, but they fail to recognize that a subnet NSG applies to all VMs in that subnet, whereas a NIC-level NSG provides per-VM isolation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Associate an NSG with the target VM's NIC and add an inbound allow rule for TCP 22 from your admin IP.
Network Security Groups (NSGs) can be associated at the subnet or NIC level. By associating an NSG directly with the target VM's NIC and adding an inbound allow rule for TCP port 22 from your admin IP address, you restrict SSH access exclusively to that VM while leaving the other VMs in the subnet unaffected by the rule. This provides granular, host-level security without impacting the broader subnet traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add an inbound allow rule on the subnet NSG for TCP 22 from your admin IP address.
Why it's wrong here
If you add an inbound allow rule for TCP 22 to the subnet's NSG, that rule is automatically applied to all network interfaces attached to that subnet, including every VM and any other resource behind it. Even though the rule restricts the source IP to your admin address, it still opens SSH to every NIC in the subnet, not just the desired target VM. To limit SSH to one VM, you would need to pair this subnet rule with a blocking NSG on the other NICs, which is more complex and broader than simply attaching a rule to the target NIC.
When this WOULD be correct
If the requirement were to allow SSH access to all VMs in the subnet from your admin IP, then adding an inbound allow rule on the subnet NSG for TCP 22 would be correct.
- ✓
Associate an NSG with the target VM's NIC and add an inbound allow rule for TCP 22 from your admin IP.
Why this is correct
An NSG associated directly with the target VM's network interface (NIC) applies its rules only to that NIC, so adding an inbound allow rule for TCP 22 from your admin IP explicitly permits SSH for that single VM while leaving every other NIC in the subnet unaffected. Because Azure's default rules deny all other inbound internet traffic, this NIC-level NSG creates the narrowest possible exposure: only the specified source IP can reach only the specified port on only the target VM. This is the proper least-privilege approach when you need to administer one specific Linux VM within a shared subnet.
- ✗
Create a public load balancer in front of the subnet and forward port 22 to the VM.
Why it's wrong here
Placing a public load balancer in front of the subnet and forwarding port 22 to the VM would rely on the load balancer's inbound NAT rule to reach the target VM, but this introduces an unnecessary public-facing component and does not by itself restrict additional access paths to the VM's NIC. The load balancer is designed for distributing traffic across multiple backend resources, not for enforcing administrative access control; you would still need an NSG to filter the traffic to the VM, and the load balancer's public IP could become an additional attack surface. For a single administrative SSH target, this is over-engineered and violates least-privilege principles compared to a direct NIC-level NSG rule.
When this WOULD be correct
When you need to distribute SSH traffic across multiple VMs for load balancing or high availability, and you want to hide the VMs' public IPs behind a single endpoint. For example, managing a fleet of jump servers where any available server can handle the connection.
- ✗
Enable a service endpoint on the subnet so SSH traffic is limited to that VM.
Why it's wrong here
A service endpoint on a subnet extends the subnet's identity and routes traffic to an Azure PaaS service (such as Azure Storage or SQL Database) over the Azure backbone; it does not filter inbound TCP 22 to a VM. SSH to a Linux VM is host-to-host IP traffic, and service endpoints do not contain any access-list logic to permit or deny individual destination IPs or ports. Consequently, enabling a service endpoint would not prevent other VMs in the subnet from accepting SSH, nor would it create any rule specific to the target VM.
When this WOULD be correct
If the question required restricting access from a specific Azure service (e.g., Azure Storage) to only a particular subnet or VM, enabling a service endpoint on the subnet would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Associate an NSG with the target VM's NIC and add an inbound allow rule for TCP 22 from your admin IP.Correct answer▾
Why this is correct
An NSG associated directly with the target VM's network interface (NIC) applies its rules only to that NIC, so adding an inbound allow rule for TCP 22 from your admin IP explicitly permits SSH for that single VM while leaving every other NIC in the subnet unaffected. Because Azure's default rules deny all other inbound internet traffic, this NIC-level NSG creates the narrowest possible exposure: only the specified source IP can reach only the specified port on only the target VM. This is the proper least-privilege approach when you need to administer one specific Linux VM within a shared subnet.
✗Add an inbound allow rule on the subnet NSG for TCP 22 from your admin IP address.Wrong answer — click to see why▾
Why this is wrong here
Applying the rule at the subnet NSG level would allow SSH access to all VMs in the subnet, not just the target VM, violating the requirement that other VMs remain inaccessible from the internet.
★ When this WOULD be the correct answer
If the requirement were to allow SSH access to all VMs in the subnet from your admin IP, then adding an inbound allow rule on the subnet NSG for TCP 22 would be correct.
Why candidates choose this
Candidates may think that subnet-level NSG rules are sufficient and simpler, overlooking the need to restrict access to a single VM when others must remain inaccessible.
✗Create a public load balancer in front of the subnet and forward port 22 to the VM.Wrong answer — click to see why▾
Why this is wrong here
A public load balancer distributes traffic across multiple VMs, not restrict access to a single VM. It would expose all VMs behind it to SSH traffic if configured, and it adds unnecessary complexity and cost for a simple access control requirement.
★ When this WOULD be the correct answer
When you need to distribute SSH traffic across multiple VMs for load balancing or high availability, and you want to hide the VMs' public IPs behind a single endpoint. For example, managing a fleet of jump servers where any available server can handle the connection.
Why candidates choose this
Candidates may think a load balancer provides granular access control or security, but its primary purpose is distribution and availability, not fine-grained per-VM access restriction.
✗Enable a service endpoint on the subnet so SSH traffic is limited to that VM.Wrong answer — click to see why▾
Why this is wrong here
Service endpoints secure Azure service traffic (e.g., to Storage or SQL) to a virtual network, not SSH access to a specific VM. They do not filter inbound internet traffic to VMs.
★ When this WOULD be the correct answer
If the question required restricting access from a specific Azure service (e.g., Azure Storage) to only a particular subnet or VM, enabling a service endpoint on the subnet would be correct.
Why candidates choose this
Candidates may confuse 'service endpoint' with 'network security group' or think it can limit traffic to a specific VM, misunderstanding its purpose of securing Azure service traffic.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
TCP
TCP (Transmission Control Protocol) is a core internet protocol that ensures data is sent reliably and in order between devices over a network.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to allow RDP access from the internet to a Windows VM named VM-Admin01 in Azure. The VM already has a public IP address. Which additional configuration is required?
medium- A.A private DNS zone
- ✓ B.An NSG rule allowing inbound TCP 3389
- C.A user-defined route to Azure Monitor
- D.A blob lifecycle management rule
Why B: An NSG (Network Security Group) rule allowing inbound TCP port 3389 is required to permit Remote Desktop Protocol (RDP) traffic from the internet to reach the Windows VM. Even though the VM has a public IP address, Azure NSGs act as a stateful firewall at the subnet or NIC level, and by default all inbound traffic is denied unless explicitly allowed. Without this rule, RDP connection attempts will be blocked.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.