You need to allow SSH access to only one Linux VM in a subnet that contains several application servers. The other VMs in the subnet must remain inaccessible from the internet. What is the best configuration?

Add an inbound allow rule on the subnet NSG for TCP 22 from your admin IP address.

This would allow SSH to every NIC in the subnet, not only the target VM.

Create a public load balancer in front of the subnet and forward port 22 to the VM.

A load balancer is not the best least-privilege control for one administrative SSH target.

Enable a service endpoint on the subnet so SSH traffic is limited to that VM.

Service endpoints apply to supported PaaS services, not to SSH access to a virtual machine.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Associate an NSG with the target VM's NIC and add an inbound allow rule for TCP 22 from your admin IP. — To limit SSH to one VM, a NIC-level NSG is the most precise option. A subnet NSG would apply to every VM in that subnet, which would unnecessarily expose all of them to the same rule. By associating an NSG with only the target VM's NIC, you can permit TCP 22 from your admin IP while keeping the other machines protected. Why others are wrong: A subnet-level allow rule is too broad because it applies to all resources in the subnet. A public load balancer is not a good administrative access pattern for a single VM and adds unnecessary exposure. Service endpoints do not control SSH to VMs; they are for secure access to certain Azure platform services.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.