AZ-104 Implement and Manage Virtual Networking Practice Question
An application subnet has a network security group with these inbound rules: Allow-Web-From-Internet at priority 200, Allow-App-From-Web at priority 300, and Deny-All-Inbound at priority 250. The web tier must reach the app tier on TCP 8080, but traffic is being denied. The administrator confirms the source and destination IPs are correct. What is the best fix?
⚠ Common exam trap
A common mix-up: candidates assume all rules are evaluated and the most specific rule wins, but in Azure NSGs, priority order (numerical value) strictly determines evaluation sequence, not specificity or rule type.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change the Allow-App-From-Web rule to a lower priority number than 250.
The Deny-All-Inbound rule at priority 250 is evaluated before the Allow-App-From-Web rule at priority 300 because lower priority numbers are processed first. To allow web-to-app traffic on TCP 8080, the Allow-App-From-Web rule must have a lower priority number (e.g., 240) than the Deny-All-Inbound rule so it is evaluated and applied first, permitting the traffic before the deny rule blocks it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the Deny-All-Inbound rule because default NSG rules will allow the traffic.
Why it's wrong here
Deleting the custom deny rule does not cause default rules to allow the inbound traffic; Azure's default inbound rules only permit virtual-network and Azure load-balancer traffic, followed by a default DenyAllInbound rule at priority 65000. Without the custom deny at 250, the existing Allow-App-From-Web rule at 300 would match before the default deny, but this also removes the blanket block, potentially exposing the subnet to other unwanted traffic. The correct fix is to lower the allow rule's priority below 250, not delete a deny rule that provides defense-in-depth.
When this WOULD be correct
This option would be correct if the question stated that the Deny-All-Inbound rule was blocking traffic that should be allowed by a default rule (e.g., traffic from another subnet in the same virtual network) and the default rule had a higher priority than the deny rule.
- ✓
Change the Allow-App-From-Web rule to a lower priority number than 250.
Why this is correct
NSG rules are processed in priority order, and the lowest number wins. Because Deny-All-Inbound at 250 is evaluated before the allow rule at 300, it blocks the traffic first. Moving the allow rule to a lower number than 250 lets the permitted web-to-app traffic match before the deny rule is applied.
- ✗
Add a route table entry for TCP 8080 traffic to bypass the NSG.
Why it's wrong here
A route table (user-defined route) controls the next hop for packets based on destination IP prefixes, not the security policies applied by an NSG. Even if a UDR sends TCP 8080 traffic to a virtual appliance or the internet, the NSG attached to the app subnet is still evaluated as a packet filter at the subnet/NIC boundary. Bypassing an NSG is not possible through routing; you would need to adjust the NSG rule priorities or add an explicit allow rule with a lower number than the deny rule.
When this WOULD be correct
In a scenario where traffic between subnets is failing due to missing or incorrect routes (e.g., a virtual appliance or forced tunneling), adding a route table entry with the correct next hop would fix connectivity.
- ✗
Move the Allow-Web-From-Internet rule to priority 400.
Why it's wrong here
Changing the Allow-Web-From-Internet rule to priority 400 assigns it a higher numeric value, meaning it is evaluated later than the Deny-All-Inbound rule at priority 250. Inbound web traffic would hit the deny rule first and be dropped, so this change could break the web tier. It also does not address the Allow-App-From-Web rule, which is the rule governing app-to-app connectivity; only renumbering that specific allow rule to a priority lower than 250 resolves the issue.
When this WOULD be correct
This option would be correct in a scenario where the Allow-Web-From-Internet rule is incorrectly blocking legitimate traffic from the internet to the web tier, and the Deny-All-Inbound rule is not present or is at a lower priority. Lowering its priority would allow other higher-priority rules to process first.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Change the Allow-App-From-Web rule to a lower priority number than 250.Correct answer▾
Why this is correct
NSG rules are processed in priority order, and the lowest number wins. Because Deny-All-Inbound at 250 is evaluated before the allow rule at 300, it blocks the traffic first. Moving the allow rule to a lower number than 250 lets the permitted web-to-app traffic match before the deny rule is applied.
✗Delete the Deny-All-Inbound rule because default NSG rules will allow the traffic.Wrong answer — click to see why▾
Why this is wrong here
Default NSG rules allow inbound traffic only within a virtual network and from Azure load balancers, not from the internet. Deleting the Deny-All-Inbound rule would expose the subnet to all inbound traffic, which is not the intended fix.
★ When this WOULD be the correct answer
This option would be correct if the question stated that the Deny-All-Inbound rule was blocking traffic that should be allowed by a default rule (e.g., traffic from another subnet in the same virtual network) and the default rule had a higher priority than the deny rule.
Why candidates choose this
Candidates may mistakenly believe that default NSG rules automatically allow all traffic, so removing the explicit deny would restore connectivity, overlooking that the default rules are restrictive.
✗Add a route table entry for TCP 8080 traffic to bypass the NSG.Wrong answer — click to see why▾
Why this is wrong here
Route tables control traffic routing between subnets, not NSG rule evaluation. NSGs filter traffic regardless of route table entries, so adding a route cannot bypass an explicit Deny rule.
★ When this WOULD be the correct answer
In a scenario where traffic between subnets is failing due to missing or incorrect routes (e.g., a virtual appliance or forced tunneling), adding a route table entry with the correct next hop would fix connectivity.
Why candidates choose this
Candidates may confuse NSG filtering with routing, thinking that a route can override an NSG deny rule, or they may assume that traffic must be explicitly routed to the destination subnet.
✗Move the Allow-Web-From-Internet rule to priority 400.Wrong answer — click to see why▾
Why this is wrong here
Moving Allow-Web-From-Internet to priority 400 would not fix the issue because the Deny-All-Inbound rule at priority 250 still blocks traffic from the web tier to the app tier on TCP 8080. The problem is that the Allow-App-From-Web rule (priority 300) is processed after the deny rule, so it never takes effect.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the Allow-Web-From-Internet rule is incorrectly blocking legitimate traffic from the internet to the web tier, and the Deny-All-Inbound rule is not present or is at a lower priority. Lowering its priority would allow other higher-priority rules to process first.
Why candidates choose this
Candidates may think that moving the allow rule to a lower priority will reduce conflicts, but they overlook that the deny rule at priority 250 is the actual blocker. They focus on the wrong rule due to misunderstanding of NSG priority evaluation order.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Network Security Groups (NSG)
Key term
TCP
TCP (Transmission Control Protocol) is a core internet protocol that ensures data is sent reliably and in order between devices over a network.
Key term
Network security
Network security is the practice of protecting a computer network from unauthorized access, misuse, malfunction, modification, destruction, or improper disclosure, ensuring the confidentiality, integrity, and availability of data and resources.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.