An application subnet has a network security group with these inbound rules: Allow-Web-From-Internet at priority 200, Allow-App-From-Web at priority 300, and Deny-All-Inbound at priority 250. The web tier must reach the app tier on TCP 8080, but traffic is being denied. The administrator confirms the source and destination IPs are correct. What is the best fix?

Delete the Deny-All-Inbound rule because default NSG rules will allow the traffic.

Default rules are not meant to replace a required deny rule, and deleting the custom deny rule is not necessary if priority is corrected.

Add a route table entry for TCP 8080 traffic to bypass the NSG.

Route tables determine next hop, not firewall decisions. NSGs still evaluate the traffic even when routing is correct.

Move the Allow-Web-From-Internet rule to priority 400.

This would make the web inbound allow rule evaluated later, which does not help app-tier traffic and could make other traffic more restrictive.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Change the Allow-App-From-Web rule to a lower priority number than 250. — The deny rule is taking precedence because it has a lower priority number than the allow rule. NSGs evaluate rules from the lowest priority number to the highest, and the first match is applied. To permit the web tier to reach the app tier, the allow rule must be moved to a priority lower than 250 so it is evaluated before Deny-All-Inbound. This is the cleanest fix. Why others are wrong: A removes a protection control rather than solving the ordering problem, and the default rules would not necessarily permit the desired app-to-app path. C confuses routing with security filtering; a route cannot override an NSG deny. D changes an unrelated rule and would not alter the order between the deny rule and the application allow rule.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.