An application subnet has an NSG outbound rule Deny-HTTPS at priority 200 for TCP 443 to Any. A second outbound rule Allow-HTTPS-API at priority 300 permits TCP 443 from ASG-Web to ASG-Api. Web servers can reach other ports but not the API. What change should the administrator make?

Delete the deny rule so the allow rule can be evaluated.

Removing the deny rule is unnecessary if the allow rule is given a higher priority.

Change the destination from ASG-Api to the entire subnet address range.

The destination address form is not the issue; the deny rule still wins because of priority.

Change the protocol from TCP to Any so the rule matches more traffic.

The rule already matches TCP 443 traffic; protocol widening does not resolve a higher-priority deny.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Change the allow rule to a higher priority than 200, such as 100. — Network security groups evaluate rules in priority order, where the lowest number is processed first. The deny rule at priority 200 is matched before the allow rule at 300, so TCP 443 traffic is blocked. To permit the API traffic, the allow rule must have a higher priority, such as 100, so it is evaluated before the deny rule and can take effect. Why others are wrong: Deleting the deny rule is not required if a more specific allow rule is placed first. Changing the destination range or protocol does not help when the deny rule still matches the same traffic earlier. The core issue is rule order, not the rule scope or protocol width.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.