AZ-104 Implement and Manage Virtual Networking Practice Question
An NSG attached to a subnet contains these inbound rules: Deny-All-Inbound at priority 200, Allow-HTTPS-Admin at priority 250 from 203.0.113.20/32, and Allow-HTTPS-Internet at priority 300. A VM in the subnet cannot receive HTTPS from the admin workstation even though the source IP is correct. What should the administrator change?
⚠ Common exam trap
A common mix-up: candidates assume a higher priority number means higher precedence, but in Azure NSGs, a lower numeric priority value (e.g., 200) is evaluated before a higher one (e.g., 250), so the deny rule blocks the traffic before the allow rule is checked.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Move the Allow-HTTPS-Admin rule to a priority number lower than 200.
The Deny-All-Inbound rule at priority 200 blocks all traffic, including HTTPS from the admin workstation, because NSG rules are evaluated in priority order (lowest number first). The Allow-HTTPS-Admin rule at priority 250 is never reached since the deny rule with a higher priority (lower number) matches first. To allow the admin traffic, the allow rule must have a priority lower than 200 (e.g., 150) so it is evaluated before the deny rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the protocol from TCP to Any on the allow rule.
Why it's wrong here
Changing the protocol from TCP to Any on the Allow-HTTPS-Admin rule does not resolve the rule precedence issue because the Deny-All-Inbound rule at priority 200 also applies to Any protocol and is evaluated first. NSG rules are matched in ascending priority order, so the lower-numbered deny rule catches all traffic regardless of protocol, making the allow rule at 250 effectively unreachable. Protocol changes only affect matching criteria for a specific rule; they do not reorder or bypass higher-priority deny rules.
When this WOULD be correct
In a scenario where the allow rule is correctly prioritized but the protocol is set to TCP and the traffic uses a different protocol (e.g., UDP), changing the protocol to Any would ensure the rule matches all protocols.
- ✓
Move the Allow-HTTPS-Admin rule to a priority number lower than 200.
Why this is correct
NSG rules are processed in priority order, and the lowest number wins. Because Deny-All-Inbound is at priority 200, it is evaluated before the allow rule at 250 and blocks the traffic. Moving the allow rule to a smaller number than 200 lets the admin workstation's HTTPS traffic match the allow rule first.
- ✗
Associate a NAT gateway with the subnet.
Why it's wrong here
A NAT gateway performs outbound source network address translation, primarily enabling instances in a subnet to initiate outbound connections and receive responses to those flows. It has no role in filtering or authorizing inbound traffic destined to a VM; inbound packets still traverse the subnet NSG and are evaluated against its rules. Since the problem is the Deny-All-Inbound rule at priority 200 being processed before the permissive rule, NAT does not alter the priority order or unblock HTTPS management traffic.
When this WOULD be correct
In a scenario where a VM in a private subnet needs to initiate outbound HTTPS connections to the internet and the subnet has no other outbound connectivity, associating a NAT gateway would be correct to enable outbound traffic.
- ✗
Enable service endpoint policies on the subnet.
Why it's wrong here
Service endpoint policies are used to filter egress traffic from a subnet to specific Azure PaaS resources over service endpoints, such as restricting which Storage or SQL accounts can be accessed. They do not inspect or control inbound management traffic like HTTPS RDP or administration consoles arriving from the internet. Since the allow rule is being blocked by a lower-numbered deny rule, enabling service endpoint policies does not influence the NSG priority evaluation or permit the desired inbound connection.
When this WOULD be correct
A question where a VM in a subnet cannot access an Azure Storage account, and the subnet has a service endpoint enabled for Microsoft.Storage. The correct answer would be to configure a service endpoint policy on the subnet to allow only specific storage accounts, restricting access to others.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Move the Allow-HTTPS-Admin rule to a priority number lower than 200.Correct answer▾
Why this is correct
NSG rules are processed in priority order, and the lowest number wins. Because Deny-All-Inbound is at priority 200, it is evaluated before the allow rule at 250 and blocks the traffic. Moving the allow rule to a smaller number than 200 lets the admin workstation's HTTPS traffic match the allow rule first.
✗Change the protocol from TCP to Any on the allow rule.Wrong answer — click to see why▾
Why this is wrong here
The issue is that the Deny-All-Inbound rule at priority 200 blocks HTTPS traffic before the Allow-HTTPS-Admin rule at priority 250 is evaluated. Changing the protocol to Any does not affect the priority order; the deny rule still takes precedence.
★ When this WOULD be the correct answer
In a scenario where the allow rule is correctly prioritized but the protocol is set to TCP and the traffic uses a different protocol (e.g., UDP), changing the protocol to Any would ensure the rule matches all protocols.
Why candidates choose this
Candidates may think that the protocol mismatch is the issue, overlooking that NSG rules are evaluated in priority order and a higher priority deny rule will block traffic regardless of protocol.
✗Associate a NAT gateway with the subnet.Wrong answer — click to see why▾
Why this is wrong here
A NAT gateway provides outbound internet connectivity for private subnets, but does not affect inbound traffic filtering by NSG rules. The issue is that the Deny-All-Inbound rule at priority 200 blocks HTTPS before the Allow-HTTPS-Admin rule at priority 250 is evaluated.
★ When this WOULD be the correct answer
In a scenario where a VM in a private subnet needs to initiate outbound HTTPS connections to the internet and the subnet has no other outbound connectivity, associating a NAT gateway would be correct to enable outbound traffic.
Why candidates choose this
Candidates may confuse inbound connectivity issues with outbound connectivity solutions, or think that a NAT gateway can bypass NSG rules for inbound traffic.
✗Enable service endpoint policies on the subnet.Wrong answer — click to see why▾
Why this is wrong here
Service endpoint policies control access to Azure services (like Storage or SQL) from a subnet, not inbound HTTPS traffic to a VM. They do not affect NSG rule processing or priority, so they cannot resolve the issue where a higher-priority Deny-All rule blocks the admin's HTTPS.
★ When this WOULD be the correct answer
A question where a VM in a subnet cannot access an Azure Storage account, and the subnet has a service endpoint enabled for Microsoft.Storage. The correct answer would be to configure a service endpoint policy on the subnet to allow only specific storage accounts, restricting access to others.
Why candidates choose this
Candidates may confuse service endpoint policies with general network security controls, thinking they can override NSG rules or manage traffic filtering for all protocols, including HTTPS to a VM.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.