AZ-104 Implement and Manage Virtual Networking Practice Question
An NSG on a subnet has these inbound rules: Deny-All-Inbound at priority 100 and Allow-RDP-from-AdminSubnet at priority 200. Administrators on AdminSubnet still cannot RDP to a VM in the subnet. What should the network administrator change?
⚠ Common exam trap
A common mix-up: candidates assume allow rules override deny rules regardless of priority, but Azure NSGs use priority-based evaluation where the first matching rule (lowest priority number) wins, so a higher-priority deny rule will block traffic even if a lower-priority allow rule exists.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Move the allow rule to a lower priority number than 100.
The NSG rules are evaluated in priority order, with lower numbers having higher precedence. The Deny-All-Inbound rule at priority 100 blocks all traffic, including RDP from AdminSubnet, before the Allow-RDP-from-AdminSubnet rule at priority 200 is evaluated. To allow RDP traffic, the allow rule must have a lower priority number (e.g., 90) than the deny rule (100), ensuring it is evaluated first and permits the traffic before the deny rule blocks it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the deny rule so only the allow rule remains.
Why it's wrong here
Deleting the deny-all rule would indeed allow the RDP allow rule to take effect, but it also removes all blocking of other unsolicited inbound traffic to the subnet, which is a significant security risk. A more targeted resolution is to reorder the rules so the allow rule has a lower priority number than the deny rule; this preserves the deny-all protection for all other ports while enabling RDP. Removing the deny rule broadens the attack surface unnecessarily and is not the minimal, best-practice fix.
When this WOULD be correct
In a scenario where an NSG has a low-priority deny rule that is too restrictive and the intent is to allow all traffic except specific threats, deleting the deny rule and relying on default allow rules or a more permissive rule set could be correct. For example, if the requirement is to allow all inbound traffic and only block known malicious IPs via a higher-priority deny rule.
- ✓
Move the allow rule to a lower priority number than 100.
Why this is correct
NSG rules are evaluated in ascending priority order, where the lowest numeric value is processed first and the first matching rule determines the outcome. The current deny-all rule at priority 100 will match any inbound traffic, so a lower-priority allow rule (with a higher number, e.g., 200) is never reached. By moving the RDP allow rule to a priority number below 100, it is evaluated before the deny rule and permits the connection, while the deny rule still blocks all other unsolicited inbound traffic.
- ✗
Change the VM to a different availability zone.
Why it's wrong here
Availability zones are physical fault domains within an Azure region used to protect against datacenter-level outages; they have no relationship to network traffic filtering. The subnet's NSG is applied at the network layer regardless of which zone the VM resides in, and the deny-all rule will still be evaluated in the same priority order. Moving the VM to another zone does not change NSG rule processing, so inbound RDP remains blocked.
When this WOULD be correct
In a scenario where a VM in a specific availability zone is experiencing network connectivity issues due to a zonal outage or a zone-specific network virtual appliance failure, moving the VM to a different zone could restore connectivity.
- ✗
Create a private endpoint for the VM.
Why it's wrong here
Private endpoints are a networking feature for Azure PaaS services (such as Storage, SQL Database, or Key Vault) that inject a private IP address into your virtual network; they are not used for virtual machines. A private endpoint cannot be created for a VM, and it would not alter the NSG inbound rules that govern the VM's RDP port. Thus, this action has no effect on the existing deny-all rule or the ability to connect via RDP.
When this WOULD be correct
In a scenario where a VM needs to be accessed securely from on-premises without exposing it to the internet, creating a private endpoint for the VM (via Private Link) would be the correct solution.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Move the allow rule to a lower priority number than 100.Correct answer▾
Why this is correct
NSG rules are evaluated in ascending priority order, where the lowest numeric value is processed first and the first matching rule determines the outcome. The current deny-all rule at priority 100 will match any inbound traffic, so a lower-priority allow rule (with a higher number, e.g., 200) is never reached. By moving the RDP allow rule to a priority number below 100, it is evaluated before the deny rule and permits the connection, while the deny rule still blocks all other unsolicited inbound traffic.
✗Delete the deny rule so only the allow rule remains.Wrong answer — click to see why▾
Why this is wrong here
Deleting the deny rule would remove all inbound traffic restrictions, allowing any source to reach the subnet, which is overly permissive and violates security best practices. The issue is that the allow rule at priority 200 is never evaluated because the deny rule at priority 100 is processed first.
★ When this WOULD be the correct answer
In a scenario where an NSG has a low-priority deny rule that is too restrictive and the intent is to allow all traffic except specific threats, deleting the deny rule and relying on default allow rules or a more permissive rule set could be correct. For example, if the requirement is to allow all inbound traffic and only block known malicious IPs via a higher-priority deny rule.
Why candidates choose this
Candidates may think that removing the conflicting deny rule will directly solve the connectivity issue without understanding NSG rule priority evaluation order, assuming that allow rules can override deny rules regardless of priority.
✗Change the VM to a different availability zone.Wrong answer — click to see why▾
Why this is wrong here
Changing the VM to a different availability zone does not affect NSG rule evaluation; NSG rules are applied at the subnet or NIC level regardless of zone.
★ When this WOULD be the correct answer
In a scenario where a VM in a specific availability zone is experiencing network connectivity issues due to a zonal outage or a zone-specific network virtual appliance failure, moving the VM to a different zone could restore connectivity.
Why candidates choose this
Candidates may mistakenly think that availability zones affect network security or that moving a VM to a different zone could bypass NSG rules.
✗Create a private endpoint for the VM.Wrong answer — click to see why▾
Why this is wrong here
Creating a private endpoint for the VM does not affect NSG rules; private endpoints are used for secure access to Azure PaaS services, not for RDP connectivity to VMs.
★ When this WOULD be the correct answer
In a scenario where a VM needs to be accessed securely from on-premises without exposing it to the internet, creating a private endpoint for the VM (via Private Link) would be the correct solution.
Why candidates choose this
Candidates may confuse private endpoints with a general networking solution for connectivity issues, not realizing they are specific to PaaS services and do not override NSG rules for IaaS VMs.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.