An NSG on a subnet has these inbound rules: Deny-All-Inbound at priority 100 and Allow-RDP-from-AdminSubnet at priority 200. Administrators on AdminSubnet still cannot RDP to a VM in the subnet. What should the network administrator change?

Delete the deny rule so only the allow rule remains.

Removing the deny rule is unnecessary if a higher-priority allow rule can be placed ahead of it.

Change the VM to a different availability zone.

Availability zones do not affect NSG rule evaluation or inbound port access.

Create a private endpoint for the VM.

Private endpoints are for supported PaaS services, not for opening RDP to a virtual machine.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Move the allow rule to a lower priority number than 100. — Azure Network Security Groups process rules from lowest priority number to highest. Because Deny-All-Inbound is priority 100, it is matched before the allow rule at 200 and blocks the connection. The correct fix is to place the allow rule at a higher priority, such as 90 or 50, so it is evaluated first for traffic from AdminSubnet on the RDP port. Why others are wrong: Deleting the deny rule is not the best design if a targeted allow rule can be ordered correctly. Availability zones are unrelated to inbound filtering. Private endpoints do not provide administrative RDP access to VMs and are intended for private service access instead.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.