AZ-104 Implement and Manage Virtual Networking Practice Question
A VM has an NSG with these inbound rules: Deny-RDP at priority 100 for TCP 3389 from Any, and Allow-RDP-Admins at priority 200 for TCP 3389 from 10.8.1.0/24. Admins from 10.8.1.0/24 still cannot connect by RDP. What change fixes access while keeping all other sources blocked?
⚠ Common exam trap
Many exam-takers think changing the protocol or adding a route or ASG can override the priority-based evaluation order, but the core issue is simply that the deny rule has a lower priority number and is evaluated first.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Move the allow rule to a lower priority number than 100.
C is correct because NSG rules are evaluated in priority order, with lower numbers evaluated first. The Deny-RDP rule at priority 100 is evaluated before the Allow-RDP-Admins rule at priority 200, so traffic from 10.8.1.0/24 is denied before the allow rule is reached. Moving the allow rule to a priority lower than 100 (e.g., 90) ensures it is evaluated first, allowing the admin traffic while the deny rule still blocks all other sources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the deny rule to protocol Any so the allow rule will be evaluated first.
Why it's wrong here
Setting the deny rule to protocol 'Any' does not change its priority or its position in the evaluation sequence; it only broadens the deny to cover all protocols, including TCP. Since NSG rules are processed in ascending priority order, the deny rule at priority 100 will still match the RDP traffic before the allow rule at priority 200 is ever examined. This change actually makes the deny rule more aggressive and ensures that no TCP-based allow rule could be evaluated. To fix the problem, you must move the allow rule to a lower priority number, not alter the protocol field.
When this WOULD be correct
This would be correct if the question stated that the deny rule was blocking traffic due to a protocol mismatch (e.g., the allow rule used TCP but the deny rule blocked UDP), and the goal was to ensure the allow rule applies to the correct protocol.
- ✗
Add a UDR that sends TCP 3389 traffic to the VM subnet.
Why it's wrong here
A user-defined route (UDR) controls the next hop for traffic traversing a subnet, but it does not influence how an NSG evaluates inbound packets. When a TCP 3389 packet arrives from the internet, the NSG on the VM subnet is evaluated first, and the priority-100 deny rule matches before any routing consideration. Even if the UDR redirects the packet to an appliance or back to the subnet, the NSG filter still blocks the connection because NSG rules are independent of the effective route table. Thus, changing routing via UDR cannot bypass an NSG deny rule.
When this WOULD be correct
If the VM were in a different subnet or virtual network and RDP traffic was not reaching it due to missing or incorrect routes (e.g., forced tunneling or a network virtual appliance), adding a UDR to direct TCP 3389 traffic to the VM subnet would be correct.
- ✓
Move the allow rule to a lower priority number than 100.
Why this is correct
NSG rules are evaluated in priority order, where the lowest number wins. Because the deny rule at priority 100 is matched before the allow rule at 200, the connection is blocked even for the admin subnet. Moving the allow rule to a priority such as 90 makes it the first matching rule, while the deny rule still blocks all other sources afterward.
- ✗
Associate an application security group with the VM and keep the existing priorities.
Why it's wrong here
An application security group (ASG) is a logical grouping of VMs that you can reference as a source or destination in an NSG rule, but it does not change the priority-based evaluation engine. Associating the VM with an ASG does not move the allow rule earlier or invalidate the existing deny rule, so the deny rule at priority 100 still wins. You could use an ASG to simplify a new rule, but you would still need to place that rule at a priority lower than 100 (e.g., 90) to have it evaluated before the deny. Simply associating an ASG while keeping priorities unchanged leaves the traffic blocked.
When this WOULD be correct
This option would be correct in a scenario where the NSG rules reference ASGs as source or destination, and the VM needs to be added to an ASG to be included in an allow rule. For example, if the allow rule specifies an ASG as source, associating the VM with that ASG would permit traffic.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Move the allow rule to a lower priority number than 100.Correct answer▾
Why this is correct
NSG rules are evaluated in priority order, where the lowest number wins. Because the deny rule at priority 100 is matched before the allow rule at 200, the connection is blocked even for the admin subnet. Moving the allow rule to a priority such as 90 makes it the first matching rule, while the deny rule still blocks all other sources afterward.
✗Change the deny rule to protocol Any so the allow rule will be evaluated first.Wrong answer — click to see why▾
Why this is wrong here
Changing the deny rule to protocol Any does not affect rule evaluation order; NSG rules are evaluated by priority number, not protocol. The deny rule at priority 100 will still block all RDP traffic before the allow rule at priority 200 is evaluated.
★ When this WOULD be the correct answer
This would be correct if the question stated that the deny rule was blocking traffic due to a protocol mismatch (e.g., the allow rule used TCP but the deny rule blocked UDP), and the goal was to ensure the allow rule applies to the correct protocol.
Why candidates choose this
Candidates may think that changing the protocol to Any makes the rule more general, but they misunderstand that NSG evaluation is based on priority, not rule specificity.
✗Add a UDR that sends TCP 3389 traffic to the VM subnet.Wrong answer — click to see why▾
Why this is wrong here
A User Defined Route (UDR) controls traffic routing between subnets or to on-premises, not NSG rule evaluation. Since the VM is in the same subnet, RDP traffic already reaches the VM; the issue is the NSG deny rule blocking it, not routing.
★ When this WOULD be the correct answer
If the VM were in a different subnet or virtual network and RDP traffic was not reaching it due to missing or incorrect routes (e.g., forced tunneling or a network virtual appliance), adding a UDR to direct TCP 3389 traffic to the VM subnet would be correct.
Why candidates choose this
Candidates may confuse NSG rule processing with network routing, thinking that a UDR can override NSG rules or that traffic is not reaching the VM due to routing issues rather than explicit deny rules.
✗Associate an application security group with the VM and keep the existing priorities.Wrong answer — click to see why▾
Why this is wrong here
Associating an application security group (ASG) with the VM does not change the priority of existing NSG rules. The deny rule at priority 100 still blocks all RDP traffic, including from the admin subnet, regardless of ASG membership.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the NSG rules reference ASGs as source or destination, and the VM needs to be added to an ASG to be included in an allow rule. For example, if the allow rule specifies an ASG as source, associating the VM with that ASG would permit traffic.
Why candidates choose this
Candidates may think that ASGs provide a way to bypass or override existing NSG rules, or that associating an ASG automatically adjusts rule priorities, when in fact ASGs are just logical groupings used in rule definitions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.