AZ-104 Implement and Manage Virtual Networking Practice Question
Exhibit
Subnet NSG inbound rules: Priority 100 Deny-RDP-All Source: Any Destination: Any Protocol: TCP Port: 3389 Priority 200 Allow-RDP-Admin Source: 192.168.10.0/24 Destination: Any Protocol: TCP Port: 3389 Priority 65000 AllowVNetInBound Source: VirtualNetwork Destination: VirtualNetwork Protocol: Any Port: * Client IP: 192.168.10.25 Symptom: RDP times out before the logon prompt appears.
Based on the exhibit, a help desk engineer cannot RDP from an approved admin subnet to a VM in Azure. What change should the administrator make so the connection is allowed?
⚠ Common exam trap
It's easy for candidates to assume allow rules always override deny rules, but in Azure NSGs, the rule with the lowest priority number (highest precedence) wins, regardless of whether it is an allow or deny rule.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Move Allow-RDP-Admin to a priority lower than 100.
The exhibit shows a deny rule with priority 100 that blocks all inbound traffic from the approved admin subnet, and an allow rule for RDP with a priority lower than 100 (e.g., 200). Since Azure Network Security Group (NSG) rules are evaluated in priority order (lowest number first), the deny rule at priority 100 is evaluated before the allow rule at a lower priority, thus blocking the RDP connection. To allow the RDP traffic, the administrator must move the Allow-RDP-Admin rule to a priority lower than 100 (e.g., 90) so it is evaluated before the deny rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the deny rule to use UDP instead of TCP.
Why it's wrong here
RDP uses TCP 3389 for the primary connection. Changing the deny rule protocol to UDP does not permit the required TCP traffic and would not solve the timeout.
When this WOULD be correct
If the question involved a protocol that uses UDP (e.g., DNS, DHCP) and a deny rule was blocking it, changing the rule to UDP would allow the traffic.
- ✓
Move Allow-RDP-Admin to a priority lower than 100.
Why this is correct
NSG rules are processed in priority order, and the lowest number wins. Because the deny rule at priority 100 matches first, the allow rule at 200 never takes effect. Moving the allow rule to a smaller number than 100 lets the approved subnet match the permit rule before the deny rule is evaluated.
- ✗
Add the VM NIC to an application security group and leave the rules unchanged.
Why it's wrong here
Application security groups help target rules, but they do not override an earlier deny rule. The priority conflict still blocks RDP even if the VM is in an ASG.
When this WOULD be correct
In a scenario where the VM NIC has no NSG assigned and the subnet NSG has an allow rule for an application security group, adding the NIC to that ASG would apply the allow rule and permit RDP.
- ✗
Delete the default AllowVNetInBound rule.
Why it's wrong here
The default allow rule is not the reason the approved subnet is blocked. Removing it would reduce connectivity further and would not fix the higher-priority deny rule.
When this WOULD be correct
In a scenario where the default AllowVNetInBound rule is explicitly blocking desired traffic (e.g., due to a misconfiguration or security requirement to isolate subnets), deleting it could be correct. For example, if the question states that VNet-internal traffic must be restricted for compliance, and the admin needs to remove the default rule to enforce custom rules.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Move Allow-RDP-Admin to a priority lower than 100.Correct answer▾
Why this is correct
NSG rules are processed in priority order, and the lowest number wins. Because the deny rule at priority 100 matches first, the allow rule at 200 never takes effect. Moving the allow rule to a smaller number than 100 lets the approved subnet match the permit rule before the deny rule is evaluated.
✗Change the deny rule to use UDP instead of TCP.Wrong answer — click to see why▾
Why this is wrong here
RDP uses TCP, not UDP. Changing the deny rule to UDP would not affect TCP-based RDP traffic, so the connection would still be blocked.
★ When this WOULD be the correct answer
If the question involved a protocol that uses UDP (e.g., DNS, DHCP) and a deny rule was blocking it, changing the rule to UDP would allow the traffic.
Why candidates choose this
Candidates may confuse RDP's transport protocol or think that changing protocol type in a rule can bypass the block, misunderstanding that RDP relies on TCP.
✗Add the VM NIC to an application security group and leave the rules unchanged.Wrong answer — click to see why▾
Why this is wrong here
Adding the VM NIC to an application security group does not change the existing NSG rules; the deny rule with priority 100 still blocks RDP traffic from the admin subnet, so the connection remains denied.
★ When this WOULD be the correct answer
In a scenario where the VM NIC has no NSG assigned and the subnet NSG has an allow rule for an application security group, adding the NIC to that ASG would apply the allow rule and permit RDP.
Why candidates choose this
Candidates may think application security groups simplify rule management and automatically override deny rules, not realizing that explicit deny rules with higher priority still take effect.
✗Delete the default AllowVNetInBound rule.Wrong answer — click to see why▾
Why this is wrong here
Deleting the default AllowVNetInBound rule would block all intra-VNet traffic, which is not required to allow RDP from the admin subnet. The issue is that the high-priority deny rule (priority 100) is blocking RDP before the Allow-RDP-Admin rule (priority 200) is evaluated.
★ When this WOULD be the correct answer
In a scenario where the default AllowVNetInBound rule is explicitly blocking desired traffic (e.g., due to a misconfiguration or security requirement to isolate subnets), deleting it could be correct. For example, if the question states that VNet-internal traffic must be restricted for compliance, and the admin needs to remove the default rule to enforce custom rules.
Why candidates choose this
Candidates may think that removing default rules is a quick fix to allow traffic, not realizing that the default rule is permissive and its deletion would cause more connectivity issues, or they may confuse it with a blocking rule.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.