Implement and Manage Virtual Networking →easyMultiple ChoiceObjective-mapped

AZ-104 Implement and Manage Virtual Networking Practice Question

Exhibit

Inbound NSG rules on subnet AppSubnet:
1. Priority 100: Deny-HTTPS, Source=Any, Destination=Any, Port=443, Action=Deny
2. Priority 200: Allow-HTTPS-Admins, Source=10.10.1.0/24, Destination=Any, Port=443, Action=Allow
Observed result: Admins from 10.10.1.25 cannot open the site on TCP 443.

Based on the exhibit, administrators can reach a web server from the approved subnet, but connections still fail. What is the most likely reason?

⚠ Common exam trap

A common mix-up: candidates assume NSG rules are evaluated in the order they appear in the portal (top-to-bottom) or that allow rules override deny rules regardless of priority, but Azure explicitly uses the priority number to determine evaluation order, and a higher-priority deny rule will block traffic even if a lower-priority allow rule exists.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The deny rule has a higher priority and matches the traffic before the allow rule.

Network Security Groups (NSGs) evaluate rules in order of priority, where a lower priority number (e.g., 100) is evaluated before a higher number (e.g., 200). If a deny rule with a higher priority (lower number) matches the traffic before the allow rule, the traffic is blocked. In this scenario, the deny rule (priority 100) matches the source subnet and destination port 443 before the allow rule (priority 200) can permit it, causing connections to fail.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The allow rule is blocked because inbound rules are evaluated from highest priority number to lowest.
Why it's wrong here
This statement reverses Azure's actual NSG evaluation order. Inbound rules are processed in ascending numeric priority, meaning the lowest priority value is evaluated first, and the first rule that matches ends processing. Here the deny rule with priority 100 is evaluated before the allow rule with priority 200, and because it matches the traffic, the allow rule is never reached. Even if the order were reversed, the evaluation algorithm still uses the priority number, not a highest-to-lowest sequence.
When this WOULD be correct
This option would be correct if the question stated that NSG rules are evaluated from lowest priority number to highest (i.e., highest priority first), and a lower priority allow rule was being blocked by a higher priority deny rule. For example, 'An NSG has an allow rule with priority 200 and a deny rule with priority 100. Traffic matches both, but the allow rule is not effective. Why?'
✓
The deny rule has a higher priority and matches the traffic before the allow rule.
Why this is correct
Azure NSG evaluation uses the lowest priority number first. In the exhibit, the deny rule at priority 100 matches TCP 443 from Any, so it blocks the traffic before the later allow rule at priority 200 is considered. To fix the issue, the allow rule must be placed above the deny rule or the deny rule must be narrowed.
✗
The destination port must be changed to 80 because NSGs cannot allow TCP 443.
Why it's wrong here
NSGs are fully stateful and support filtering for any TCP or UDP port, including TCP 443. There is no protocol port whitelist restriction that prevents HTTPS traffic, and removing or changing the rule to port 80 would actually block the web server's secure traffic. The correct fix is to resolve the rule priority conflict, not to substitute a different port.
When this WOULD be correct
If the question stated that the NSG rule was configured to allow TCP 443 but the web server only listens on port 80, then the destination port mismatch would be the issue. In that scenario, changing the rule to port 80 would be correct.
✗
The subnet requires a route table before HTTPS can be permitted.
Why it's wrong here
A route table (user-defined route) controls the next hop for network traffic, such as forcing traffic through a firewall or VPN appliance. It does not itself permit or deny traffic on a given port; that evaluation is performed exclusively by network security groups and their rules. In this scenario, the web server already uses system routes that allow normal VNet and internet connectivity, so adding a route table would have no effect on the deny rule that is blocking TCP 443.
When this WOULD be correct
In a scenario where a subnet needs to send traffic to an on-premises network via a VPN or ExpressRoute, and no route table with the appropriate route (e.g., 0.0.0.0/0 to the virtual network gateway) is associated with the subnet, causing outbound traffic to fail. The question would specify that traffic to the web server must go through a gateway.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

✓The deny rule has a higher priority and matches the traffic before the allow rule.Correct answer▾

Why this is correct

Azure NSG evaluation uses the lowest priority number first. In the exhibit, the deny rule at priority 100 matches TCP 443 from Any, so it blocks the traffic before the later allow rule at priority 200 is considered. To fix the issue, the allow rule must be placed above the deny rule or the deny rule must be narrowed.

✗The allow rule is blocked because inbound rules are evaluated from highest priority number to lowest.Wrong answer — click to see why▾

Why this is wrong here

In Azure NSGs, rules are evaluated from highest priority (lowest number) to lowest priority (highest number), not from highest priority number to lowest. The allow rule with a lower priority number would be evaluated before a deny rule with a higher priority number, so the order of evaluation is not the issue here.

★ When this WOULD be the correct answer

This option would be correct if the question stated that NSG rules are evaluated from lowest priority number to highest (i.e., highest priority first), and a lower priority allow rule was being blocked by a higher priority deny rule. For example, 'An NSG has an allow rule with priority 200 and a deny rule with priority 100. Traffic matches both, but the allow rule is not effective. Why?'

Why candidates choose this

Candidates may confuse the priority numbering system, thinking that a higher priority number means higher precedence, when in fact a lower number indicates higher priority. They might also misinterpret the evaluation order as being from highest number to lowest.

✗The destination port must be changed to 80 because NSGs cannot allow TCP 443.Wrong answer — click to see why▾

Why this is wrong here

NSGs can allow TCP port 443 (HTTPS) just like any other port; there is no inherent restriction that prevents NSGs from permitting HTTPS traffic.

★ When this WOULD be the correct answer

If the question stated that the NSG rule was configured to allow TCP 443 but the web server only listens on port 80, then the destination port mismatch would be the issue. In that scenario, changing the rule to port 80 would be correct.

Why candidates choose this

Candidates may mistakenly believe that NSGs have limited port support or that HTTPS requires special handling, leading them to think port 443 cannot be allowed.

✗The subnet requires a route table before HTTPS can be permitted.Wrong answer — click to see why▾

Why this is wrong here

Route tables control traffic routing between subnets and networks, not the security filtering of inbound HTTPS traffic. NSGs alone can permit or deny traffic based on rules; a missing route table does not block HTTPS unless the traffic needs to traverse a virtual appliance or another network segment, which is not indicated.

★ When this WOULD be the correct answer

In a scenario where a subnet needs to send traffic to an on-premises network via a VPN or ExpressRoute, and no route table with the appropriate route (e.g., 0.0.0.0/0 to the virtual network gateway) is associated with the subnet, causing outbound traffic to fail. The question would specify that traffic to the web server must go through a gateway.

Why candidates choose this

Candidates may confuse the function of NSGs (security filtering) with route tables (traffic routing), assuming that a route table is required for any traffic to be permitted, or they may think that HTTPS requires a specific route to the internet.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Visual reference

Go deeper

AZ-104 Implement and Manage Virtual Networking Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question