AZ-104 Implement and Manage Virtual Networking Practice Question
Exhibit
Application security groups: - WebASG contains the web VM NICs - AppASG contains the app VM NICs App subnet NSG rules: - Priority 300: Deny-All-Inbound | Source: Any | Destination: Any | Port: Any | Action: Deny No allow rule exists for web-to-app traffic.
Based on the exhibit, what inbound NSG rule should the administrator add to allow only the web tier to reach the app tier on TCP 8080?
⚠ Common exam trap
Many exam-takers confuse the source and destination in NSG rules, mistakenly thinking the rule should allow the app tier to receive traffic from the web tier by setting the source to AppASG and destination to WebASG, which is the reverse of the required direction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Source: WebASG, Destination: AppASG, Protocol: TCP, Port: 8080, Priority: 250
The inbound NSG rule must allow traffic from the web tier (source: WebASG) to the app tier (destination: AppASG) on TCP port 8080. A priority of 250 is lower than the default rules (65000+) and ensures this rule is evaluated before any higher-numbered deny rules, while being high enough to leave room for more specific rules if needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Source: WebASG, Destination: AppASG, Protocol: TCP, Port: 8080, Priority: 250
Why this is correct
This rule uses application security groups to target the web tier and app tier precisely. Priority 250 is evaluated before the deny rule at 300, so the allowed web-to-app traffic can pass while everything else remains blocked.
- ✗
Source: Internet, Destination: VirtualNetwork, Protocol: TCP, Port: 8080, Priority: 250
Why it's wrong here
This rule permits any source on the Internet to reach any destination within the entire VirtualNetwork on TCP port 8080. That exposes the app tier and database tier directly to inbound internet traffic, not just the web-tier VMs that belong to the WebASG. The correct rule scopes the source to WebASG and the destination to AppASG, preserving the intended subnet isolation and least-privilege security. Because the rule is allowed at priority 250, it would also preempt the deny rule at 300 and create a broad network exposure far beyond the explicit web-to-app requirement.
When this WOULD be correct
This option would be correct if the question asked for a rule to allow inbound HTTP traffic from the Internet to a web server (e.g., on port 80) within a virtual network, with no requirement to restrict to specific application security groups.
- ✗
Source: AppASG, Destination: WebASG, Protocol: TCP, Port: 8080, Priority: 250
Why it's wrong here
This rule has the source and destination ASGs reversed: it would allow traffic from the AppASG to the WebASG on TCP 8080, which is the opposite of the required web-to-app flow. Since the rule specifies the wrong direction, any legitimate web-tier requests to the app tier on port 8080 would not match it, and those packets would still be evaluated against the deny rule and dropped. Even though the priority of 250 correctly precedes the deny rule, the ASG orientations render it useless for the intended purpose. The correct rule must place WebASG as the source and AppASG as the destination.
When this WOULD be correct
If the question asked for an inbound rule to allow the app tier to initiate traffic to the web tier on TCP 8080, this option would be correct.
- ✗
Source: WebASG, Destination: AppASG, Protocol: TCP, Port: 8080, Priority: 350
Why it's wrong here
NSG rules are evaluated in ascending numeric priority order, so a lower number is processed first. If a deny rule exists at priority 300 that blocks web-to-app traffic on port 8080, the deny is processed first and the packet is discarded before a rule at priority 350 is ever reached. The allow rule at 350 would therefore never be effective, and the required traffic would still be blocked. To override or precede the deny, the allow rule must have a priority that is numerically lower than 300 (for example, 250) so it is evaluated earlier.
When this WOULD be correct
In a scenario where an existing NSG rule with priority 300 already allows traffic from WebASG to AppASG on TCP 8080, and the administrator needs to add a rule that will be evaluated after that rule (e.g., to deny traffic from a specific subnet within WebASG), a higher priority number like 350 would be correct to ensure the new rule is processed later.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Source: WebASG, Destination: AppASG, Protocol: TCP, Port: 8080, Priority: 250Correct answer▾
Why this is correct
This rule uses application security groups to target the web tier and app tier precisely. Priority 250 is evaluated before the deny rule at 300, so the allowed web-to-app traffic can pass while everything else remains blocked.
✗Source: Internet, Destination: VirtualNetwork, Protocol: TCP, Port: 8080, Priority: 250Wrong answer — click to see why▾
Why this is wrong here
This rule allows inbound traffic from the Internet to any virtual network resource on TCP 8080, which is overly permissive and does not restrict access to only the web tier reaching the app tier.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a rule to allow inbound HTTP traffic from the Internet to a web server (e.g., on port 80) within a virtual network, with no requirement to restrict to specific application security groups.
Why candidates choose this
Candidates may mistakenly think that allowing traffic from the Internet is necessary for web tier access, or they overlook the requirement to limit the source to the web tier specifically.
✗Source: AppASG, Destination: WebASG, Protocol: TCP, Port: 8080, Priority: 250Wrong answer — click to see why▾
Why this is wrong here
The rule specifies Source: AppASG and Destination: WebASG, which is the reverse direction (app to web) instead of allowing web tier to reach app tier on TCP 8080.
★ When this WOULD be the correct answer
If the question asked for an inbound rule to allow the app tier to initiate traffic to the web tier on TCP 8080, this option would be correct.
Why candidates choose this
Candidates may confuse source and destination when thinking about inbound rules, mistakenly assuming the destination is the source of traffic.
✗Source: WebASG, Destination: AppASG, Protocol: TCP, Port: 8080, Priority: 350Wrong answer — click to see why▾
Why this is wrong here
Priority 350 is higher than the default deny rule (65000) but lower than the required priority to override any existing rules; however, the question does not specify a need for a specific priority, so priority 250 is acceptable. The real issue is that option D is identical to the correct answer A, so it is not wrong; the question likely expects priority 250 as the correct one, but D is also correct. Actually, the question states correct answer is A, so D is wrong because it has a higher priority number (350) which means lower priority, potentially being overridden by other rules with lower numbers.
★ When this WOULD be the correct answer
In a scenario where an existing NSG rule with priority 300 already allows traffic from WebASG to AppASG on TCP 8080, and the administrator needs to add a rule that will be evaluated after that rule (e.g., to deny traffic from a specific subnet within WebASG), a higher priority number like 350 would be correct to ensure the new rule is processed later.
Why candidates choose this
Candidates may confuse priority numbering, thinking a higher number means higher priority, or they might assume that any priority works as long as the source/destination are correct, overlooking the importance of rule precedence.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Deny Assignments and Resource Locks Deep Dive
Key term
NSG rule
An NSG rule is a set of security rules in Microsoft Azure that controls whether network traffic is allowed or denied to and from Azure resources.
Key term
TCP
TCP (Transmission Control Protocol) is a core internet protocol that ensures data is sent reliably and in order between devices over a network.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.