Courseiva
Implement and Manage Virtual NetworkinghardMultiple ChoiceObjective-mapped

AZ-104 Implement and Manage Virtual Networking Practice Question

Exhibit

NSG: nsg-app
Inbound security rules:
- Priority 100  Deny   TCP 8443   Source: VirtualNetwork   Destination: AppTier-ASG
- Priority 200  Allow  TCP 8443   Source: WebTier-ASG      Destination: AppTier-ASG
- Priority 300  Allow  TCP 443    Source: VirtualNetwork   Destination: AppTier-ASG

ASG membership:
- VM-Web1 is in WebTier-ASG
- VM-App1 is in AppTier-ASG

Observed result:
- VM-Web1 cannot connect to VM-App1 on TCP 8443

Based on the exhibit, what should the administrator change to allow only the web tier to reach the app tier on TCP 8443?

⚠ Common exam trap

The trap here is that candidates often overlook the default-deny rule at priority 100 and assume any allow rule will work regardless of priority, failing to realize that NSG rules are processed in strict priority order and a higher-priority deny will override a lower-priority allow.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Move the allow rule for WebTier-ASG to a priority lower than 100.

The exhibit shows a default-deny NSG rule at priority 100 that blocks all traffic from VirtualNetwork to VirtualNetwork. To allow only the web tier (WebTier-ASG) to reach the app tier (AppTier-ASG) on TCP 8443, the administrator must move the allow rule for WebTier-ASG to a priority lower than 100 (e.g., 90). This ensures the allow rule is evaluated before the deny rule, as NSG rules are processed in priority order (lowest number first).

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Move the allow rule for WebTier-ASG to a priority lower than 100.

    Why this is correct

    NSG rules are processed in ascending priority order, where a lower number (e.g., 90) is evaluated before a higher number (e.g., 100). The existing deny rule at priority 100 matches all traffic from VirtualNetwork to AppTier-ASG on TCP 8443, including the web tier's traffic. To let the web tier through, the allow rule for WebTier-ASG must carry a priority lower than 100, ensuring it is evaluated first. Without this change, the deny rule will always block the desired traffic, regardless of the allow rule's other settings.

  • Change the deny rule source from VirtualNetwork to Internet.

    Why it's wrong here

    Modifying the deny rule's source from VirtualNetwork to Internet would cause it to ignore all internal traffic, including the web tier's traffic, making the allow rule unnecessary for that path. However, this would eliminate the intended restriction on internal sources, allowing any virtual network resource (e.g., other subnets or compromised VMs) to reach AppTier-ASG on TCP 8443. It also leaves the underlying precedence problem unsolved, as the deny rule would no longer block the web tier but would create a broader, less secure rule.

    When this WOULD be correct

    This option would be correct if the question required blocking inbound traffic from the internet to the app tier while allowing traffic from the web tier. For example, if the deny rule was intended to block internet traffic but was incorrectly scoped to VirtualNetwork, changing the source to Internet would fix it.

  • Associate the NSG with the virtual machine NIC instead of the subnet.

    Why it's wrong here

    Changing the NSG association from the subnet to the VM NIC alters the scope of enforcement—NIC-level NSGs apply only to that VM, while subnet-level NSGs apply to all resources in the subnet—but it does nothing to change rule precedence. The identical NSG rules are evaluated in the same order whether attached to a subnet or a NIC, so the deny rule at priority 100 would still be processed before the allow rule for WebTier-ASG. This action is therefore ineffective for resolving the traffic block.

    When this WOULD be correct

    This option would be correct in a scenario where the NSG is applied at the subnet level but you need to apply different rules to individual VMs within the same subnet. For example, if you want to allow specific traffic to one VM while blocking it to another VM in the same subnet, you would associate the NSG with the VM NIC instead of the subnet.

  • Replace the ASG destination with the subnet address range.

    Why it's wrong here

    Replacing the ASG destination with the subnet address range changes the rule's matching logic from a logical group to a CIDR range, which would apply the same priority order but potentially match traffic to any VM in that subnet, not just the application tier. The core issue remains: the deny rule at priority 100 is evaluated before any allow rule with a higher priority number, so the allow rule for WebTier-ASG would still be bypassed. This approach degrades rule precision and fails to address the precedence conflict.

    When this WOULD be correct

    This option would be correct if the question asked to allow traffic from a specific subnet (e.g., 10.0.1.0/24) to the app tier, and the NSG rule was using an ASG that did not match the required source. In that case, using the subnet address range as the destination would be appropriate.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Move the allow rule for WebTier-ASG to a priority lower than 100.Correct answer

Why this is correct

NSG rules are processed in ascending priority order, where a lower number (e.g., 90) is evaluated before a higher number (e.g., 100). The existing deny rule at priority 100 matches all traffic from VirtualNetwork to AppTier-ASG on TCP 8443, including the web tier's traffic. To let the web tier through, the allow rule for WebTier-ASG must carry a priority lower than 100, ensuring it is evaluated first. Without this change, the deny rule will always block the desired traffic, regardless of the allow rule's other settings.

Change the deny rule source from VirtualNetwork to Internet.Wrong answer — click to see why

Why this is wrong here

Changing the deny rule source from VirtualNetwork to Internet would block all internet traffic, but the issue is that the deny rule with priority 65000 is blocking traffic from the web tier (which is within the virtual network) to the app tier. The source should remain VirtualNetwork to allow internal traffic; the problem is the rule priority.

★ When this WOULD be the correct answer

This option would be correct if the question required blocking inbound traffic from the internet to the app tier while allowing traffic from the web tier. For example, if the deny rule was intended to block internet traffic but was incorrectly scoped to VirtualNetwork, changing the source to Internet would fix it.

Why candidates choose this

Candidates may think the deny rule is blocking internet traffic to the app tier, so changing the source to Internet seems logical. They overlook that the deny rule's priority is too high and is blocking internal traffic from the web tier.

Associate the NSG with the virtual machine NIC instead of the subnet.Wrong answer — click to see why

Why this is wrong here

Associating the NSG with the VM NIC instead of the subnet would not resolve the issue because the NSG rules are evaluated at the subnet level for traffic between subnets. The problem is that the deny rule with priority 100 is blocking traffic from the web tier subnet to the app tier subnet; moving the NSG to the NIC would not change the subnet-level rule evaluation.

★ When this WOULD be the correct answer

This option would be correct in a scenario where the NSG is applied at the subnet level but you need to apply different rules to individual VMs within the same subnet. For example, if you want to allow specific traffic to one VM while blocking it to another VM in the same subnet, you would associate the NSG with the VM NIC instead of the subnet.

Why candidates choose this

Candidates may think that applying the NSG closer to the VM (at the NIC) gives more granular control and might override subnet-level rules, not realizing that subnet-level NSG rules are evaluated first and can still block traffic regardless of NIC-level rules.

Replace the ASG destination with the subnet address range.Wrong answer — click to see why

Why this is wrong here

Replacing the ASG destination with the subnet address range would remove the application security group's ability to dynamically track the web tier's VMs, breaking the intended rule that only the web tier (ASG members) can reach the app tier on TCP 8443.

★ When this WOULD be the correct answer

This option would be correct if the question asked to allow traffic from a specific subnet (e.g., 10.0.1.0/24) to the app tier, and the NSG rule was using an ASG that did not match the required source. In that case, using the subnet address range as the destination would be appropriate.

Why candidates choose this

Candidates may think that using a subnet address range is simpler and more direct than an ASG, not realizing that ASGs provide dynamic membership and are essential for scaling groups where VM IPs change.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

About these practice questions

Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.