AZ-104 Implement and Manage Virtual Networking Practice Question
Exhibit
NSG: nsg-app Inbound security rules: - Priority 100 Deny TCP 8443 Source: VirtualNetwork Destination: AppTier-ASG - Priority 200 Allow TCP 8443 Source: WebTier-ASG Destination: AppTier-ASG - Priority 300 Allow TCP 443 Source: VirtualNetwork Destination: AppTier-ASG ASG membership: - VM-Web1 is in WebTier-ASG - VM-App1 is in AppTier-ASG Observed result: - VM-Web1 cannot connect to VM-App1 on TCP 8443
Based on the exhibit, what should the administrator change to allow only the web tier to reach the app tier on TCP 8443?
⚠ Common exam trap
The trap here is that candidates often overlook the default-deny rule at priority 100 and assume any allow rule will work regardless of priority, failing to realize that NSG rules are processed in strict priority order and a higher-priority deny will override a lower-priority allow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Move the allow rule for WebTier-ASG to a priority lower than 100.
The exhibit shows a default-deny NSG rule at priority 100 that blocks all traffic from VirtualNetwork to VirtualNetwork. To allow only the web tier (WebTier-ASG) to reach the app tier (AppTier-ASG) on TCP 8443, the administrator must move the allow rule for WebTier-ASG to a priority lower than 100 (e.g., 90). This ensures the allow rule is evaluated before the deny rule, as NSG rules are processed in priority order (lowest number first).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Move the allow rule for WebTier-ASG to a priority lower than 100.
Why this is correct
NSG rules are processed in ascending priority order, where a lower number (e.g., 90) is evaluated before a higher number (e.g., 100). The existing deny rule at priority 100 matches all traffic from VirtualNetwork to AppTier-ASG on TCP 8443, including the web tier's traffic. To let the web tier through, the allow rule for WebTier-ASG must carry a priority lower than 100, ensuring it is evaluated first. Without this change, the deny rule will always block the desired traffic, regardless of the allow rule's other settings.
- ✗
Change the deny rule source from VirtualNetwork to Internet.
Why it's wrong here
Modifying the deny rule's source from VirtualNetwork to Internet would cause it to ignore all internal traffic, including the web tier's traffic, making the allow rule unnecessary for that path. However, this would eliminate the intended restriction on internal sources, allowing any virtual network resource (e.g., other subnets or compromised VMs) to reach AppTier-ASG on TCP 8443. It also leaves the underlying precedence problem unsolved, as the deny rule would no longer block the web tier but would create a broader, less secure rule.
When this WOULD be correct
This option would be correct if the question required blocking inbound traffic from the internet to the app tier while allowing traffic from the web tier. For example, if the deny rule was intended to block internet traffic but was incorrectly scoped to VirtualNetwork, changing the source to Internet would fix it.
- ✗
Associate the NSG with the virtual machine NIC instead of the subnet.
Why it's wrong here
Changing the NSG association from the subnet to the VM NIC alters the scope of enforcement—NIC-level NSGs apply only to that VM, while subnet-level NSGs apply to all resources in the subnet—but it does nothing to change rule precedence. The identical NSG rules are evaluated in the same order whether attached to a subnet or a NIC, so the deny rule at priority 100 would still be processed before the allow rule for WebTier-ASG. This action is therefore ineffective for resolving the traffic block.
When this WOULD be correct
This option would be correct in a scenario where the NSG is applied at the subnet level but you need to apply different rules to individual VMs within the same subnet. For example, if you want to allow specific traffic to one VM while blocking it to another VM in the same subnet, you would associate the NSG with the VM NIC instead of the subnet.
- ✗
Replace the ASG destination with the subnet address range.
Why it's wrong here
Replacing the ASG destination with the subnet address range changes the rule's matching logic from a logical group to a CIDR range, which would apply the same priority order but potentially match traffic to any VM in that subnet, not just the application tier. The core issue remains: the deny rule at priority 100 is evaluated before any allow rule with a higher priority number, so the allow rule for WebTier-ASG would still be bypassed. This approach degrades rule precision and fails to address the precedence conflict.
When this WOULD be correct
This option would be correct if the question asked to allow traffic from a specific subnet (e.g., 10.0.1.0/24) to the app tier, and the NSG rule was using an ASG that did not match the required source. In that case, using the subnet address range as the destination would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Move the allow rule for WebTier-ASG to a priority lower than 100.Correct answer▾
Why this is correct
NSG rules are processed in ascending priority order, where a lower number (e.g., 90) is evaluated before a higher number (e.g., 100). The existing deny rule at priority 100 matches all traffic from VirtualNetwork to AppTier-ASG on TCP 8443, including the web tier's traffic. To let the web tier through, the allow rule for WebTier-ASG must carry a priority lower than 100, ensuring it is evaluated first. Without this change, the deny rule will always block the desired traffic, regardless of the allow rule's other settings.
✗Change the deny rule source from VirtualNetwork to Internet.Wrong answer — click to see why▾
Why this is wrong here
Changing the deny rule source from VirtualNetwork to Internet would block all internet traffic, but the issue is that the deny rule with priority 65000 is blocking traffic from the web tier (which is within the virtual network) to the app tier. The source should remain VirtualNetwork to allow internal traffic; the problem is the rule priority.
★ When this WOULD be the correct answer
This option would be correct if the question required blocking inbound traffic from the internet to the app tier while allowing traffic from the web tier. For example, if the deny rule was intended to block internet traffic but was incorrectly scoped to VirtualNetwork, changing the source to Internet would fix it.
Why candidates choose this
Candidates may think the deny rule is blocking internet traffic to the app tier, so changing the source to Internet seems logical. They overlook that the deny rule's priority is too high and is blocking internal traffic from the web tier.
✗Associate the NSG with the virtual machine NIC instead of the subnet.Wrong answer — click to see why▾
Why this is wrong here
Associating the NSG with the VM NIC instead of the subnet would not resolve the issue because the NSG rules are evaluated at the subnet level for traffic between subnets. The problem is that the deny rule with priority 100 is blocking traffic from the web tier subnet to the app tier subnet; moving the NSG to the NIC would not change the subnet-level rule evaluation.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the NSG is applied at the subnet level but you need to apply different rules to individual VMs within the same subnet. For example, if you want to allow specific traffic to one VM while blocking it to another VM in the same subnet, you would associate the NSG with the VM NIC instead of the subnet.
Why candidates choose this
Candidates may think that applying the NSG closer to the VM (at the NIC) gives more granular control and might override subnet-level rules, not realizing that subnet-level NSG rules are evaluated first and can still block traffic regardless of NIC-level rules.
✗Replace the ASG destination with the subnet address range.Wrong answer — click to see why▾
Why this is wrong here
Replacing the ASG destination with the subnet address range would remove the application security group's ability to dynamically track the web tier's VMs, breaking the intended rule that only the web tier (ASG members) can reach the app tier on TCP 8443.
★ When this WOULD be the correct answer
This option would be correct if the question asked to allow traffic from a specific subnet (e.g., 10.0.1.0/24) to the app tier, and the NSG rule was using an ASG that did not match the required source. In that case, using the subnet address range as the destination would be appropriate.
Why candidates choose this
Candidates may think that using a subnet address range is simpler and more direct than an ASG, not realizing that ASGs provide dynamic membership and are essential for scaling groups where VM IPs change.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Subscription Transfer and Resource Move Operations
Key term
NSG rule
An NSG rule is a set of security rules in Microsoft Azure that controls whether network traffic is allowed or denied to and from Azure resources.
Key term
ASG
An Availability Set is a logical grouping of virtual machines in Azure that helps ensure high availability by distributing VMs across different physical hardware within a datacenter.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.