Question 618 of 1,049
AZ-104 Implement and Manage Virtual Networking Practice Question
Exhibit
Inbound NSG rules for Subnet-Prod: Priority 200: Deny-HTTPS-Internet | Source: Internet | Destination: Any | Port: 443 | Action: Deny Priority 250: Allow-HTTPS-Admin | Source: 203.0.113.20/32 | Destination: Any | Port: 443 | Action: Allow Observed result: Traffic from 203.0.113.20 to the VM on TCP 443 is blocked.
Based on the exhibit, why is the administrator's HTTPS test still being denied, and what should be changed?
⚠ Common exam trap
Many exam-takers confuse priority numbers, thinking a higher number means higher priority, when in fact lower numbers are evaluated first; this leads them to incorrectly choose increasing the deny rule's priority or other irrelevant changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Move Allow-HTTPS-Admin to a priority lower than 200.
The administrator's HTTPS test is denied because Azure Network Security Groups (NSGs) process rules in priority order, from lowest to highest numeric value. The deny rule at priority 200 is evaluated before the allow rule at priority 300, so the HTTPS traffic is blocked. To allow HTTPS traffic, the allow rule must have a lower priority number (e.g., 100) than the deny rule, ensuring it is evaluated first. Option B correctly identifies that moving Allow-HTTPS-Admin to a priority lower than 200 (i.e., a smaller number) will allow the traffic before the deny rule is applied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase the deny rule priority number from 200 to 300.
Why it's wrong here
Increasing the deny rule's priority number from 200 to 300 lowers its precedence, meaning it will be evaluated later in the rule sequence. However, the admin allow rule still has a higher numeric priority (e.g., 400), so it is evaluated after the deny rule and will never be matched. The correct fix is to make the allow rule's numeric priority lower than 200 so that it is evaluated before the deny rule; simply renumbering the deny rule does not guarantee the allow rule is reached.
When this WOULD be correct
This option would be correct if the question stated that the allow rule had a priority of 300 and the deny rule had a priority of 200, and the goal was to ensure the deny rule is evaluated before the allow rule. Increasing the deny rule priority to 300 would make it higher priority than the allow rule, thus denying traffic as intended.
- ✓
Move Allow-HTTPS-Admin to a priority lower than 200.
Why this is correct
NSG rules are processed from the lowest priority number upward. Because the deny rule is evaluated first, the admin allow rule never gets a chance. Moving the allow rule ahead of the deny rule lets only the admin IP reach HTTPS while everyone else remains blocked.
- ✗
Change Allow-HTTPS-Admin to use protocol Any.
Why it's wrong here
Changing the protocol to Any would only broaden the rule's matching criteria; it does not change the order in which NSG rules are evaluated. Because the deny rule at priority 200 is processed first, any subsequent allow rule, regardless of protocol, will never be reached. It also weakens security by permitting all protocols for that rule while leaving the precedence issue unresolved.
When this WOULD be correct
In a scenario where a firewall rule is blocking traffic due to protocol mismatch (e.g., an allow rule for HTTPS but traffic uses HTTP), changing the rule to 'Any' protocol would allow the traffic. For example, if the administrator's test used HTTP instead of HTTPS, setting protocol to 'Any' would match.
- ✗
Assign a public IP address to the VM.
Why it's wrong here
Assigning a public IP address to the VM only provides a routable inbound endpoint; it has no effect on NSG rule evaluation. NSG filters are applied at the subnet or network interface level before traffic reaches the guest OS, so the deny rule still applies exactly the same. The VM's own public IP does not change the source IP of the request, nor does it cause the NSG to skip the deny rule.
When this WOULD be correct
In a scenario where a VM is behind Azure Firewall and needs direct internet access without firewall inspection, assigning a public IP and using a custom route (e.g., 0.0.0.0/0 next hop Internet) would bypass the firewall, making this correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Move Allow-HTTPS-Admin to a priority lower than 200.Correct answer▾
Why this is correct
NSG rules are processed from the lowest priority number upward. Because the deny rule is evaluated first, the admin allow rule never gets a chance. Moving the allow rule ahead of the deny rule lets only the admin IP reach HTTPS while everyone else remains blocked.
✗Increase the deny rule priority number from 200 to 300.Wrong answer — click to see why▾
Why this is wrong here
Increasing the deny rule priority from 200 to 300 makes it a lower priority (higher number), which does not resolve the issue because the deny rule still has a higher priority than the allow rule (which is at priority 100). The HTTPS test is denied because the deny rule at priority 200 is evaluated before the allow rule at priority 100.
★ When this WOULD be the correct answer
This option would be correct if the question stated that the allow rule had a priority of 300 and the deny rule had a priority of 200, and the goal was to ensure the deny rule is evaluated before the allow rule. Increasing the deny rule priority to 300 would make it higher priority than the allow rule, thus denying traffic as intended.
Why candidates choose this
Candidates may think that increasing the priority number makes the rule more important, but in Azure, a lower priority number means higher priority. They might also confuse priority with rule order or assume that a higher number overrides a lower one.
✗Change Allow-HTTPS-Admin to use protocol Any.Wrong answer — click to see why▾
Why this is wrong here
The Allow-HTTPS-Admin rule already uses protocol TCP (HTTPS). Changing it to 'Any' would not resolve the issue because the deny rule with priority 200 is blocking traffic before the allow rule is evaluated. The problem is rule priority, not protocol.
★ When this WOULD be the correct answer
In a scenario where a firewall rule is blocking traffic due to protocol mismatch (e.g., an allow rule for HTTPS but traffic uses HTTP), changing the rule to 'Any' protocol would allow the traffic. For example, if the administrator's test used HTTP instead of HTTPS, setting protocol to 'Any' would match.
Why candidates choose this
Candidates may think that if the rule is not matching, widening the protocol to 'Any' will make it match. They overlook that the deny rule with higher priority is the actual blocker, not the protocol specificity.
✗Assign a public IP address to the VM.Wrong answer — click to see why▾
Why this is wrong here
Assigning a public IP address to the VM does not affect Azure Firewall rules; the HTTPS test is denied by a firewall rule with priority 200, and the VM's IP assignment does not bypass firewall policies.
★ When this WOULD be the correct answer
In a scenario where a VM is behind Azure Firewall and needs direct internet access without firewall inspection, assigning a public IP and using a custom route (e.g., 0.0.0.0/0 next hop Internet) would bypass the firewall, making this correct.
Why candidates choose this
Candidates may think that a public IP allows direct internet access, overlooking that Azure Firewall still intercepts traffic unless explicitly bypassed via routing.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.