AZ-104 Implement and Manage Virtual Networking Practice Question
You need to control inbound and outbound traffic to resources in a subnet by allowing or denying traffic based on IP address, port, and protocol. Which Azure feature should you use?
⚠ Common exam trap
Test-takers frequently confuse a route table (which controls traffic routing) with an NSG (which controls traffic filtering), especially since both are associated with subnets in the Azure portal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A network security group
A network security group (NSG) is the correct Azure feature because it contains security rules that allow or deny inbound and outbound traffic at the subnet or network interface level based on source/destination IP address, port, and protocol (TCP, UDP, or Any). This directly matches the requirement to control traffic by these three parameters.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A network security group
Why this is correct
A network security group contains security rules that permit or deny inbound and outbound traffic by source and destination IP, port, and protocol, applied at the subnet or NIC level, exactly matching the stated filtering requirement.
- ✗
A route table
Why it's wrong here
Route tables direct where packets are forwarded using next-hop addresses; they cannot allow or deny by port or protocol. It is tempting because they shape subnet traffic, and would be correct for forcing traffic through a firewall appliance, not for filtering rules.
When this WOULD be correct
You need to control the path traffic takes from a subnet to another network, such as forcing all internet-bound traffic through a network virtual appliance. A route table with user-defined routes would be the correct answer.
- ✗
A private DNS zone
Why it's wrong here
A private DNS zone resolves names to IP addresses within a virtual network; it cannot filter traffic by IP, port, or protocol. It is tempting because name resolution is a common subnet design task, and it would be correct when you need custom DNS records for internal resources rather than security filtering.
When this WOULD be correct
You need to resolve a custom domain name (e.g., contoso.com) to a private IP address within your Azure virtual network, ensuring that only resources in the virtual network can resolve the name.
- ✗
Azure Advisor
Why it's wrong here
Azure Advisor only surfaces recommendations on cost, reliability, security and performance; it cannot permit or deny packets by IP, port and protocol. It is tempting as a governance tool, but traffic filtering requires a network security group attached to the subnet or NIC.
When this WOULD be correct
When the question asks for a service that provides personalized recommendations to optimize Azure resources for high availability, security, performance, or cost, Azure Advisor is the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A network security groupCorrect answer▾
Why this is correct
A network security group contains security rules that permit or deny inbound and outbound traffic by source and destination IP, port, and protocol, applied at the subnet or NIC level, exactly matching the stated filtering requirement.
✗A route tableWrong answer — click to see why▾
Why this is wrong here
A route table controls network traffic routing (next hop) between subnets and on-premises networks, not traffic filtering based on IP, port, and protocol. It does not allow or deny traffic; it directs packets.
★ When this WOULD be the correct answer
You need to control the path traffic takes from a subnet to another network, such as forcing all internet-bound traffic through a network virtual appliance. A route table with user-defined routes would be the correct answer.
Why candidates choose this
Candidates may confuse routing (path selection) with filtering (allow/deny), or think that controlling traffic flow includes both routing and security filtering.
✗A private DNS zoneWrong answer — click to see why▾
Why this is wrong here
A private DNS zone is used for custom domain name resolution within a virtual network, not for filtering traffic based on IP, port, or protocol.
★ When this WOULD be the correct answer
You need to resolve a custom domain name (e.g., contoso.com) to a private IP address within your Azure virtual network, ensuring that only resources in the virtual network can resolve the name.
Why candidates choose this
Candidates may confuse DNS zones with network security because both involve controlling network behavior, but DNS zones handle name resolution, not traffic filtering.
✗Azure AdvisorWrong answer — click to see why▾
Why this is wrong here
Azure Advisor provides recommendations for best practices in cost, security, reliability, and performance, but it does not control traffic flow based on IP, port, or protocol.
★ When this WOULD be the correct answer
When the question asks for a service that provides personalized recommendations to optimize Azure resources for high availability, security, performance, or cost, Azure Advisor is the correct answer.
Why candidates choose this
Candidates may confuse Azure Advisor's security recommendations with actual security controls, thinking it can enforce traffic rules.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Hub-and-Spoke Network Topology on Azure
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Network security
Network security is the practice of protecting a computer network from unauthorized access, misuse, malfunction, modification, destruction, or improper disclosure, ensuring the confidentiality, integrity, and availability of data and resources.
About these practice questions
This AZ-104 question is part of Courseiva's 1,053-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.