Match each NSG or ASG scenario to the most accurate Azure security behavior.
Drag a concept onto its matching description — or click a concept then click the description.
The priority 200 deny is evaluated first and blocks the flow.
The destination NIC must be added to ASG-Api for the rule to match.
The service tag does not represent the workstation's IP; a rule for the real source or a VPN path is needed.
NSGs are stateful, so the return traffic is allowed automatically.
The lower-number deny rule wins because NSGs stop at the first matching rule.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
NSG applied to subnet: Traffic filtering is applied to all network interfaces in that subnet.
NSGs filter traffic at subnet or NIC level, while ASGs group VMs for scalable rule application. Service tags simplify rules for Azure services.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
NSG applied to subnet: Traffic filtering is applied to all network interfaces in that subnet.
Why this is correct
An NSG associated with a subnet applies its rules to all VMs and resources within that subnet.
ASG applied to VMs: Allows grouping of VMs for application of NSG rules based on workload roles.
Why this is correct
ASGs enable logical grouping of VMs with similar functions, simplifying NSG rule creation.
Service tag in NSG: Allows traffic only to specific IP ranges defined by user.
Why it's wrong here
Service tags represent predefined IP ranges for Azure services; users cannot define custom IPs.
ASG automatically updates NSG rules: ASGs integrate with NSGs but do not auto-update rules; rules must reference the ASG.
Why it's wrong here
ASGs are referenced in NSG rules but do not automatically modify or update rules.
Visual reference
Go deeper
Learn chapter
Managed Identities for Azure Resources
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.