AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  NSG: A distributed firewall that filters traffic based on rules.

  Why this is correct

  An NSG is a distributed firewall implemented by Azure's host networking layer, not a physical or virtual appliance. It filters inbound and outbound traffic based on priority-ordered security rules, each specifying source/destination, protocol, and port ranges. NSGs can be associated with a subnet, a NIC, or both, and are stateful, meaning that allowing inbound traffic automatically permits the corresponding outbound return traffic. This makes it the primary control for permitting or denying inbound connections to a VM.

• ✗

  Default inbound rule: Allows all inbound traffic by default.

  Why it's wrong here

  Default inbound rules in an NSG actually deny all inbound traffic by default, not allow it. The built-in 'DenyAllInBound' rule with the lowest priority ensures that any inbound traffic not matched by a higher-priority allow rule is blocked. There are also default allow rules for virtual network traffic and Azure Load Balancer health probes, but these are exceptions to the default deny posture. You must explicitly create an allow rule with a priority number lower than the deny rule (i.e., a higher priority) to let traffic reach the VM.

• ✓

  UDR: Overrides the default system route and can redirect traffic to a network virtual appliance.

  Why this is correct

  A User Defined Route (UDR) is an explicit route entry in a route table that takes precedence over Azure's system routes for matching traffic. When attached to a subnet, UDRs can redirect outbound or inbound traffic that transits the subnet to a network virtual appliance (NVA) by setting the next hop type to 'Virtual Appliance' and specifying its private IP address. This is commonly used to force traffic through firewalls or IDS/IPS for inspection. However, a UDR does not open or block ports; it only changes the path traffic takes, so an NSG is still needed to actually filter that traffic.

• ✓

  ASG: Groups VMs logically to simplify NSG rule management.

  Why this is correct

  An Application Security Group (ASG) is an Azure resource that groups VM network interfaces logically based on workload, such as 'web servers' or 'database servers', rather than by subnet or IP address. In NSG rules, you can reference an ASG as the source or destination, and the rule automatically applies to any VM NIC that is added to or removed from the group. This eliminates the need to update individual NSG rules when IP addresses change and reduces rule management overhead. Note that ASGs are not a firewall or security service; they are purely an organization and targeting construct for NSG rules.

• ✗

  Service tags: Override default system routes.

  Why it's wrong here

  Service tags are groups of Azure service IP prefixes, such as 'Storage' or 'AzureLoadBalancer', that you can use as source or destination in NSG rules to allow or deny traffic for an Azure service without hard-coding IP addresses. They represent a collection of IP ranges, not a routing capability; they do not override default system routes. Route overriding is performed exclusively by User Defined Routes (UDRs) in route tables, not by service tags. Thus, using a service tag in an NSG might filter traffic, but it will never change the next hop or the path traffic takes.

Go deeper

Related to this question