AZ-104 Implement and Manage Virtual Networking Practice Question
An administrator is troubleshooting inbound HTTPS to a VM. The subnet NSG has these custom rules: Deny-Internet-Inbound at priority 150, Allow-HTTPS-Admin at priority 200, and the default deny rules remain in place. The administrator’s client is on the internet and should be able to reach the VM on TCP 443. What change will fix the problem?
⚠ Common exam trap
Many exam-takers assume NSG rules are evaluated in the order they are listed or that allow rules automatically override deny rules, but Azure NSGs strictly evaluate by priority number, so a deny rule with a lower number will block traffic even if an allow rule with a higher number exists.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Move the allow rule to a lower priority number than the deny rule.
Network Security Group (NSG) rules are evaluated in priority order, with lower numbers evaluated first. The Deny-Internet-Inbound rule at priority 150 is evaluated before the Allow-HTTPS-Admin rule at priority 200, so the deny rule blocks the inbound HTTPS traffic before the allow rule can be processed. Moving the allow rule to a lower priority number (e.g., 140) ensures it is evaluated first, permitting the traffic from the internet on TCP 443.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Move the allow rule to a lower priority number than the deny rule.
Why this is correct
NSG rules are evaluated in priority order, and the lowest number wins. Because the deny rule at 150 is evaluated before the allow rule at 200, inbound HTTPS is blocked even though an allow rule exists. Making the allow rule higher priority than the deny rule, such as 100, lets the permitted traffic match first and be accepted.
- ✗
Change the allow rule source from Internet to Any and keep the same priority.
Why it's wrong here
Changing the source from Internet to Any does not affect NSG rule evaluation order; the deny rule at priority 150 is still evaluated before the allow rule at 200. Because the deny rule matches first, the packet is dropped before any allow rule can be considered, regardless of how broad the source is. Priority, not source scope, is the deciding factor here.
When this WOULD be correct
If the NSG had no deny rule blocking Internet traffic, or if the allow rule had a lower priority number than any conflicting deny rule, then setting the source to Any would be correct to allow all inbound HTTPS traffic.
- ✗
Create a route table to the VM subnet so traffic reaches the VM faster.
Why it's wrong here
A route table (user-defined route) controls the next-hop path for packets, not the firewall-like filtering performed by NSGs. Even if a custom route made traffic reach the VM faster, the NSG's deny rule is evaluated along the network path and blocks the connection before delivery. Routing and security rule evaluation are independent; changing routing cannot override a higher-priority deny rule.
When this WOULD be correct
This option would be correct in a scenario where traffic to the VM is being dropped due to asymmetric routing or a missing default route, and you need to ensure return traffic uses the same path. For example, if the VM is behind a network virtual appliance and traffic is not reaching it because of incorrect route tables.
- ✗
Associate an application security group with the VM and leave the rules unchanged.
Why it's wrong here
An application security group (ASG) is just a logical grouping used to simplify NSG rule source/destination definitions, not a mechanism to change rule priority. Associating the VM with an ASG while leaving existing rules unchanged leaves the deny rule at priority 150 ahead of the allow rule at 200, so the deny still wins. ASGs do not reorder or bypass NSG evaluation order.
When this WOULD be correct
In a scenario where the NSG has an allow rule referencing an ASG as source or destination, and the VM is added to that ASG, this would be correct. For example, if the allow rule had source set to an ASG containing the admin's client IPs, associating the VM with that ASG would apply the rule.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Move the allow rule to a lower priority number than the deny rule.Correct answer▾
Why this is correct
NSG rules are evaluated in priority order, and the lowest number wins. Because the deny rule at 150 is evaluated before the allow rule at 200, inbound HTTPS is blocked even though an allow rule exists. Making the allow rule higher priority than the deny rule, such as 100, lets the permitted traffic match first and be accepted.
✗Change the allow rule source from Internet to Any and keep the same priority.Wrong answer — click to see why▾
Why this is wrong here
The deny rule at priority 150 explicitly blocks traffic from the Internet, so changing the allow rule's source from Internet to Any does not override the deny; the deny still applies because it has higher priority (lower number).
★ When this WOULD be the correct answer
If the NSG had no deny rule blocking Internet traffic, or if the allow rule had a lower priority number than any conflicting deny rule, then setting the source to Any would be correct to allow all inbound HTTPS traffic.
Why candidates choose this
Candidates may think that widening the source to Any makes the rule more permissive, but they overlook that priority determines which rule wins when rules conflict.
✗Create a route table to the VM subnet so traffic reaches the VM faster.Wrong answer — click to see why▾
Why this is wrong here
The issue is that the deny rule at priority 150 blocks inbound HTTPS from the Internet before the allow rule at priority 200 can be evaluated. Adding a route table does not affect NSG rule evaluation order; it only influences traffic routing, which is not the problem here.
★ When this WOULD be the correct answer
This option would be correct in a scenario where traffic to the VM is being dropped due to asymmetric routing or a missing default route, and you need to ensure return traffic uses the same path. For example, if the VM is behind a network virtual appliance and traffic is not reaching it because of incorrect route tables.
Why candidates choose this
Candidates may think that a route table can override NSG rules or speed up traffic, confusing routing with security filtering. They might also believe that adding a route can bypass the deny rule, which is incorrect.
✗Associate an application security group with the VM and leave the rules unchanged.Wrong answer — click to see why▾
Why this is wrong here
Associating an application security group (ASG) with the VM does not change the NSG rule evaluation order; the deny rule at priority 150 still blocks inbound HTTPS from the Internet, regardless of ASG membership.
★ When this WOULD be the correct answer
In a scenario where the NSG has an allow rule referencing an ASG as source or destination, and the VM is added to that ASG, this would be correct. For example, if the allow rule had source set to an ASG containing the admin's client IPs, associating the VM with that ASG would apply the rule.
Why candidates choose this
Candidates may think ASGs simplify rule management and automatically override deny rules, or they confuse ASGs with service endpoints or route tables that affect traffic flow.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Network Security Groups (NSG)
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
Network Security Group
A Network Security Group is a set of rules that controls inbound and outbound traffic to Azure resources like virtual machines and subnets.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.