Question 850 of 1,049
AZ-104 Implement and Manage Virtual Networking Practice Question
Users on the internet cannot access an HTTPS website hosted on VM-Web01. The VM has a public IP address, the web service is running, and the guest OS firewall allows TCP 443. What is the most likely Azure-side issue?
⚠ Common exam trap
Watch out — candidates often assume that because the guest OS firewall allows the port and the web service is running, the VM is fully accessible, overlooking the fact that Azure's NSG is an additional, mandatory layer of network filtering that must also permit the traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NSG does not allow inbound TCP 443
The most likely Azure-side issue is that the Network Security Group (NSG) associated with the VM's subnet or NIC does not have an inbound rule allowing TCP 443. Even if the guest OS firewall permits HTTPS and the web service is running, the NSG acts as a distributed firewall that filters traffic at the Azure network boundary. Without an explicit inbound security rule for TCP 443, all HTTPS traffic from the internet is dropped before reaching the VM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The NSG does not allow inbound TCP 443
Why this is correct
An NSG is a stateful packet filter that denies inbound traffic by default unless an explicit rule permits it. Without an inbound allow rule for TCP 443, the VM's network interface or its subnet discards the TCP handshake packets from the internet, so HTTPS sessions never reach the web server even if the server is healthy. You must add a rule with source 'Internet' or 0.0.0.0/0, destination port 443, and action Allow to enable inbound HTTPS.
- ✗
The VM uses managed disks
Why it's wrong here
Managed disks are Azure-managed virtual hard disks that function as the OS and data disks attached to the VM; they reside in the storage layer, not the data-path for internet-facing traffic. The VM's network interface, subnet NSG, and host firewall determine whether TCP 443 is reachable. Using managed disks instead of unmanaged disks changes operational overhead and storage reliability, but it has no bearing on inbound HTTPS access.
When this WOULD be correct
In a scenario where a VM fails to start or experiences performance issues due to disk constraints, and the question asks for a likely cause related to storage, 'The VM uses managed disks' could be correct if the exam expects you to identify that unmanaged disks (or misconfigured managed disks) are causing the problem.
- ✗
Azure Backup is not enabled
Why it's wrong here
Azure Backup is a data-protection service that copies VM disks and metadata to a Recovery Services vault for disaster recovery and restore scenarios. Enabling or disabling backup has no effect on the VM's network configuration, firewall rules, or running services. Inbound HTTPS connectivity is governed by the NSG, OS firewall, and the web server's listening socket, not by whether a backup schedule is configured.
- ✗
The storage account uses the Cool tier
Why it's wrong here
The Cool access tier is a performance and cost tier for Azure Blob Storage, intended for data that is infrequently accessed, and it only applies to blob storage accounts. It does not influence the VM's operating system, web server, or network adapters. Even if a website stores content on blob storage, the storage account's tier is not involved in the VM's inbound TCP ports, so it cannot block HTTPS requests to the VM.
When this WOULD be correct
A question asks why an Azure web application using blob storage for static assets experiences high latency for infrequently accessed files. The correct answer would be that the storage account uses the Cool tier, which has lower cost but higher access latency compared to Hot tier.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓The NSG does not allow inbound TCP 443Correct answer▾
Why this is correct
An NSG is a stateful packet filter that denies inbound traffic by default unless an explicit rule permits it. Without an inbound allow rule for TCP 443, the VM's network interface or its subnet discards the TCP handshake packets from the internet, so HTTPS sessions never reach the web server even if the server is healthy. You must add a rule with source 'Internet' or 0.0.0.0/0, destination port 443, and action Allow to enable inbound HTTPS.
✗The VM uses managed disksWrong answer — click to see why▾
Why this is wrong here
Managed disks are a storage configuration for VMs and do not affect network access or HTTPS connectivity. The issue is about inbound traffic, which is controlled by NSGs, not disk type.
★ When this WOULD be the correct answer
In a scenario where a VM fails to start or experiences performance issues due to disk constraints, and the question asks for a likely cause related to storage, 'The VM uses managed disks' could be correct if the exam expects you to identify that unmanaged disks (or misconfigured managed disks) are causing the problem.
Why candidates choose this
Candidates may confuse managed disks with network-related components or think that disk type impacts public access, not realizing that NSGs are the primary Azure firewall for VM traffic.
✗The storage account uses the Cool tierWrong answer — click to see why▾
Why this is wrong here
The storage account Cool tier affects blob storage costs and access latency, not network connectivity to a VM's HTTPS endpoint. The issue is about inbound traffic to a VM, which is controlled by NSG rules, not storage tier.
★ When this WOULD be the correct answer
A question asks why an Azure web application using blob storage for static assets experiences high latency for infrequently accessed files. The correct answer would be that the storage account uses the Cool tier, which has lower cost but higher access latency compared to Hot tier.
Why candidates choose this
Candidates may confuse storage tiers with performance tiers or mistakenly think that storage configuration impacts VM network access, especially when the question involves a web service that might use storage.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.