AZ-104 Implement and Manage Virtual Networking Practice Question
Which two statements about network security group processing are correct? Select two.
⚠ Common exam trap
Many exam-takers confuse NSG rule processing order with alphabetical or sequential naming, or mistakenly believe NSGs cannot be applied to NICs, leading them to select options B or E instead of the correct priority-based evaluation logic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NSG rules are evaluated starting with the lowest priority number.
NSG rules are processed in order of increasing priority number, meaning the rule with the lowest priority number (e.g., 100) is evaluated first. This ensures that more specific or critical rules can be applied before broader rules with higher priority numbers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NSG rules are evaluated starting with the lowest priority number.
Why this is correct
Azure Network Security Group rules are evaluated in ascending priority-number order, so the rule with the smallest numeric value (for example, 100) is processed before rules numbered 200 or 1000. The first rule whose source, destination, port, and protocol match the traffic is applied, and no later rules are evaluated. This numeric priority design ensures deterministic, predictable filtering regardless of rule order in the portal or ARM template.
- ✗
An NSG can be linked only to a subnet, not to a network interface card.
Why it's wrong here
An NSG can be associated with a subnet and with an individual network interface card; both associations are valid and can even be applied simultaneously to the same workload. When both are configured, the security rules are combined, and for inbound traffic the subnet-level NSG is processed first followed by the NIC-level NSG; for outbound, the reverse order applies. NIC-level associations allow granular per-VM filtering, so restricting NSGs to subnets only is a common misconception.
When this WOULD be correct
If the question stated 'An NSG can be linked only to a subnet, not to a virtual network' or 'An NSG can be linked only to a subnet, not to a virtual machine directly' (without mentioning NIC), then this option could be correct because NSGs are associated at subnet or NIC level, not directly to a VM or VNet.
- ✓
A deny rule with a lower number can block traffic even if an allow rule exists later.
Why this is correct
A deny rule with a lower priority number (for example, 100) is evaluated earlier and, if it matches, immediately terminates processing, so a matching allow rule with a higher number (for example, 200) is never reached. This 'first match wins' behavior is why Azure recommends placing broad denies at low-numbered priorities and more specific allows at higher unless you intentionally want to block first. Lower number means higher precedence, so the deny's action determines the traffic outcome despite a later allow.
- ✗
Azure ignores NSG rules whenever a route table is attached to the subnet.
Why it's wrong here
Attaching a route table to a subnet only changes the next-hop path for traffic (via user-defined routes); it does not bypass or disable NSG processing. NSGs are access-control filters evaluated independently and, if a rule matches, the traffic is allowed or denied before forwarding decisions are determined by the route table. In fact, route tables and NSGs serve different layers, so an NSG still inspects packets even when a UDR directs packets to a virtual appliance or a gateway.
When this WOULD be correct
This option would be correct if the question stated: 'Which statement about Azure network security is true?' and the scenario involved a forced tunneling configuration where a route table directs all traffic to a network virtual appliance, effectively bypassing NSG inspection for certain traffic flows. However, even then, NSG rules are not ignored; they are still evaluated.
- ✗
Security rules are processed alphabetically by name.
Why it's wrong here
Azure NSG rules are never processed alphabetically; their names are only logical identifiers used for management and documentation. The evaluation order is strictly by the numeric priority property, with duplicate priorities disallowed for rules in the same NSG. If names mattered, renaming a rule would silently change network behavior, which is why the platform relies on an explicit integer priority value.
When this WOULD be correct
This would be correct in a question about Azure Policy or role-based access control (RBAC) where policy rules or role assignments are evaluated alphabetically by name when priorities are equal.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓NSG rules are evaluated starting with the lowest priority number.Correct answer▾
Why this is correct
Azure Network Security Group rules are evaluated in ascending priority-number order, so the rule with the smallest numeric value (for example, 100) is processed before rules numbered 200 or 1000. The first rule whose source, destination, port, and protocol match the traffic is applied, and no later rules are evaluated. This numeric priority design ensures deterministic, predictable filtering regardless of rule order in the portal or ARM template.
✗An NSG can be linked only to a subnet, not to a network interface card.Wrong answer — click to see why▾
Why this is wrong here
An NSG can be linked to both a subnet and a network interface card (NIC), not just a subnet. This is a fundamental capability of NSGs in Azure.
★ When this WOULD be the correct answer
If the question stated 'An NSG can be linked only to a subnet, not to a virtual network' or 'An NSG can be linked only to a subnet, not to a virtual machine directly' (without mentioning NIC), then this option could be correct because NSGs are associated at subnet or NIC level, not directly to a VM or VNet.
Why candidates choose this
Candidates may confuse NSG association with other Azure resources that are subnet-only, or they may incorrectly recall that NSGs are only for subnets, overlooking the NIC-level association.
✗Azure ignores NSG rules whenever a route table is attached to the subnet.Wrong answer — click to see why▾
Why this is wrong here
Azure does not ignore NSG rules when a route table is attached. NSGs and route tables operate independently: NSGs filter traffic, while route tables control traffic routing. Both can be applied to the same subnet without conflict.
★ When this WOULD be the correct answer
This option would be correct if the question stated: 'Which statement about Azure network security is true?' and the scenario involved a forced tunneling configuration where a route table directs all traffic to a network virtual appliance, effectively bypassing NSG inspection for certain traffic flows. However, even then, NSG rules are not ignored; they are still evaluated.
Why candidates choose this
Candidates may confuse the functions of NSGs and route tables, thinking that a route table overrides NSG rules because both can be associated with subnets. They might also recall that user-defined routes can influence traffic flow, leading to the incorrect assumption that NSGs are bypassed.
✗Security rules are processed alphabetically by name.Wrong answer — click to see why▾
Why this is wrong here
NSG rules are processed in priority order (lowest number first), not alphabetically by name. Rule names are for identification only and have no effect on evaluation order.
★ When this WOULD be the correct answer
This would be correct in a question about Azure Policy or role-based access control (RBAC) where policy rules or role assignments are evaluated alphabetically by name when priorities are equal.
Why candidates choose this
Candidates may assume that since many IT systems process rules alphabetically (e.g., firewall rule lists), Azure NSGs follow the same pattern, overlooking the explicit priority number system.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Security Groups (NSG)
Key term
Security group
A security group is a virtual firewall that controls inbound and outbound traffic to AWS resources, such as EC2 instances, based on defined rules.
Key term
Network Security Group
A Network Security Group is a set of rules that controls inbound and outbound traffic to Azure resources like virtual machines and subnets.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.