Pass Your Microsoft AZ-104 Exam Easy!

'The lower-priority-number deny rule wins when its tuple matches' applies to a different feature boundary because Azure NSGs evaluate matching rules in ascending priority; a broad later allow cannot override an earlier deny. In the stated scenario where both subnet and NIC NSGs apply to a VM, 'The lower-priority-number deny rule wins when its tuple matches' does not satisfy the mechanism that traffic must satisfy relevant security checks at each applicable network boundary. The necessary action is 'Evaluate both applied NSGs and their combined allow/deny outcome', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Correct the NIC's ASG association and verify rule scope' is associated with this separate need: an application security group name was added to an NSG rule but one backend NIC isn't a member. That is because nSGs match eligible NIC group membership, not merely a similarly named application tag. Here both subnet and NIC NSGs apply to a VM, so 'Correct the NIC's ASG association and verify rule scope' misses the fact that traffic must satisfy relevant security checks at each applicable network boundary. 'Evaluate both applied NSGs and their combined allow/deny outcome' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When both a subnet NSG and a network-interface NSG apply, a connection must pass the applicable rules at both scopes for its direction. An allow on the NIC does not erase a matching deny on the subnet, and the reverse can also fail. The scenario explicitly says both NSGs are attached, so inspecting only one level gives an incomplete access decision. Evaluate the same source/destination address, protocol, and port tuple through both effective rule sets before adding a rule or declaring the VM protected.

The nearby action 'The lower-priority-number deny rule wins when its tuple matches' is associated with this separate need: two inbound NSG rules exist: broad Allow priority 200 and narrow Deny priority 100. That is because Azure NSGs evaluate matching rules in ascending priority; a broad later allow cannot override an earlier deny. Here a lab NSG permits Any source to Any destination on Any port, contrary to the app's limited needs, so 'The lower-priority-number deny rule wins when its tuple matches' misses the fact that broad Any-to-Any rules violate least privilege and expand reachability. 'Use narrowly scoped source, destination, protocol and port rules' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Match the correct destination port and leave client source port appropriately broad' solves another task because client source ports are usually ephemeral; confusing source/destination fields prevents intended connections. For the situation where a lab NSG permits Any source to Any destination on Any port, contrary to the app's limited needs, this distractor misses the requirement that broad Any-to-Any rules violate least privilege and expand reachability. Unlike 'Match the correct destination port and leave client source port appropriately broad', 'Use narrowly scoped source, destination, protocol and port rules' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Review outbound NSG rules and the flow's direction-specific tuple' applies to a different feature boundary because inbound allow is not general permission for new outbound connections. In the stated scenario where a lab NSG permits Any source to Any destination on Any port, contrary to the app's limited needs, 'Review outbound NSG rules and the flow's direction-specific tuple' does not satisfy the mechanism that broad Any-to-Any rules violate least privilege and expand reachability. The necessary action is 'Use narrowly scoped source, destination, protocol and port rules', which should be checked against this Azure resource's actual permissions and state.

'The lower-priority-number deny rule wins when its tuple matches' solves another task because Azure NSGs evaluate matching rules in ascending priority; a broad later allow cannot override an earlier deny. For the situation where a public frontend should contact only one backend service on TCP 8443, this distractor misses the requirement that a constrained five-tuple protects the backend without an unnecessary global service allow. Unlike 'The lower-priority-number deny rule wins when its tuple matches', 'Allow the frontend ASG or subnet to the backend on required TCP 8443 only' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When an engineer writes a five-tuple NSG rule but swaps source prefix and destination prefix, the action 'Correct source/destination addresses, ports and protocol for actual packet direction' can be relevant: NSG rule matching depends on each field in the connection tuple. For the different problem of a public frontend should contact only one backend service on TCP 8443, 'Correct source/destination addresses, ports and protocol for actual packet direction' misses the mechanism that a constrained five-tuple protects the backend without an unnecessary global service allow. Choosing 'Correct source/destination addresses, ports and protocol for actual packet direction' would address that other need, whereas 'Allow the frontend ASG or subnet to the backend on required TCP 8443 only' is intended to solve the stated condition.

'Trace effective subnet and NIC security rules for the same five-tuple' applies to a different feature boundary because a subnet allow cannot force a separately applicable NIC-level deny to permit traffic. In the stated scenario where a public frontend should contact only one backend service on TCP 8443, 'Trace effective subnet and NIC security rules for the same five-tuple' does not satisfy the mechanism that a constrained five-tuple protects the backend without an unnecessary global service allow. The necessary action is 'Allow the frontend ASG or subnet to the backend on required TCP 8443 only', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Review outbound NSG rules and the flow's direction-specific tuple' is associated with this separate need: a VM can accept inbound HTTPS but cannot initiate a connection to a remote API. That is because inbound allow is not general permission for new outbound connections. Here a public frontend should contact only one backend service on TCP 8443, so 'Review outbound NSG rules and the flow's direction-specific tuple' misses the fact that a constrained five-tuple protects the backend without an unnecessary global service allow. 'Allow the frontend ASG or subnet to the backend on required TCP 8443 only' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When two inbound NSG rules exist: broad Allow priority 200 and narrow Deny priority 100, the action 'The lower-priority-number deny rule wins when its tuple matches' can be relevant: Azure NSGs evaluate matching rules in ascending priority; a broad later allow cannot override an earlier deny. For the different problem of a team uses NSG rules but wants to block HTTP requests containing malicious URLs, 'The lower-priority-number deny rule wins when its tuple matches' misses the mechanism that nSGs mainly filter network tuples, not request paths and application payload patterns. Choosing 'The lower-priority-number deny rule wins when its tuple matches' would address that other need, whereas 'Use a supported WAF or application-layer firewall for HTTP inspection' is intended to solve the stated condition.

'Use application security groups in supported NSG source/destination rules' applies to a different feature boundary because aSGs group eligible NICs for rule matching instead of static address lists. In the stated scenario where a team uses NSG rules but wants to block HTTP requests containing malicious URLs, 'Use application security groups in supported NSG source/destination rules' does not satisfy the mechanism that nSGs mainly filter network tuples, not request paths and application payload patterns. The necessary action is 'Use a supported WAF or application-layer firewall for HTTP inspection', which should be checked against this Azure resource's actual permissions and state.

'Review outbound NSG rules and the flow's direction-specific tuple' solves another task because inbound allow is not general permission for new outbound connections. For the situation where a team uses NSG rules but wants to block HTTP requests containing malicious URLs, this distractor misses the requirement that nSGs mainly filter network tuples, not request paths and application payload patterns. Unlike 'Review outbound NSG rules and the flow's direction-specific tuple', 'Use a supported WAF or application-layer firewall for HTTP inspection' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Delete the subnet NSG without inspecting the NIC NSG' fails the stated scenario where an NSG deny appears at the NIC even though the subnet allow exists because the second applicable NSG can still deny the same flow, so this is not diagnostic. The required multi-part resolution instead needs a subnet allow cannot force a separately applicable NIC-level deny to permit traffic, which 'Delete the subnet NSG without inspecting the NIC NSG' does not establish. Do not count 'Delete the subnet NSG without inspecting the NIC NSG' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

'Disable NSG logging before troubleshooting the denied connection' fails the stated scenario where an NSG deny appears at the NIC even though the subnet allow exists because removing security evidence neither permits the flow nor identifies the rule blocking it. The required multi-part resolution instead needs a subnet allow cannot force a separately applicable NIC-level deny to permit traffic, which 'Disable NSG logging before troubleshooting the denied connection' does not establish. Do not count 'Disable NSG logging before troubleshooting the denied connection' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

'Assume an allow at the subnet automatically overrides a deny on the NIC' fails the stated scenario where an NSG deny appears at the NIC even though the subnet allow exists because traffic must satisfy both relevant security boundaries where both NSGs apply. The required multi-part resolution instead needs a subnet allow cannot force a separately applicable NIC-level deny to permit traffic, which 'Assume an allow at the subnet automatically overrides a deny on the NIC' does not establish. Do not count 'Assume an allow at the subnet automatically overrides a deny on the NIC' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

'Raise VM vCPU quota to resolve a denied TCP port' fails the stated scenario where an NSG deny appears at the NIC even though the subnet allow exists because compute quota cannot alter NSG packet filtering decisions. The required multi-part resolution instead needs a subnet allow cannot force a separately applicable NIC-level deny to permit traffic, which 'Raise VM vCPU quota to resolve a denied TCP port' does not establish. Do not count 'Raise VM vCPU quota to resolve a denied TCP port' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

Azure NSG rules use their priority and matching five-tuple to decide which rule applies first. A custom allow that matches the requested flow but is evaluated after a deny will not permit the traffic. The administrator must choose an appropriate higher-priority rule and verify source, destination, protocol and ports. Correct match conditions alone cannot override a deny that is processed first.

When two inbound NSG rules exist: broad Allow priority 200 and narrow Deny priority 100, the action 'The lower-priority-number deny rule wins when its tuple matches' can be relevant: Azure NSGs evaluate matching rules in ascending priority; a broad later allow cannot override an earlier deny. For the different problem of a new custom NSG allow should supersede a broad default deny, 'The lower-priority-number deny rule wins when its tuple matches' misses the mechanism that built-in default rules apply only after more specific custom rules that match first. Choosing 'The lower-priority-number deny rule wins when its tuple matches' would address that other need, whereas 'Use a valid custom rule with higher evaluation priority and the correct tuple' is intended to solve the stated condition.

'Trace effective subnet and NIC security rules for the same five-tuple' applies to a different feature boundary because a subnet allow cannot force a separately applicable NIC-level deny to permit traffic. In the stated scenario where a new custom NSG allow should supersede a broad default deny, 'Trace effective subnet and NIC security rules for the same five-tuple' does not satisfy the mechanism that built-in default rules apply only after more specific custom rules that match first. The necessary action is 'Use a valid custom rule with higher evaluation priority and the correct tuple', which should be checked against this Azure resource's actual permissions and state.

An NSG rule can have a numerically higher evaluation priority yet be irrelevant if its tuple does not match the actual flow. The requirement is an allow that supersedes a broad deny for the intended traffic, which needs both appropriate priority and correct match conditions. Looking only at the numbers can misdiagnose the reason packets are blocked and risks creating a rule with unintended access.

Changing a packet or rule condition would test a different connection rather than evaluate the given traffic. The current source `10.0.0.5` lies within `10.0.0.0/24`, and TCP 443 matches both listed inbound rules. Azure NSGs process applicable rules by ascending numerical priority until the first match. For this specified packet, Allow 250 is encountered before Deny 300. Altering the input does not answer which existing rule determines the stated request.

NSG rules are not evaluated by a blanket principle that Deny always overrides Allow. The decisive facts are the traffic five-tuple and numeric priority ordering, where a smaller number has higher precedence. In this case the packet matches an Allow at 250 before reaching the Deny at 300. Treating Deny as absolute would incorrectly predict a block; it would not describe the Azure NSG first-matching-rule evaluation model for these exact rules.

Priority number 400 is evaluated after both the existing Allow 250 and Deny 300, not before them. Adding a later rule cannot override a first-match decision that has already been made for a packet matching an earlier rule. The existing Allow 250 already determines this source's NSG disposition. If policy requires a different result, the administrator must change an appropriate earlier matching rule or its priority, not append a lower-precedence Allow and assume it will take effect.

Outbound NSG rules govern new flows initiated from the VM, and confirming the original outbound allow can be useful if a new connection fails. Here, however, the connection is already established and permitted, and the question asks only whether another inbound allow is required for its return packets. Azure network security groups keep flow records and are stateful; return traffic belonging to the allowed flow is permitted without a new reversed rule. Reviewing the same outbound rule and assuming an inbound reply allow is required misses that stateful behavior. If an actual response fails, investigate the host firewall, application and other path controls separately.

Effective-rule inspection and tools such as IP flow verify are useful when diagnosing a genuinely blocked new connection, but they do not themselves explain why reply packets for a currently established permitted flow need no separate inbound ACL entry. The question states the TCP flow has already been allowed, so the decisive feature is the NSG flow record. State tracking associates return packets with that existing flow and permits them without an additional inbound authorization. If symptoms persist despite that, gather evidence at the guest operating system, listener, NAT or intermediate network devices instead of automatically adding a broad reverse allow rule.

Reversing the source and destination address prefixes in an outbound NSG rule changes the match for new outbound traffic; it is not the correct way to admit response packets belonging to an existing permitted TCP connection. NSG stateful flow tracking already provides that reverse direction for the established flow. An incorrectly broad reversed rule could also grant access that was not part of the original requirement or fail to match the intended direction. Treat a new inbound session and a response to an outbound session as different authorization events, and inspect evidence from the actual flow before changing network policy.

'Use application security groups in supported NSG source/destination rules' applies to a different feature boundary because aSGs group eligible NICs for rule matching instead of static address lists. In the stated scenario where an engineer writes a five-tuple NSG rule but swaps source prefix and destination prefix, 'Use application security groups in supported NSG source/destination rules' does not satisfy the mechanism that NSG rule matching depends on each field in the connection tuple. The necessary action is 'Correct source/destination addresses, ports and protocol for actual packet direction', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Correct the NIC's ASG association and verify rule scope' is associated with this separate need: an application security group name was added to an NSG rule but one backend NIC isn't a member. That is because nSGs match eligible NIC group membership, not merely a similarly named application tag. Here an engineer writes a five-tuple NSG rule but swaps source prefix and destination prefix, so 'Correct the NIC's ASG association and verify rule scope' misses the fact that NSG rule matching depends on each field in the connection tuple. 'Correct source/destination addresses, ports and protocol for actual packet direction' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Match the correct destination port and leave client source port appropriately broad' solves another task because client source ports are usually ephemeral; confusing source/destination fields prevents intended connections. For the situation where an engineer writes a five-tuple NSG rule but swaps source prefix and destination prefix, this distractor misses the requirement that NSG rule matching depends on each field in the connection tuple. Unlike 'Match the correct destination port and leave client source port appropriately broad', 'Correct source/destination addresses, ports and protocol for actual packet direction' directly targets that requirement; its success must be confirmed at the authorized resource scope.

The nearby action 'Trace effective subnet and NIC security rules for the same five-tuple' is associated with this separate need: an NSG deny appears at the NIC even though the subnet allow exists. That is because a subnet allow cannot force a separately applicable NIC-level deny to permit traffic. Here an application security group name was added to an NSG rule but one backend NIC isn't a member, so 'Trace effective subnet and NIC security rules for the same five-tuple' misses the fact that nSGs match eligible NIC group membership, not merely a similarly named application tag. 'Correct the NIC's ASG association and verify rule scope' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Correct source/destination addresses, ports and protocol for actual packet direction' solves another task because NSG rule matching depends on each field in the connection tuple. For the situation where an application security group name was added to an NSG rule but one backend NIC isn't a member, this distractor misses the requirement that nSGs match eligible NIC group membership, not merely a similarly named application tag. Unlike 'Correct source/destination addresses, ports and protocol for actual packet direction', 'Correct the NIC's ASG association and verify rule scope' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When both subnet and NIC NSGs apply to a VM, the action 'Evaluate both applied NSGs and their combined allow/deny outcome' can be relevant: traffic must satisfy relevant security checks at each applicable network boundary. For the different problem of an application security group name was added to an NSG rule but one backend NIC isn't a member, 'Evaluate both applied NSGs and their combined allow/deny outcome' misses the mechanism that nSGs match eligible NIC group membership, not merely a similarly named application tag. Choosing 'Evaluate both applied NSGs and their combined allow/deny outcome' would address that other need, whereas 'Correct the NIC's ASG association and verify rule scope' is intended to solve the stated condition.

When a response packet is blocked according to a team that already allowed the original outbound TCP connection, the action 'Account for NSG stateful flow tracking for permitted connections' can be relevant: allowed established flows normally permit return traffic without a separate inverse rule. For the different problem of before deleting a suspicious NSG deny, the operator wants objective evidence of which rule blocks a test connection, 'Account for NSG stateful flow tracking for permitted connections' misses the mechanism that effective-rule tooling identifies matched rules; wholesale deletion is premature. Choosing 'Account for NSG stateful flow tracking for permitted connections' would address that other need, whereas 'Inspect effective security rules or Network Watcher IP flow verify' is intended to solve the stated condition.

Azure NSG rules are evaluated by priority among rules whose direction, addresses, protocol and port ranges match the packet. The lowest number is not proof of a block if the rule does not match the test flow. The operator needs objective evidence of the particular denying rule before changing a security control. Network Watcher IP flow verify and effective security-rule inspection can evaluate the real five-tuple and relevant subnet/NIC policy. A priority-only list can point to the wrong rule and encourage an unnecessary or unsafe deletion.

The nearby action 'Use a valid custom rule with higher evaluation priority and the correct tuple' is associated with this separate need: a new custom NSG allow should supersede a broad default deny. That is because built-in default rules apply only after more specific custom rules that match first. Here before deleting a suspicious NSG deny, the operator wants objective evidence of which rule blocks a test connection, so 'Use a valid custom rule with higher evaluation priority and the correct tuple' misses the fact that effective-rule tooling identifies matched rules; wholesale deletion is premature. 'Inspect effective security rules or Network Watcher IP flow verify' is the more defensible action; confirm its behavior in the target service before calling the task complete.