100% Latest & Updated Microsoft AZ-104 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 670
An engineer runs IP flow verify and gets an NSG allow result, but an application still times out connecting to a VM behind a gateway. What is the correct interpretation of that result?
- Run Network Watcher Next Hop for the destination and treat its selected route as proof that a successful TCP handshake occurred through the gateway
- Run NSG IP flow verify against the same five-tuple again and assume two Allow results prove the backend listener is reachable
- Treat the result as an NSG filtering finding, then test route, listener and downstream connectivity separately
- Declare the connection healthy because an NSG allow necessarily proves TCP handshake completion
Explanation
Correct Answer
C:An NSG allow only eliminates one security rule as the immediate block. It does not prove the target port is listening, the return route exists or every intervening component accepts the flow.
Incorrect Answers
A:Next Hop reveals route selection, not whether the gateway forwards correctly, the VM service is listening, or TCP completed. An NSG Allow and a valid route are only parts of end-to-end connectivity diagnosis.
B:IP flow verify evaluates NSG rule decisions and cannot establish whether the application listener accepts a TCP connection. An Allow finding should be followed with route, gateway, endpoint and transport testing.
D:NSG verification does not perform a complete end-to-end application exchange. Other failures can persist despite allowed security policy.
Question 671
An NSG attached to a subnet contains inbound Allow-TCP-443 priority 300 from a specific partner CIDR and inbound Deny-Any priority 200 for the same partner CIDR. No more specific higher-priority rule exists. What happens to matching HTTPS traffic?
- HTTPS is allowed because protocol-specific rules always outrank broader rules
- HTTPS is denied because the lower numeric priority 200 is evaluated first
- The NSG evaluates both and combines the outcomes as Allow
- The allow rule wins because the NSG is attached to a subnet rather than a NIC
Explanation
Correct Answer
B:Azure evaluates lower numeric priority rules before higher values. The partner HTTPS packet matches Deny-Any at 200 and is rejected without considering the later allow.
Incorrect Answers
A:NSG evaluation is primarily by numeric priority in ascending order, not by the narrowest application protocol. The deny at 200 wins before allow 300 can match.
C:NSGs use first matching rule behavior rather than merging allow and deny results. One earlier deny is sufficient to stop the packet.
D:NSG priority order is the same concept at subnet and network-interface scopes. Attachment scope does not make a lower-priority-number deny disappear.
Question 672
A VM network interface is associated with an NSG allowing inbound TCP 443 from a partner. Its subnet NSG explicitly denies inbound TCP 443 from that partner. The team expects the NIC allow rule to override the subnet rule. What is the correct effective outcome?
- The connection is allowed because NIC rules always take priority
- The connection is denied because traffic must be permitted by both associated NSGs
- Only the NIC-level NSG is evaluated for private IP traffic
- The two NSG rules are merged and the most specific Allow rule always wins
Explanation
Correct Answer
B:Inbound traffic is evaluated through the subnet NSG and then the NIC NSG where both exist. A denial at either applicable level blocks the connection regardless of a later allow elsewhere.
Incorrect Answers
A:A NIC-level allow cannot override a separate subnet-level deny. Multiple associated NSGs must independently permit the inbound flow for it to reach the VM.
C:Private IP traffic is still subject to an associated subnet NSG and NIC NSG. Skipping subnet evaluation would bypass a real deny policy.
D:Associated NSGs are evaluated at their own scopes. Azure does not merge them into one rule set where a narrower permit cancels a separate deny.
Question 673
An infrastructure template creates two inbound security rules in a single Azure NSG: AllowHttps with priority 200 and DenyAdmin with priority 200. Their destination ports do not overlap, yet Azure rejects the new rule. Which template adjustment satisfies the NSG control-plane requirement without changing the intended matches?
- Give each security rule a different valid numeric priority within that NSG, retaining its existing match and action fields.
- Keep the same priority and set the first rule protocol to TCP and the second to UDP.
- Make both rules source port 65535 because priority collisions occur only with wildcard ports.
- Set both priorities to 4097, which makes them reserved default rules that can coexist.
Explanation
Correct Answer
A:Azure NSG custom security-rule priorities are numeric values from 100 through 4096 and must be unique within the NSG rule collection. Assigning separate priorities, such as 200 and 210, resolves the deployment conflict without changing the two rules’ individual source, port, protocol or allow/deny intent.
Incorrect Answers
B:Azure does not accept duplicate rule priorities merely because protocols differ. Rule evaluation requires an unambiguous priority sequence, so TCP versus UDP is irrelevant to the control-plane uniqueness constraint.
C:The source port condition influences which packets would match an accepted NSG rule. It does not make duplicate priorities legal and setting a single arbitrary source port could improperly exclude most real client connections.
D:Custom NSG priority values are constrained to 100–4096; 4097 is outside that range. Default NSG rules are system-managed, not created by a custom rule with an invalid numeric priority.
Question 674
An administrator enables an outbound TCP connection from a VM subnet through an NSG. Responses return successfully even though there is no matching explicit inbound allow rule for the ephemeral response port. Which security behavior explains that?
- An implicit inbound allow for the VM's ephemeral response ports exists in every NSG even when no outbound flow was initiated
- NSGs are stateful and track permitted connections so return traffic is allowed
- All inbound traffic to Azure VMs is allowed automatically
- A user-defined route matching the remote server automatically creates the corresponding inbound NSG security rule
Explanation
Correct Answer
B:Stateful filtering recognizes response packets for already allowed flows. An independent reverse-direction rule for every ephemeral response port is not generally required.
Incorrect Answers
A:NSGs are not configured with a blanket inbound ephemeral-port allow. Return packets for an established, permitted outbound flow are handled by stateful connection tracking instead.
C:An NSG still denies new inbound flows according to its rules. Only established permitted connection state explains the narrow return-path behavior.
D:Routing selects the next hop; it does not create NSG inbound allows. The existing stateful flow record is what lets the permitted outbound connection's return packets through.
Question 675
A subnet NSG must permit outbound HTTPS to an approved Azure platform service whose published IP ranges change regularly. Maintaining thousands of addresses manually is risky. What NSG source or destination abstraction should the admin evaluate?
- The applicable Azure service tag for the target service when supported
- A fixed list of one currently observed backend IP address
- Use an application security group containing your VMs as the destination for the external Azure platform service
- Use the VirtualNetwork service tag as the outbound destination and assume it includes the approved Azure public service
Explanation
Correct Answer
A:Service tags represent managed groups of Azure service IP prefixes in NSG rules. Azure maintains the underlying prefixes, reducing manual updates and stale allowlists.
Incorrect Answers
B:Cloud service address ranges can change. Hardcoding one observed address risks outages or incomplete policy coverage.
C:An application security group groups Azure VM NICs for NSG rule evaluation. It does not represent the Azure platform service's changing published IP prefixes, so it cannot substitute for the service's supported service tag as the outbound destination.
D:The VirtualNetwork tag covers relevant virtual-network address spaces and routes, not a service-specific maintained set of public endpoint prefixes. It either misses the intended service or grants overly broad local reachability. Use the supported Azure service tag for that platform service.
Question 676
A VM has no custom NSG inbound deny for internal traffic. After a new VNet peering is established, a security analyst notices that traffic from the peer is now permitted by a default rule. What default-rule behavior should be reviewed?
- The AllowVnetInBound default rule and the VirtualNetwork service tag’s effective prefixes
- Assume AllowInternetInBound is the default rule that permits the peered VNet prefix
- Allow the same peered network only in a destination outbound rule and assume this explains the inbound packet
- Change subnet UDR 0.0.0.0/0 to Internet and assume it overrides the NSG verdict
Explanation
Correct Answer
A:The VirtualNetwork service tag can cover connected/peered network address spaces as routes are established. Without a higher-priority explicit restriction, its default inbound allow can permit peer traffic.
Incorrect Answers
B:The default inbound internet rule is not an unconditional AllowInternetInBound. The relevant match is the VirtualNetwork service tag in the default AllowVnetInBound rule.
C:Outbound rules apply to outbound sessions. The observed new inbound path must be understood through inbound rules and the expanded VirtualNetwork tag.
D:Routing controls the next hop; it does not make a denied inbound NSG packet allowed or explain why a default inbound rule matched after peering.
Question 677
An application subnet has an outbound NSG Allow for destination 10.60.1.4:443. A new inbound connection from 10.60.1.4 to the application’s port 443 is still denied. What distinction explains this?
- One outbound Allow automatically authorizes all new inbound sessions from that destination
- Increase the outbound rule priority above every inbound priority number
- Set source port 443 on the outbound rule because that matches the new inbound destination
- The outbound rule governs new outbound sessions, while a separately initiated inbound flow is matched against inbound rules
Explanation
Correct Answer
D:A connection initiated from 10.60.1.4 toward the app is not the return traffic of an allowed outbound session. It must satisfy a matching inbound rule and any other applicable controls.
Incorrect Answers
A:NSGs are stateful for replies to established connections, not for arbitrary new reverse-direction sessions. A separate inbound flow needs a matching inbound rule.
B:Inbound and outbound NSG rule sets evaluate separately. Changing outbound priority cannot authorize a separately initiated inbound connection.
C:Source and destination port fields match different ends of a flow. Modifying an outbound rule does not make an unsolicited inbound session a reply to an established connection.
Question 678
An application VM needs to accept TLS traffic on TCP 443 from authorized clients. An NSG rule specifies source port 443 and destination port 443; most client connections are rejected. Which field is too narrow?
- Destination port should be replaced by every possible port
- Destination protocol must be UDP instead of TCP
- Source port should allow the clients’ ephemeral ports, typically via wildcard
- Configure an inbound rule with destination port set to wildcard and source port fixed to 443
Explanation
Correct Answer
C:Clients usually initiate TCP sessions from ephemeral source ports rather than 443. The rule should constrain destination port 443 and trusted source addresses, without incorrectly requiring client source port 443.
Incorrect Answers
A:The server listens on 443, so destination port 443 is appropriately narrow. Opening all destination ports would enlarge the attack surface.
B:Typical HTTPS over TCP uses TCP 443 in this scenario. Changing protocol to UDP would not solve the server’s TCP listener traffic.
D:This makes the server’s accepted destination too broad while still expecting clients to originate on 443. The source/destination port constraints remain reversed.
Question 679
A monitoring design created new NSG flow logs for each application subnet. The team learns that NSG flow logs are retiring and new creation is unsupported. Which supported traffic logging direction should the administrator evaluate?
- Turn on NSG diagnostics and assume its one-time verdict produces continuous historical flow telemetry
- Use Azure virtual network flow logs with an appropriate storage and analytics design
- Continue to create new NSG flow log resources despite the creation retirement notice
- Use Network Watcher next hop reports as the complete historical record of every packet
Explanation
Correct Answer
B:Virtual network flow logs provide supported network flow telemetry as NSG flow logs retire. The team should plan collection, retention, access and any Traffic Analytics integration explicitly.
Incorrect Answers
A:NSG diagnostics can explain a tested packet’s allow/deny rule but does not replace the ongoing flow logging capability being retired.
C:A deprecating/retired creation path is not a durable telemetry architecture. The service transition calls for migrating flow collection to a supported capability.
D:A next-hop test explains a route decision for a specified destination; it is not a persistent network flow log across a subnet.
Question 680
An NSG rule set currently contains one inbound rule per ten HTTPS destination ports and is nearing rule-management complexity limits. The security team wants one rule that matches several explicitly approved destination ports while keeping the same source IP scope. Which NSG feature can reduce rule sprawl?
- Create separate NSGs containing each approved port and attach all of them to the same subnet to merge their rules
- Use augmented NSG security rule syntax with multiple supported destination ports
- Set destination ports to * and assume all unlisted ports remain denied
- Use an Application Security Group as a substitute for a list of destination ports
Explanation
Correct Answer
B:Augmented rules support multiple service ports or port ranges in a rule. This consolidates equivalent decisions without granting ports outside the explicitly approved set.
Incorrect Answers
A:Azure subnet NSG association does not allow stacking arbitrary subnet NSGs to combine destination-port lists. An augmented rule supports multiple destination port values within a single rule.
C:The wildcard would allow a much wider port range than the approved list and defeat the intended least-privilege constraint.
D:ASGs identify groups of NICs. They do not represent TCP destination port sets or consolidate the required port selectors.
Microsoft Azure Administrator (AZ-104) Practice Tests
