Microsoft AZ-104 Exam Dumps, Practice Test Questions

Azure subnet NSG association does not allow stacking arbitrary subnet NSGs to combine destination-port lists. An augmented rule supports multiple destination port values within a single rule.

The wildcard would allow a much wider port range than the approved list and defeat the intended least-privilege constraint.

ASGs identify groups of NICs. They do not represent TCP destination port sets or consolidate the required port selectors.

Public IP association does not modify NSG authorization. Standard IPs remain secure by default without a matching allow rule.

Outbound rules do not grant new inbound connections. Stateful return traffic applies only after a legitimately allowed initiating flow.

NSG security is directional and stateful. A default outbound rule does not authorize unsolicited inbound SSH from the Internet; the Standard public IP and NSG still require an explicit high-priority inbound permit rule if the service should be exposed.

Virtual Network Manager admin Allow is not equivalent to AlwaysAllow and does not force an NSG to accept the flow. Because the subnet NSG explicitly denies the connection, valid guest credentials cannot make that packet reach SSH. Diagnose the policy action before changing VM identities.

Security admin Deny rules evaluate before NSGs and stop the traffic without passing the packet to downstream NSG rules. Duplicating an NSG denial cannot explain or correct the difference between Allow and AlwaysAllow; it would simply reinforce the block.

AlwaysAllow is an Azure Virtual Network Manager security admin rule action, not an NSG default for stateful return packets. NSGs maintain state for permitted connections, but that functionality is separate from choosing whether a central admin rule permits subsequent NSG evaluation.

Probe packet authorization is decided by network rules and the probe endpoint, not an external alias record.

Azure NSGs evaluate matching rules by priority, with lower numbers evaluated first. An Allow placed below a matching Deny cannot restore probe connectivity; adjust the higher-priority deny or add an earlier supported allow for the health probe source and port.

NSG packet evaluation still matters for permitted health-probe traffic. An explicit deny can disrupt backend health assessment.

Defaults have lower priority than applicable custom rules. Otherwise administrators could not restrict outbound network traffic.

Inbound and outbound directions are evaluated separately. An inbound rule is not an outbound override.

Azure role grants manage resources but do not bypass packet filtering for the VM’s network flows.

The same NSG resource can be associated with multiple compatible subnets, so duplicating its rules into a separate resource per subnet is unnecessary. Standardization can use one reused NSG after checking the common policy fits both subnets.

Each subnet has one NSG association; you cannot stack a second subnet-level NSG onto the existing association. A NIC may have its own NSG as a separate layer, but that is not two subnet NSGs.

Resource group membership does not automatically apply an NSG's rules to contained subnet data-plane traffic. Security filtering requires the appropriate subnet or NIC association rather than tagging or placing an NSG in a resource group.

Augmented source IP prefixes can contain multiple supported literal CIDRs or IP addresses. They cannot accept an application security group resource ID as though it were a literal address prefix in the same field. ASG references and explicit IP ranges are different source selector types, so the attempted mixed-source definition still fails validation.

An asterisk in destination ports matches all ports; it would weaken the stated HTTPS-only policy and does not change the allowed data types in the Source field. Azure rejects the mixed ASG/CIDR source regardless of whether the destination is a single port or a wildcard. Fix the source-selector structure instead.

Azure service tags are predefined Microsoft-managed address-prefix sets, not arbitrary aliases an administrator can create from ASGs. Converting an application security group name into a custom service tag is not a supported workaround. Keep the actual ASG reference and literal partner prefix in their respective separate NSG rules.

NSG destination ports must describe supported protocol port numbers or ranges, not DNS names. Moving the hostname into a port selector does not add Layer 7 filtering capabilities.

NSG packet evaluation does not consult user-created DNS TXT records as destination criteria. The configuration remains unsupported and the SaaS domain is not automatically managed.

The protocol selector controls TCP, UDP and other protocols, not the accepted address selector grammar. An unsupported FQDN remains invalid regardless of protocol.

The VM's subnet prefix identifies workload addresses, not the Microsoft-managed public Storage endpoint ranges for a selected region. Using it as a destination would fail to match intended service traffic or accidentally permit different private workloads.

ASG membership is based on eligible Azure NIC configurations in a VNet; it isn't a container for all Microsoft Azure Storage service IPs in a geographic region. Inventing a group name cannot replace Azure's supported service-tag catalogue.

The global Storage tag is broader than the desired region-specific selector. Text in an NSG rule description does not change which destination addresses match the rule, so the requested narrowing would not occur.

The documentation specifically notes that established connections can remain after an NSG allow rule is removed. An NSG doesn't necessarily inject TCP resets into every existing flow as a rule-change side effect. Assuming instant termination could create a false sense of containment during an incident.

Rule removal does not create an indefinite grace period for new traffic. New SSH connection attempts are judged under the current effective NSG rules and can be denied immediately after the policy update. The difference is existing flow state versus a new flow, not a VM restart requirement.

DNS name resolution maps names to addresses; it doesn't own TCP flow-state records in Azure NSG filtering. The established session's behavior is explained by stateful connection tracking and current-rule evaluation for new sessions. Changing private DNS would not directly describe the observed NSG decision split.

The restriction is not a missing port permit. Microsoft does not support NSG association on the VPN gateway subnet, regardless of whether TCP 443 is added. The gateway requires its reserved GatewaySubnet and platform-managed flows; remove the unsupported association rather than trying to repair the NSG rules for that subnet.

Azure VPN Gateway deploys into a subnet named exactly GatewaySubnet; renaming that subnet removes a prerequisite rather than solving the unsupported NSG association. A differently named ordinary subnet is not a valid replacement gateway subnet. Keep the required reserved name and remove the unsupported network security group association.

An NSG is associated with a subnet or network interface, not attached to a Public IP resource as a substitute gateway firewall. Relocating the NSG to the gateway public IP does not remediate an unsupported GatewaySubnet association. Remove it from GatewaySubnet and apply other supported perimeter controls where appropriate.