Microsoft AZ-104 Exam Dumps, Practice Test Questions

The restriction is not a missing port permit. Microsoft does not support NSG association on the VPN gateway subnet, regardless of whether TCP 443 is added. The gateway requires its reserved GatewaySubnet and platform-managed flows; remove the unsupported association rather than trying to repair the NSG rules for that subnet.

Azure VPN Gateway deploys into a subnet named exactly GatewaySubnet; renaming that subnet removes a prerequisite rather than solving the unsupported NSG association. A differently named ordinary subnet is not a valid replacement gateway subnet. Keep the required reserved name and remove the unsupported network security group association.

An NSG is associated with a subnet or network interface, not attached to a Public IP resource as a substitute gateway firewall. Relocating the NSG to the gateway public IP does not remediate an unsupported GatewaySubnet association. Remove it from GatewaySubnet and apply other supported perimeter controls where appropriate.

The default rule remains a platform-managed rule regardless of the current VM or NIC count. Removing network resources would disrupt allowed workloads and would not be a supported way to delete or customize Azure NSG defaults.

Default security rules are not editable or removable by a custom rule priority change. Lower numeric values have higher processing precedence, but operators must express that precedence through separate custom rules rather than modifying a system-created default.

NSGs match network addresses, service tags, ASGs and ports; they do not accept an arbitrary DNS suffix as a replacement for a built-in default rule. A DNS filter would not be a supported NSG override and could fail to identify the intended source/destination addresses.

The existing listener allow on 443 enables client HTTPS, not the separate GatewayManager control-plane port range needed for public Standard_v2 gateways without Network Isolation. Adding more listener allowances does not remediate the deployment error. Permit the documented GatewayManager service tag on inbound TCP 65200–65535 while retaining appropriately scoped listener rules.

GatewaySubnet is reserved for VPN or virtual-network gateways, not an Application Gateway v2 deployment. Application Gateway has its own dedicated subnet and associated inbound management rules. Relocating it to GatewaySubnet would violate the deployment topology and would not solve the specific inbound GatewayManager denial in its NSG.

An outbound RDP rule on TCP 3389 cannot admit inbound Azure platform GatewayManager connections on TCP 65200–65535. RDP is not the Application Gateway v2 infrastructure management protocol for this failure. The NSG must allow the documented inbound control-plane traffic from its designated service tag.

Broadening the NSG opens unrelated traffic but leaves the Windows Defender Firewall rule that actually rejects the probe in place. The trace already demonstrates network-layer delivery to the guest. A public Internet allow would add exposure without fixing the host-layer block.

Public versus internal frontend selection changes client exposure, not the Azure health-probe source or how the guest firewall evaluates inbound packets. Replacing the frontend does not resolve the observed host firewall rejection.

NSG rule priority is evaluated by Azure networking before delivery to the VM. Once packet capture proves a probe reaches the guest, further NSG priority changes cannot override the separate Windows Defender Firewall rule that rejects the incoming connection.

The initial partner-initiated connection is inbound to the protected workload. Outbound replies are tracked as part of the permitted connection.

Custom partner names are not automatically NSG service tags. A valid source CIDR or supported selector is needed for this tightly scoped partner rule.

Priority changes cannot fix a five-tuple that does not match the intended inbound packet. The endpoints remain reversed.

A static list of instance addresses requires continual maintenance and may become wrong as autoscaling adds or removes VMs. It does not meet the operational requirement.

Azure service tags represent documented Azure services and do not create arbitrary dynamic membership for an organization’s web-tier NICs. An ASG is the intended grouping.

VirtualNetwork covers far more than the web tier, so the database would accept requests from unrelated subnets. It violates the required application-role isolation.

Resource-group placement does not attach an NSG to a traffic path. ASGs group NIC IP configurations, but their membership alone does not apply security rules to packets; the NSG must be associated with the relevant subnet or NIC.

A second ASG merely adds a logical interface grouping. It cannot activate a security rule in an NSG that has not been associated with the database NIC's subnet or the NIC itself.

Network Contributor is a management-plane role and granting it to a workload identity is not a substitute for a network security group association. ASG membership plus an unassociated NSG does not filter data-plane traffic.

Microsoft Entra security groups manage principals and access, whereas ASG-based NSG matching operates on NIC membership. Similar names do not link the two group types.

A broader subnet rule might permit network traffic, but it does not repair the intended ASG-targeted policy and could authorize unintended machines in the same subnet.

Entra display names are not used by ASG matching and cannot substitute for NIC-level application grouping.

ASG scope is not universally subscription-wide for NICs. Attempting to include other-VNet interfaces violates the resource constraint.

ASG selectors are tied to NIC IP configurations, not just arbitrary Azure IDs without packet classification.

Peering permits supported connectivity and NSG rules control flows, but neither redefines the Azure ASG resource membership constraint. Each ASG must still contain interfaces from one virtual network. Use separate groups and explicitly scoped network rules for a cross-VNet design.

A global allow discards segmentation and exposes database traffic to web and other workloads beyond the required tier relationships.

RBAC Reader controls management visibility, not the NSG traffic permissions between application tiers.

The broad VNet service tag can include unrelated subnets or peers. It does not restrict SQL callers to the API application group.

Azure ASG membership is not limited to a single group per network interface. Splitting the workload into public IP addresses would also introduce unnecessary exposure and not solve role-based NSG selection appropriately.

ASG member NICs must satisfy same-VNet membership constraints; placing the two groups in different VNets is not how a single interface gains multiple application roles. VNet peering also does not change its actual network membership.

ASG membership belongs to network-interface IP configurations, not to a resource group abstraction. A resource group can hold many unrelated resources and is not a selector for traffic at a specific NIC IP.