AZ-104 Question 220
Single answerYou have an Azure VM running a custom web service on TCP port 8080. The VM is in a subnet associated with an NSG that has a custom inbound rule at priority 300 allowing traffic from your on-premises IP range (10.0.1.0/24) to port 8080. However, on-premises clients are still unable to connect. After reviewing 'Effective security rules' for the subnet, you discover an existing rule at priority 200 that denies inbound traffic on port 8080 from any source. Which principle explains why on-premises clients cannot connect?
- A
The default NSG rule denies all inbound traffic.
- B
The NSG is not associated with the correct subnet.
- C
A deny rule with a higher priority blocks traffic before the allow rule.
- D
The custom allow rule uses an incorrect port range.
Show answer and explanation
Correct answer: C
Explanation
In Network Security Groups, rules are evaluated by priority, with lower numbers taking precedence over higher numbers. Even though you created a custom allow rule, the existing deny rule at a lower numerical priority (priority 200) will block the traffic first. Hence, the allow rule at priority 300 never takes effect.
- A. Incorrect.
While default NSG rules can block traffic by default, the scenario mentions a higher priority rule explicitly blocking port 8080.
- B. Incorrect.
If the NSG were not associated with the correct subnet, you would not see any effective rules applying to this VM's subnet. The question states otherwise.
- C. Correct.
A deny rule at a higher priority number (200) will override the allow rule at priority 300, causing inbound traffic on port 8080 to be blocked.
- D. Incorrect.
The scenario states the correct port (8080) is configured, so the port range is not the issue.