nerdexam
Microsoft

AZ-104 · Question #759

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might…

The correct answer is A. Yes. The Azure Network Security Group (NSG) configured on VM2 is preventing the connections from 131.107.100.50 on TCP port 443.

Submitted by klara.se· Mar 4, 2026Configure and manage virtual networking

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an Azure Load Balancer. The effective network security configurations for VM2 are shown in the following exhibit. You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail. You verify that the Load Balancer rules are configured correctly. You need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port 443. Solution: You create an inbound security rule that allows any traffic from the AzureLoadBalancer source and has a priority of 150. Does this meet the goal?

Exhibits

AZ-104 question #759 exhibit 1
AZ-104 question #759 exhibit 2

Options

  • AYes
  • BNo

How the community answered

(15 responses)
  • A
    60% (9)
  • B
    40% (6)

Why each option

The Azure Network Security Group (NSG) configured on VM2 is preventing the connections from 131.107.100.50 on TCP port 443.

AYesCorrect

Based on the effective network security configurations for VM2 (as would be shown in the exhibit), a Network Security Group (NSG) rule is configured with a higher priority to explicitly deny or implicitly block (due to lack of an allow rule) inbound traffic from 131.107.100.50 on TCP port 443 to VM2, causing the connection failure.

BNo

If the NSG was not preventing the connection, then either the Load Balancer or the application itself would be the cause of the failure, contradicting the observed connection issues when examining NSG rules.

Concept tested: Azure NSG rule evaluation

Source: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview#how-nsgs-filter-network-traffic

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-104 Practice