AZ104-Q: NSG rule evaluation
Q: An NSG attached to a subnet has two rules of equal priority (100): Rule 1 denies traffic to port 443; Rule 2 allows traffic to port 443. Which applies?
- A) Rule 2 allows (it appears later)
- B) Rule 1 denies — equal-priority Deny wins / first matching rule at same priority is non-deterministic, so Deny is safest ✓
- C) Both — traffic is allowed
- D) The rule with the lower protocol number
Answer: B. NSG rules are evaluated in priority order (lower number = higher priority); at equal priority neither is guaranteed. More importantly, a subnet NSG applies to all interfaces, and when traffic matches a Deny rule at equal priority the behavior is to deny. In practice you avoid ties: use distinct priorities, and a Deny at higher priority wins over an Allow at lower priority. The exam wants: Deny rules take precedence / traffic is denied when a deny matches.
Why it helps
NSG evaluation: priority (lower = higher), default-deny at end, Deny beats Allow, subnet-level applies to all its NICs.