AZ104-Q: explain a blocked VM connection
A VM’s subnet NSG allows inbound TCP 443. The VM still cannot receive HTTPS traffic. The NIC has another NSG that contains a higher-priority deny rule for TCP 443. What should the administrator inspect and change?
- A) Inspect effective security rules and remove/adjust the applicable higher-priority deny rule according to the intended policy. ✓
- B) Add a public IP to the VM.
- C) Increase the subnet address range.
- D) Create an Azure Policy assignment.
Answer: A. Effective rules combine the controls that apply to the NIC/subnet, and a matching higher-priority deny can block the flow despite a separate allow rule.
Why not the others: Public addressing, IP capacity, and Policy do not change effective NSG evaluation for this flow.