AZ104-Q: diagnose an unexpected NSG block
A VM NIC NSG allows TCP 443, but the application remains unreachable. What should the administrator inspect next?
- A) Only the VM’s resource tags.
- B) Effective security rules, including any subnet NSG and higher-priority deny rule. ✓
- C) The storage account access tier.
- D) The App Service deployment slot. Answer: B. Traffic must pass all applicable security rules; effective rules reveal the evaluated result. Why not the others: Tags, storage, and slots do not diagnose NIC/subnet traffic filtering.