An NSG has rule priority 100 allowing HTTPS inbound and priority 200 denying all inbound. What traffic reaches the associated subnet?
A.All traffic — allow rules always win
Order matters — allow doesn't globally override deny.
B.Only HTTPS — rules are evaluated lowest-priority-number first
Lowest number evaluated first, first match wins. Correct.
C.Nothing — deny all blocks everything
The 100-priority allow matches HTTPS before the deny is reached.
D.Traffic randomly load-balanced between rules
Rules are deterministic, not load-balanced.
Why this answer
NSG rules process in ascending priority order (lower number = higher precedence); first match wins, evaluation stops. Priority 100 allow hits before 200 deny. NSGs are stateful — return traffic is automatically allowed.
Correct answer: B · Last reviewed 2026-02-14
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Virtual Networking practice session.
Practice Virtual Networking