Microsoft Azure Administrator Associate AZ-104 Practice Question

To allow inbound traffic on port 8080 from the internet, add an inbound security rule to the Network Security Group (NSG) associated with the VM's network interface or subnet. The rule should allow TCP traffic from any source to destination port 8080. An operating-system firewall change is not sufficient because an NSG blocks traffic before it reaches the guest OS. Associating a public IP address only provides an external endpoint; it does not open any ports. Moving the VM to another subnet would work only if that subnet's NSG already includes the necessary rule, which is an indirect and potentially disruptive approach.