A backend tier runs on three Azure VMs. The VMs are rebuilt frequently and receive new private IP addresses during redeployment. The administrator must allow inbound TCP 1433 from the app tier without rewriting the NSG rule each time the backend VMs change. What should be used?

Individual private IP addresses assigned directly in the NSG rule

This works only while the IP addresses stay the same, which does not fit frequent VM rebuilds.

A service endpoint enabled on the subnet

Service endpoints are for secure access to supported Azure services, not for grouping VMs in NSG rules.

A load balancer inbound NAT rule on port 1433

Inbound NAT rules publish access to individual VMs through a load balancer, but they do not simplify NSG targeting for a backend tier.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: An application security group referenced by the NSG rule — Application security groups are designed for this exact problem: dynamic VM membership with stable NSG logic. Instead of binding rules to static IP addresses, the administrator targets the ASG that represents the backend tier. As VMs are replaced or reimaged, the NSG rule remains valid because the NICs can be reassigned to the same logical group without changing the security rule itself. Why others are wrong: Individual IP addresses create fragile rules because redeployed VMs often receive different addresses. A service endpoint is unrelated to VM-to-VM access control and does not solve rule maintenance. A load balancer NAT rule is for publishing access to specific VMs, not for simplifying security-group targeting across a tier.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.