AZ-104 Implement and Manage Virtual Networking Practice Question
A team manages many application VMs and backend VMs. The VM IP addresses change whenever they are rebuilt, but the same traffic rule must always allow the app tier to reach the backend tier on TCP 8443. What should the administrator use in the NSG rule?
⚠ Common exam trap
It's easy for candidates to default to static IPs (Option A) for consistency, overlooking that ASGs provide a dynamic, IP-agnostic solution that directly addresses the rebuild scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Application Security Groups for the app and backend VMs.
Application Security Groups (ASGs) allow you to group VMs logically and reference them directly in NSG rules without relying on static IP addresses. Since the VM IPs change on rebuild, ASGs ensure the NSG rule for TCP 8443 always applies to the correct app and backend tiers, regardless of IP changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Static private IP addresses for each virtual machine.
Why it's wrong here
Assigning static private IP addresses would let you predefine NSG rules with exact IPs that survive a VM rebuild, but it forces your team to manually track and allocate each IP and to reconfigure rules whenever a VM is added, removed, or changed. It also creates a single point of human error when NICs are replaced, and it fails to group multiple VMs with the same function into a manageable policy object. Unlike ASGs, static IPs offer no abstraction layer for expressing tier-level connectivity.
When this WOULD be correct
If the question required a specific VM to always have the same IP for direct connectivity or DNS mapping, and the NSG rule could reference that single IP, then assigning a static private IP would be correct. For example, a database VM that must be reached by a fixed IP from on-premises.
- ✓
Application Security Groups for the app and backend VMs.
Why this is correct
Application Security Groups (ASGs) provide a logical network-security boundary: you associate each VM's NIC with an ASG representing its tier, then create NSG rules that reference those ASGs as source and destination. When a VM is rebuilt, its new private IP automatically remains in the same ASG, so the existing NSG rule stays valid without any IP-based rule edits. This removes the operational burden of tracking per-VM IPs while still enforcing controlled traffic between app and backend tiers.
- ✗
A user-defined route between the app and backend subnets.
Why it's wrong here
A user-defined route (UDR) is a routing-table entry that controls the next hop for traffic leaving a subnet, such as forcing it through a firewall or VPN gateway; it never evaluates or filters which application tier may talk to which other tier. Adding a UDR between app and backend subnets would only alter the network path taken by packets, not authorize or deny the communication, and it does not respond to VM IP changes. Effective tier-to-tier access control still requires NSG rules, ideally with ASGs as the source/destination.
When this WOULD be correct
A UDR would be correct if the question asked to force traffic between the app and backend subnets through a firewall or network virtual appliance (NVA) for inspection, or to override Azure's default routing to send traffic to a hub network.
- ✗
An availability set for each tier.
Why it's wrong here
An availability set only governs how physical hardware failures and patching events are distributed across replicas—it places VMs into separate fault and update domains to raise the availability SLA. It provides no networking identity or policy construct that can be referenced in an NSG rule, so it cannot specify which application tier is allowed to communicate with the backend tier. Even with VMs in an availability set, you still have to write explicit allow/deny rules based on IP addresses, CIDRs, or ASGs.
When this WOULD be correct
An availability set would be correct in a question about ensuring that VMs in a tier are placed on different physical hardware to avoid a single point of failure, such as: 'You need to guarantee that at least one VM in each tier remains available during planned maintenance. What should you configure?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Application Security Groups for the app and backend VMs.Correct answer▾
Why this is correct
Application Security Groups (ASGs) provide a logical network-security boundary: you associate each VM's NIC with an ASG representing its tier, then create NSG rules that reference those ASGs as source and destination. When a VM is rebuilt, its new private IP automatically remains in the same ASG, so the existing NSG rule stays valid without any IP-based rule edits. This removes the operational burden of tracking per-VM IPs while still enforcing controlled traffic between app and backend tiers.
✗Static private IP addresses for each virtual machine.Wrong answer — click to see why▾
Why this is wrong here
Static private IP addresses ensure IPs don't change, but they don't simplify NSG rule management when many VMs are involved; each VM would still need an individual rule or a separate NSG, making it less scalable than using Application Security Groups.
★ When this WOULD be the correct answer
If the question required a specific VM to always have the same IP for direct connectivity or DNS mapping, and the NSG rule could reference that single IP, then assigning a static private IP would be correct. For example, a database VM that must be reached by a fixed IP from on-premises.
Why candidates choose this
Candidates may think that fixing IP addresses will allow NSG rules to remain valid after VM rebuilds, overlooking that Application Security Groups provide a more dynamic and manageable solution for grouping VMs by function.
✗A user-defined route between the app and backend subnets.Wrong answer — click to see why▾
Why this is wrong here
User-defined routes (UDRs) control network traffic flow between subnets or to virtual appliances, not traffic filtering based on application tiers. The question requires allowing traffic on a specific port (TCP 8443) between dynamic IP groups, which is a job for NSG rules with Application Security Groups, not routing.
★ When this WOULD be the correct answer
A UDR would be correct if the question asked to force traffic between the app and backend subnets through a firewall or network virtual appliance (NVA) for inspection, or to override Azure's default routing to send traffic to a hub network.
Why candidates choose this
Candidates may confuse routing (UDR) with filtering (NSG), thinking that directing traffic between subnets inherently controls access, or they may overcomplicate the solution by assuming a route is needed when the default route already allows subnet-to-subnet communication.
✗An availability set for each tier.Wrong answer — click to see why▾
Why this is wrong here
An availability set ensures high availability by distributing VMs across fault domains, but it does not control network traffic rules or adapt to changing IP addresses. It cannot be used in an NSG rule to allow traffic based on VM membership.
★ When this WOULD be the correct answer
An availability set would be correct in a question about ensuring that VMs in a tier are placed on different physical hardware to avoid a single point of failure, such as: 'You need to guarantee that at least one VM in each tier remains available during planned maintenance. What should you configure?'
Why candidates choose this
Candidates may confuse availability sets with grouping mechanisms that can be referenced in NSG rules, or think that placing VMs in the same set somehow enables network filtering based on that grouping.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
TCP
TCP (Transmission Control Protocol) is a core internet protocol that ensures data is sent reliably and in order between devices over a network.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.