A team manages three backend servers in one subnet. The servers are replaced periodically, so their private IP addresses change. The NSG must allow inbound traffic from the web tier without updating individual IP addresses each time. Which destination object should be used in the NSG rule?

Service tag

Service tags represent Microsoft-managed address ranges for Azure services, not your own backend VMs. They are not the right way to group private application servers.

Route table

A route table controls traffic forwarding, not NSG rule targeting. It cannot replace the need for a security grouping object in the rule.

Private endpoint

Private endpoints are for private access to supported PaaS services, not for grouping compute instances into a security target in NSG rules.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Application security group — Application security groups are designed to simplify NSG management for workloads whose IP addresses can change. Instead of hardcoding individual VM addresses, you place the backend VMs into an ASG and reference that group in the NSG rule. This keeps the security rule aligned with the application role, which is far easier to maintain in dynamic environments such as scale sets or frequently rebuilt servers. Why others are wrong: Service tags apply to Microsoft-owned service IP ranges and do not represent your backend server group. Route tables affect packet forwarding, not security rule membership. Private endpoints are unrelated to VM-to-VM traffic grouping and do not solve the IP churn problem described in the scenario.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.