AZ-104 Implement and Manage Virtual Networking Practice Question
A team manages three backend servers in one subnet. The servers are replaced periodically, so their private IP addresses change. The NSG must allow inbound traffic from the web tier without updating individual IP addresses each time. Which destination object should be used in the NSG rule?
⚠ Common exam trap
It's easy for candidates to confuse Application Security Groups with Network Security Groups themselves, or mistakenly think Service Tags can be used to group their own VMs, when Service Tags are only for Azure platform services or well-known IP ranges.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Application security group
An Application Security Group (ASG) allows you to group backend servers logically, regardless of their private IP addresses, and reference that group as the destination in an NSG rule. When servers are replaced and their IPs change, the ASG membership is automatically updated, so the NSG rule continues to apply without manual intervention. This is the correct approach for dynamic workloads where IP addresses are not static.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Application security group
Why this is correct
An application security group lets you group VMs by application role rather than by fixed IP address. NSG rules can reference the ASG so the rule continues to work even when the VM IPs change.
- ✗
Service tag
Why it's wrong here
A service tag is a predefined, Microsoft-managed label representing a set of Azure service IP prefixes (e.g., AzureLoadBalancer, Storage, Sql) that updates automatically as ranges change. It cannot represent your own backend VMs because those are customer-managed resources with arbitrary private IPs, and service tags are not user-definable or assignable to a specific application tier. Using a service tag in an NSG rule would match Microsoft service traffic, not the traffic among your three backend application servers, so it fails to address the direct rule-targeting need.
When this WOULD be correct
A question asks to allow inbound traffic from Azure Load Balancer health probes to a subnet. Using the 'AzureLoadBalancer' service tag in the NSG rule would be correct, as it covers all probe source IPs without manual updates.
- ✗
Route table
Why it's wrong here
A route table (user-defined route) overrides Azure's default system routes by specifying next-hop behavior for traffic leaving a subnet or NIC, such as forcing traffic through a firewall or virtual appliance. It influences the path packets take, not whether they are permitted; NSG rules still need explicit source/destination constructs like IP ranges, service tags, or application security groups. A route table cannot be referenced in an NSG rule, so it is incapable of grouping the three backend servers into a reusable security rule target.
When this WOULD be correct
In a scenario where you need to force traffic from the web tier to the backend servers through a network virtual appliance (e.g., firewall) for inspection, a route table with a user-defined route (UDR) pointing to the appliance would be correct.
- ✗
Private endpoint
Why it's wrong here
A private endpoint creates a network interface with a private IP for a specific Azure PaaS resource (e.g., SQL Database, Storage) to bring that service into your virtual network. It does not act as a security grouping construct: NSG rules cannot reference a private endpoint as a source or destination for traffic between your own backend servers. Selecting it would attempt to solve a VNet-internal NSG rule target problem with a feature designed for private connectivity to managed services, leaving the requirement unsatisfied.
When this WOULD be correct
An exam question asks: 'You need to ensure that a storage account is accessible only from a specific virtual network without using a public endpoint. Which Azure feature should you use?' In that case, Private Endpoint is correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Application security groupCorrect answer▾
Why this is correct
An application security group lets you group VMs by application role rather than by fixed IP address. NSG rules can reference the ASG so the rule continues to work even when the VM IPs change.
✗Service tagWrong answer — click to see why▾
Why this is wrong here
Service tags represent groups of Azure service IP ranges (e.g., 'AzureLoadBalancer'), not dynamic private IPs of backend servers in a subnet. They cannot be used to group arbitrary VMs whose IPs change.
★ When this WOULD be the correct answer
A question asks to allow inbound traffic from Azure Load Balancer health probes to a subnet. Using the 'AzureLoadBalancer' service tag in the NSG rule would be correct, as it covers all probe source IPs without manual updates.
Why candidates choose this
Candidates may confuse service tags with application security groups, thinking both are used to group IPs dynamically, but service tags are for Azure services, not custom VM groupings.
✗Route tableWrong answer — click to see why▾
Why this is wrong here
Route tables control network traffic routing between subnets or to virtual appliances, not NSG rule destination objects for filtering traffic based on application groups.
★ When this WOULD be the correct answer
In a scenario where you need to force traffic from the web tier to the backend servers through a network virtual appliance (e.g., firewall) for inspection, a route table with a user-defined route (UDR) pointing to the appliance would be correct.
Why candidates choose this
Candidates may confuse route tables with NSGs because both are network security features in Azure, and they might think a route table can be used to define allowed traffic destinations.
✗Private endpointWrong answer — click to see why▾
Why this is wrong here
Private endpoints are used to securely access Azure PaaS services over a private IP address, not to group VMs for NSG rules. They do not provide a dynamic grouping mechanism for backend servers whose IPs change.
★ When this WOULD be the correct answer
An exam question asks: 'You need to ensure that a storage account is accessible only from a specific virtual network without using a public endpoint. Which Azure feature should you use?' In that case, Private Endpoint is correct.
Why candidates choose this
Candidates may confuse 'private' in Private Endpoint with 'private IP addresses' of the backend servers, mistakenly thinking it can be used to reference changing IPs, when it is actually for connecting to Azure services privately.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
NSG rule
An NSG rule is a set of security rules in Microsoft Azure that controls whether network traffic is allowed or denied to and from Azure resources.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.