AZ-104 Implement and Manage Virtual Networking Practice Question
A three-tier application uses separate web and app VMs that are scaled in and out regularly. The administrator must allow only the web tier to connect to the app tier on TCP 8080 without continually updating IP addresses. What should be configured in the NSG rule?
⚠ Common exam trap
Many candidates confuse network-level controls (like UDRs or VNet peering) with application-layer access control, or they incorrectly assume that a load balancer rule can replace a security rule for source-based filtering.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use application security groups for the web and app tiers and reference those groups in the NSG rule.
Application security groups (ASGs) allow you to group VMs logically by their application role (e.g., web tier, app tier) and reference those groups directly in NSG rules. This eliminates the need to maintain individual IP addresses or CIDR ranges when VMs scale in or out, because the NSG rule dynamically applies to all VMs in the ASG. By creating an inbound NSG rule that allows TCP 8080 from the web-tier ASG to the app-tier ASG, the administrator achieves the required connectivity without manual IP updates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use application security groups for the web and app tiers and reference those groups in the NSG rule.
Why this is correct
Application security groups let the administrator group VMs by role rather than by IP address. The NSG rule can then allow traffic from the web ASG to the app ASG on TCP 8080. This is a good fit for environments that scale or change frequently because the NSG does not need constant editing whenever VM addresses change.
- ✗
Add a subnet-to-subnet peering connection between the web and app subnets.
Why it's wrong here
Subnet-to-subnet peering is not a valid construct: VNet peering connects entire virtual networks, whereas subnets inside the same VNet already have built-in routing to one another. This option only establishes or relies on connectivity; it does not restrict which sources can reach the app tier on TCP 8080. Without NSG rules (or a network virtual appliance) that evaluate source and destination identities, traffic between the web and app subnets remains open to other workloads and a malicious VM. Thus it does not meet the security requirement.
When this WOULD be correct
This option could be correct if the question asked: 'How to enable communication between two virtual networks in different regions without using a gateway?' In that case, VNet peering (often mistakenly called subnet peering) would be the answer.
- ✗
Create a load balancer backend pool rule for TCP 8080.
Why it's wrong here
A load balancer backend pool rule defines how traffic arriving at a frontend IP and port is distributed to backend VM instances, typically for inbound client traffic. It does not inspect whether the source of an east-west request from the web tier is authorized to call the app tier on TCP 8080; it simply forwards or load-balances based on the destination mapping. Backend pool membership controls which endpoints receive that traffic, not which source roles may communicate, so anyone who can reach the load balancer frontend could still access the app service. Therefore, this is a traffic distribution mechanism, not a security control for inter-tier access.
When this WOULD be correct
This option would be correct in a scenario where the goal is to distribute incoming TCP 8080 traffic from the internet or a frontend to a set of backend VMs, and the question asks for a load balancing solution without specifying source IP constraints.
- ✗
Use a user-defined route that sends TCP 8080 traffic to the app tier.
Why it's wrong here
A user-defined route overrides Azure's default routing by specifying a next hop for traffic destined to a particular IP address prefix, and it cannot match on TCP port 8080 because route tables only contain address prefixes and next-hop types. Even if the web tier's traffic were forced toward the app subnet or an appliance, the route would affect forwarding for all traffic with that destination prefix, not selectively permit the app's port. UDRs are a routing mechanism, not an access-control list, and they provide no source-based authorization to block or allow web-to-app communication. This approach neither filters by port nor enforces the required allow-list.
When this WOULD be correct
A question where traffic must be forced through a network virtual appliance (e.g., firewall) for inspection before reaching the app tier. For example: 'You need to ensure all traffic from web to app tier passes through a firewall. What should you configure?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use application security groups for the web and app tiers and reference those groups in the NSG rule.Correct answer▾
Why this is correct
Application security groups let the administrator group VMs by role rather than by IP address. The NSG rule can then allow traffic from the web ASG to the app ASG on TCP 8080. This is a good fit for environments that scale or change frequently because the NSG does not need constant editing whenever VM addresses change.
✗Add a subnet-to-subnet peering connection between the web and app subnets.Wrong answer — click to see why▾
Why this is wrong here
Subnet-to-subnet peering is not a valid Azure construct; VNet peering connects entire virtual networks, not subnets. Additionally, peering does not filter traffic by port or protocol, so it would not restrict connections to TCP 8080.
★ When this WOULD be the correct answer
This option could be correct if the question asked: 'How to enable communication between two virtual networks in different regions without using a gateway?' In that case, VNet peering (often mistakenly called subnet peering) would be the answer.
Why candidates choose this
Candidates may confuse subnet-to-subnet peering with VNet peering, assuming it provides a direct, secure connection between subnets without needing IP updates, and overlook that NSGs are required for port-specific filtering.
✗Create a load balancer backend pool rule for TCP 8080.Wrong answer — click to see why▾
Why this is wrong here
A load balancer backend pool rule distributes incoming traffic to backend VMs, but it does not restrict which source tier can connect. It also does not solve the problem of dynamically updating IP addresses for scaled VMs.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the goal is to distribute incoming TCP 8080 traffic from the internet or a frontend to a set of backend VMs, and the question asks for a load balancing solution without specifying source IP constraints.
Why candidates choose this
Candidates may think a load balancer can control access between tiers, confusing its traffic distribution function with security filtering, or they may assume it can replace NSG rules for inter-tier communication.
✗Use a user-defined route that sends TCP 8080 traffic to the app tier.Wrong answer — click to see why▾
Why this is wrong here
User-defined routes (UDRs) control traffic routing between subnets or to virtual appliances, not access control. They cannot filter traffic by port or application; NSG rules are required to allow or deny traffic based on port and protocol.
★ When this WOULD be the correct answer
A question where traffic must be forced through a network virtual appliance (e.g., firewall) for inspection before reaching the app tier. For example: 'You need to ensure all traffic from web to app tier passes through a firewall. What should you configure?'
Why candidates choose this
Candidates may confuse routing with access control, thinking that directing traffic via UDRs can also restrict which sources can connect, or they may believe UDRs can filter traffic based on port.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.