AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use the individual private IP addresses of each backend VM as the source.

  Why it's wrong here

  This rule gets the direction wrong: the inbound NSG rule on the backend subnet must identify the frontend VMs as the source, not the backend VMs. Using the backend IPs as the source would permit traffic from the backend VMs to themselves, failing to restrict access to the frontend tier. Even if the IPs were correct, hard-coding individual private IP addresses makes the rule brittle—when a VM is replaced or reimaged and its IP changes, the rule breaks until manually updated.

  When this WOULD be correct

  This option would be correct if the question required restricting traffic to specific, static backend VMs and did not require the rule to adapt to IP changes, such as in a scenario with fixed IP assignments.

• ✓

  Use an application security group for the frontend tier as the source and another ASG for the backend tier as the destination.

  Why this is correct

  Application security groups let you reference groups of NICs instead of hard-coded IP addresses. That makes the NSG rule resilient when VMs are replaced or reimaged and their private IP addresses change. It also keeps the access model aligned to application tiers rather than infrastructure details, which is the preferred design for maintainable network security rules.

• ✗

  Use the VirtualNetwork service tag for both source and destination.

  Why it's wrong here

  The VirtualNetwork service tag represents all IP address space within the virtual network, including peered networks, and is far too broad for this requirement. Using it for both source and destination would allow any VM or resource in the virtual network to reach the backend, not just the frontend tier. Application security groups are the correct choice because they specifically reference the NICs of the frontend and backend tiers, providing a precise and maintainable security boundary.

  When this WOULD be correct

  When the question requires allowing traffic from any resource within the same virtual network to the backend VMs, without needing to restrict to a specific frontend tier, and IP addresses may change.

• ✗

  Create a route table entry that sends TCP 8443 traffic to the backend subnet.

  Why it's wrong here

  A route table entry controls the next hop for network traffic, not whether traffic is permitted. Route tables do not filter on TCP ports or protocols and cannot deny or allow traffic based on application-layer criteria like port 8443. To secure inbound access to the backend subnet, you need a network security group rule, not a route table entry.

  When this WOULD be correct

  A question where traffic must be forced through a network virtual appliance (NVA) for inspection, e.g., 'You need to ensure all traffic from the frontend to the backend subnet goes through a firewall VM.' Then a route table entry with next hop set to the NVA's IP would be correct.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question