AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Move the NSG to the web subnet so source membership is automatically detected.

  Why it's wrong here

  Moving the NSG to the web subnet will not fix the rule because NSG association determines where the network security policy is applied (subnet or NIC), but it does not change which NICs are members of the destination ASG. The source ASG membership for the web VMs is already known, yet the destination VMs still must be added to ASG-Api to be matched. Even if the NSG is associated to the web subnet, the destination scope of the rule remains defined by ASG-Api, and an empty ASG still means no traffic is permitted.

  When this WOULD be correct

  This would be correct if the NSG was applied to the web subnet instead of the web VM NIC, and the source ASG-Web membership was not being detected because the NSG was at the NIC level. Moving the NSG to the subnet allows it to evaluate traffic from all VMs in the subnet, including those in ASG-Web, without requiring NIC-level application.

• ✓

  Add the API VM NICs to ASG-Api.

  Why this is correct

  Adding the API VM NICs to ASG-Api is the correct fix because the NSG rule's destination object is that ASG, and Azure matches traffic by checking which NICs are currently members of that ASG. The rule only takes effect for traffic whose destination IP is on a NIC that belongs to ASG-Api; without those memberships, the rule's condition cannot be satisfied. Note that ASG membership is assigned at the NIC layer, so the VM's NIC must be explicitly associated with the ASG, independent of the NSG's association to the subnet or VM.

• ✗

  Change the destination port to 443 because ASGs only work with common HTTPS traffic.

  Why it's wrong here

  Changing the destination port to 443 is incorrect because application security groups are port-agnostic; they are simply a logical grouping of NICs that NSG rules can use as source or destination. The rule can freely allow TCP 8443 or any other port; ASGs do not restrict which ports are valid. The real problem is that the API VMs' NICs are not in ASG-Api, so the destination set is empty, and altering the port does nothing to populate that set or change how the rule is evaluated.

  When this WOULD be correct

  This would be correct if the question stated that the NSG rule was configured for HTTPS (TCP 443) but the application uses a custom port like 8443, and the administrator mistakenly thought ASGs only support common ports. In that scenario, updating the rule to the correct port would fix the issue.

• ✗

  Create a service endpoint for the spoke subnet so the NSG rule becomes effective.

  Why it's wrong here

  Creating a service endpoint for the spoke subnet is unrelated because service endpoints secure outbound traffic to Azure PaaS services (such as Storage, SQL, or Key Vault) by forcing that traffic through the Azure backbone, not by altering NSG rule processing or ASG membership. The rule at issue is for VM-to-VM TCP traffic between two application security groups; service endpoints do not enable or activate ASG-based rules. The only way to make this rule effective is to ensure the destination NICs are explicitly associated with ASG-Api.

  When this WOULD be correct

  A question where traffic to an Azure service (e.g., Azure SQL or Storage) from a subnet is failing, and enabling a service endpoint on that subnet allows the NSG rule to match traffic to the service's public IPs.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question