AZ-104 Implement and Manage Virtual Networking Practice Question
Backend virtual machines are rebuilt frequently and often receive different private IP addresses. An administrator must allow the frontend tier to reach the backend tier on TCP 8443 without editing NSG rules every time the backend IP changes. What should the administrator use in the NSG rule?
⚠ Common exam trap
A common mix-up: candidates confuse Application Security Groups (logical grouping for NSG rules) with User-Defined Routes (path control) or Private Endpoints (PaaS connectivity), leading them to pick a routing or endpoint solution instead of the correct security-grouping mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An Application Security Group that contains the backend VMs.
An Application Security Group (ASG) allows you to group backend VMs logically and reference that group in a Network Security Group (NSG) rule. When backend VMs are rebuilt and receive new private IPs, you simply add the new VMs to the same ASG, and the existing NSG rule (which references the ASG as the destination) automatically applies to the new IPs without any manual rule edits. This decouples security policy from dynamic IP addresses, making it the ideal solution for frequently changing backend IPs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A static private IP address for each backend VM.
Why it's wrong here
Static private IP addresses ensure the backend VMs keep stable addresses, but an NSG rule that references individual IPs still requires one rule per VM, or a range that may be brittle as the tier grows or shrinks. When backend VMs are rebuilt frequently, their NICs might be recreated, and even with static IPs you must track and manage address assignments manually. Static IPs do not group VMs logically or reduce rule maintenance; they only avoid DHCP changes, while an ASG provides a role-based target that stays constant regardless of IP changes.
When this WOULD be correct
If the question required a specific VM to always have the same IP for compliance or monitoring purposes, and the administrator was willing to manage IP assignments manually, a static private IP would be correct.
- ✓
An Application Security Group that contains the backend VMs.
Why this is correct
Application Security Groups let the administrator group backend VMs logically and reference that group in NSG rules instead of individual IP addresses. This is ideal when backend IPs change or VMs are replaced. The NSG rule remains stable while the backend membership changes, which reduces operational overhead and improves consistency.
- ✗
A user-defined route pointing frontend traffic to the backend subnet.
Why it's wrong here
A user-defined route (UDR) controls the next hop for packets, not which traffic is permitted or denied. Pointing frontend traffic to the backend subnet would simply change the forwarding path and could even break asymmetric routing, but it does not create an authorization boundary. NSG rules require a source, destination, and port scope; a UDR cannot reference a logical group of backend VMs, so it is fundamentally the wrong mechanism for replacing ASG-based targeting.
When this WOULD be correct
A user-defined route would be correct in a scenario where you need to force-tunnel traffic from the frontend subnet to a network virtual appliance (NVA) for inspection, or to route traffic to a different next hop (e.g., to a hub network) instead of the default Azure routing.
- ✗
A private endpoint for the backend tier.
Why it's wrong here
A private endpoint is a PaaS construct that exposes an Azure service (such as Storage or SQL Database) over a private IP address inside a virtual network; it is not a grouping mechanism for IaaS VMs. You cannot attach a private endpoint to a subnet as a source or destination in an NSG rule to represent a workload tier. Concepts like private endpoints are relevant for network-level isolation of Azure services, not for authorizing traffic to a set of backend VMs, so using one here is a category error.
When this WOULD be correct
An administrator needs to allow a frontend VM to access an Azure SQL Database privately, without exposing it to the public internet, and the database's private IP should remain static. Using a private endpoint for the database would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓An Application Security Group that contains the backend VMs.Correct answer▾
Why this is correct
Application Security Groups let the administrator group backend VMs logically and reference that group in NSG rules instead of individual IP addresses. This is ideal when backend IPs change or VMs are replaced. The NSG rule remains stable while the backend membership changes, which reduces operational overhead and improves consistency.
✗A static private IP address for each backend VM.Wrong answer — click to see why▾
Why this is wrong here
Static private IP addresses would require manual updates to NSG rules whenever a VM is rebuilt and gets a new IP, which contradicts the requirement to avoid editing NSG rules frequently.
★ When this WOULD be the correct answer
If the question required a specific VM to always have the same IP for compliance or monitoring purposes, and the administrator was willing to manage IP assignments manually, a static private IP would be correct.
Why candidates choose this
Candidates may think static IPs provide a fixed target for NSG rules, overlooking the operational overhead of reassigning IPs after VM rebuilds.
✗A user-defined route pointing frontend traffic to the backend subnet.Wrong answer — click to see why▾
Why this is wrong here
A user-defined route (UDR) controls traffic routing at the network layer, not security filtering. It cannot replace NSG rules to allow or deny traffic based on dynamic IP addresses; NSG rules still need to permit traffic, and UDRs do not provide dynamic membership like ASGs.
★ When this WOULD be the correct answer
A user-defined route would be correct in a scenario where you need to force-tunnel traffic from the frontend subnet to a network virtual appliance (NVA) for inspection, or to route traffic to a different next hop (e.g., to a hub network) instead of the default Azure routing.
Why candidates choose this
Candidates may confuse routing (UDR) with security filtering (NSG), thinking that directing traffic to the backend subnet automatically allows it, or they may believe that UDRs can dynamically adapt to IP changes, which they cannot.
✗A private endpoint for the backend tier.Wrong answer — click to see why▾
Why this is wrong here
A private endpoint is used to securely access Azure PaaS services over a private IP, not to allow frontend VMs to reach backend VMs on a specific port without editing NSG rules when backend IPs change.
★ When this WOULD be the correct answer
An administrator needs to allow a frontend VM to access an Azure SQL Database privately, without exposing it to the public internet, and the database's private IP should remain static. Using a private endpoint for the database would be correct.
Why candidates choose this
Candidates may confuse private endpoints with a way to provide static IPs for dynamic VMs, or think that a private endpoint can group VMs and simplify NSG rules, but it is designed for PaaS services, not VM-to-VM traffic.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Network Security Group
A Network Security Group is a set of rules that controls inbound and outbound traffic to Azure resources like virtual machines and subnets.
Key term
Security group
A security group is a virtual firewall that controls inbound and outbound traffic to AWS resources, such as EC2 instances, based on defined rules.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.