AZ-104 Implement and Manage Virtual Networking Practice Question
Backend VMs are rebuilt often and get new private IP addresses. Frontend VMs must reach them only on TCP 8443, and the rule should keep working after rebuilds. Which two actions should the administrator take? Select two.
⚠ Common exam trap
Candidates often confuse Application Security Groups with Network Security Groups (NSGs) or think that static routes or service endpoints can solve dynamic IP addressing, when in fact ASGs are the correct Azure feature for grouping VMs by function regardless of IP changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the backend NICs in an ASG named ASG-Backend.
An Application Security Group (ASG) allows you to group backend VMs by their NICs, regardless of their private IP addresses. When backend VMs are rebuilt and receive new IPs, the ASG membership remains intact, so NSG rules referencing the ASG continue to work without manual updates. This decouples security rules from dynamic IP addresses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Place the backend NICs in an ASG named ASG-Backend.
Why this is correct
Backend VMs are rebuilt, so their private IPs change; an NSG rule that references a fixed IP would stop matching after the rebuild. By placing the backend NICs in ASG-Backend, you make the security rule's destination logical rather than address-based. Azure dynamically resolves ASG membership whenever traffic is evaluated, so the rule continues to allow traffic to the rebuilt instance as long as its NIC is a member of the ASG.
- ✓
Create an NSG rule that allows TCP 8443 from ASG-Front to ASG-Backend.
Why this is correct
The NSG rule from ASG-Front to ASG-Backend on TCP 8443 is the explicit allow rule that authorizes the frontend tier to reach the backend application port. Since NSGs are stateful, this single inbound rule also permits the backend's return traffic without a separate outbound rule. Using ASGs on both sides keeps the rule unaffected by VM re-IPs and expresses the workload's role-to-role communication intent clearly.
- ✗
Create a static route for the backend subnet to preserve the same IPs.
Why it's wrong here
A static route controls the next-hop path for network traffic; it does not control DHCP-based private IP allocation. When a VM is rebuilt, Azure assigns a fresh dynamic private IP from the subnet unless the NIC itself is configured with a static private IP address. Adding a custom route on the backend subnet would only alter routing behavior, so it cannot preserve the rebuilt VM's IP and is irrelevant to avoiding IP-based NSG rules.
When this WOULD be correct
In a scenario where backend VMs use static private IPs (e.g., via NIC IP configuration) and the administrator needs to ensure traffic from frontend to backend follows a specific path (e.g., through a firewall), creating a static route for the backend subnet would be correct.
- ✗
Use a service endpoint between the two subnets.
Why it's wrong here
A service endpoint extends your virtual network identity to supported Azure PaaS services (e.g., Azure Storage, Azure SQL Database) and ensures traffic to those services stays on the Microsoft backbone. It is not a security rule or connectivity mechanism between two subnets within a VNet, and it cannot permit frontend-to-backend application traffic on TCP 8443. Therefore, using a service endpoint does not address the IP-churn problem or replace the need for an NSG allow rule.
When this WOULD be correct
An administrator needs to ensure that VMs in a subnet can securely access an Azure Storage account using the Azure backbone network instead of the public internet. In that case, enabling a service endpoint on the subnet and creating a private endpoint or service endpoint rule would be correct.
- ✗
Add a load balancer health probe rule on TCP 8443 only.
Why it's wrong here
A load balancer health probe on TCP 8443 is used solely to determine whether a backend instance is available to receive traffic; it does not participate in the data-path permission decision. The backend NSG still needs an explicit rule that allows the frontend's source IP or ASG to reach the backend on TCP 8443; otherwise, a healthy probe does not make application traffic pass. Probe responses are also subject to NSG rules, so a blocked probe can even cause the instance to be marked unhealthy.
When this WOULD be correct
In a scenario where a load balancer distributes traffic to backend VMs on TCP 8443 and you need to ensure only healthy VMs receive traffic, you would add a health probe rule on TCP 8443 to monitor backend health.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Place the backend NICs in an ASG named ASG-Backend.Correct answer▾
Why this is correct
Backend VMs are rebuilt, so their private IPs change; an NSG rule that references a fixed IP would stop matching after the rebuild. By placing the backend NICs in ASG-Backend, you make the security rule's destination logical rather than address-based. Azure dynamically resolves ASG membership whenever traffic is evaluated, so the rule continues to allow traffic to the rebuilt instance as long as its NIC is a member of the ASG.
✗Create a static route for the backend subnet to preserve the same IPs.Wrong answer — click to see why▾
Why this is wrong here
Static routes do not preserve private IP addresses; they control traffic routing. Private IPs are assigned dynamically by Azure DHCP, and a static route cannot prevent IP changes after VM rebuilds.
★ When this WOULD be the correct answer
In a scenario where backend VMs use static private IPs (e.g., via NIC IP configuration) and the administrator needs to ensure traffic from frontend to backend follows a specific path (e.g., through a firewall), creating a static route for the backend subnet would be correct.
Why candidates choose this
Candidates may confuse static routing with static IP assignment, thinking a static route can fix IP address changes, or they may incorrectly believe that routes can preserve IP addresses.
✗Use a service endpoint between the two subnets.Wrong answer — click to see why▾
Why this is wrong here
Service endpoints secure Azure service access (e.g., to Storage or SQL) from a virtual network, not traffic between VMs. They do not enable frontend VMs to reach backend VMs on TCP 8443.
★ When this WOULD be the correct answer
An administrator needs to ensure that VMs in a subnet can securely access an Azure Storage account using the Azure backbone network instead of the public internet. In that case, enabling a service endpoint on the subnet and creating a private endpoint or service endpoint rule would be correct.
Why candidates choose this
Candidates may confuse service endpoints with general network connectivity solutions, thinking they can route traffic between subnets, or they may misremember service endpoints as a way to preserve IP addresses or enable inter-VM communication.
✗Add a load balancer health probe rule on TCP 8443 only.Wrong answer — click to see why▾
Why this is wrong here
A load balancer health probe rule on TCP 8443 only checks backend health; it does not create a network rule to allow traffic from frontend to backend. The question requires a security rule (NSG) to permit traffic, not a health probe.
★ When this WOULD be the correct answer
In a scenario where a load balancer distributes traffic to backend VMs on TCP 8443 and you need to ensure only healthy VMs receive traffic, you would add a health probe rule on TCP 8443 to monitor backend health.
Why candidates choose this
Candidates may confuse health probes with network security rules, thinking that a health probe can also control traffic flow, or they may overcomplicate the solution by involving load balancing when only a simple NSG rule is needed.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Application Security Group
An Application Security Group (ASG) is a cloud networking feature that groups virtual machines logically and allows you to apply security rules based on the application workload, rather than individual IP addresses.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.