Backend VMs are rebuilt often and get new private IP addresses. Frontend VMs must reach them only on TCP 8443, and the rule should keep working after rebuilds. Which two actions should the administrator take? Select two.

Create a static route for the backend subnet to preserve the same IPs.

Routes do not make VM IP addresses static and do not solve the rebuild scenario.

Use a service endpoint between the two subnets.

Service endpoints are for PaaS access, not for permitting subnet-to-subnet application traffic.

Add a load balancer health probe rule on TCP 8443 only.

Health probes do not replace the need for an NSG rule that explicitly allows application traffic.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Place the backend NICs in an ASG named ASG-Backend. — Application security groups are ideal when VM IPs change frequently because the NSG rule can target workload groups rather than fixed addresses. By placing backend NICs in ASG-Backend and writing the NSG rule from ASG-Front to ASG-Backend on TCP 8443, the access control remains stable even after rebuilds. This is a common Azure administration pattern for dynamic application tiers. Why others are wrong: Static routes cannot preserve VM IP addresses, and service endpoints are for supported Azure services rather than VM-to-VM traffic. Health probes only help a load balancer detect availability; they do not authorize the connection. The reliable solution here is an ASG-based NSG rule tied to NIC membership.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.