The answer is to add api01’s NIC to ASG-Api. This is correct because an Application Security Group membership directly defines which network interfaces are included as a source or destination in an NSG rule; the exhibit shows the rule permits traffic from ASG-Web to ASG-Api, so even though web01 belongs to ASG-Web, the destination api01 will only match the rule if its NIC is a member of ASG-Api. On the AZ-104 exam, this tests your understanding that ASGs abstract IP addresses into logical groups, and a common trap is assuming any VM in the same subnet is automatically covered—membership must be explicitly assigned to the NIC. Remember the memory tip: “ASG membership is NIC-deep, not subnet-wide.”
AZ-104 Implement and Manage Virtual Networking Practice Question
This AZ-104 practice question tests your understanding of implement and manage virtual networking. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
NSG rule on ApiSubnet:
Priority 200 Allow-WebToApi Source: ASG-Web Destination: ASG-Api Protocol: TCP Port: 8443
Priority 300 Deny-All-Other Source: Any Destination: Any Protocol: Any Port: *
VM inventory:
web01 NIC: Member of ASG-Web
api01 NIC: Not a member of ASG-Api
Symptom: TCP 8443 connections from web01 to api01 are denied.
Based on the exhibit, web servers can reach a backend VM only after it is added to a specific group. What should the administrator change to allow the traffic to match the existing NSG rule?
NSG rule on ApiSubnet:
Priority 200 Allow-WebToApi Source: ASG-Web Destination: ASG-Api Protocol: TCP Port: 8443
Priority 300 Deny-All-Other Source: Any Destination: Any Protocol: Any Port: *
VM inventory:
web01 NIC: Member of ASG-Web
api01 NIC: Not a member of ASG-Api
Symptom: TCP 8443 connections from web01 to api01 are denied.
A
Add api01's NIC to ASG-Api.
The NSG rule is already written to permit traffic from ASG-Web to ASG-Api on TCP 8443. The backend NIC is not in the destination ASG, so the allow rule never matches. Adding api01 to ASG-Api makes the existing rule effective without broadening access to the entire subnet.
B
Move the deny rule to priority 100.
Why wrong: Moving the deny rule earlier would make the problem worse. The allow rule must match before the deny rule, and in this case the destination ASG membership is the missing piece.
C
Change the source of the allow rule from ASG-Web to VirtualNetwork.
Why wrong: Using VirtualNetwork would widen access beyond the intended app tier and would not preserve the current least-privilege design. The problem is not the source scope; it is the destination ASG membership.
D
Place api01 in the same subnet as web01.
Why wrong: Subnet placement is not required for ASG-based NSG filtering. The existing rule can work across subnets as long as both NICs are in the correct ASGs.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add api01's NIC to ASG-Api.
The exhibit shows that the NSG rule allows traffic from ASG-Web to ASG-Api. Since web01 is in ASG-Web, traffic from web01 to api01 is only permitted if api01 is a member of ASG-Api. Adding api01's NIC to ASG-Api ensures the destination matches the NSG rule, allowing the traffic.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Add api01's NIC to ASG-Api.
Why this is correct
The NSG rule is already written to permit traffic from ASG-Web to ASG-Api on TCP 8443. The backend NIC is not in the destination ASG, so the allow rule never matches. Adding api01 to ASG-Api makes the existing rule effective without broadening access to the entire subnet.
Related concept
Read the scenario before looking for a memorised answer.
✗
Move the deny rule to priority 100.
Why it's wrong here
Moving the deny rule earlier would make the problem worse. The allow rule must match before the deny rule, and in this case the destination ASG membership is the missing piece.
✗
Change the source of the allow rule from ASG-Web to VirtualNetwork.
Why it's wrong here
Using VirtualNetwork would widen access beyond the intended app tier and would not preserve the current least-privilege design. The problem is not the source scope; it is the destination ASG membership.
✗
Place api01 in the same subnet as web01.
Why it's wrong here
Subnet placement is not required for ASG-based NSG filtering. The existing rule can work across subnets as long as both NICs are in the correct ASGs.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may think subnet placement or rule priority is the issue, but the core concept is that ASG membership must match the rule's destination to allow traffic.
Detailed technical explanation
How to think about this question
Application Security Groups (ASGs) allow you to group virtual machine NICs and use them as source or destination in NSG rules, simplifying security management. Under the hood, ASGs are evaluated at the NIC level, and membership is dynamic; adding a NIC to an ASG immediately updates the effective NSG rules without requiring rule modification. In real-world scenarios, this enables micro-segmentation where web servers can only communicate with specific backend VMs, reducing the attack surface.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
An e-commerce site experiences heavy traffic on Black Friday and near-zero traffic during off-peak weeks. Rather than provisioning permanent large VMs, the team uses auto-scaling groups that add capacity automatically under load and reduce it overnight. Questions like this test whether you understand elasticity, availability zones, and cloud compute scaling patterns.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-104 question in full detail.
Implement and Manage Virtual Networking — This question tests Implement and Manage Virtual Networking — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Add api01's NIC to ASG-Api. — The exhibit shows that the NSG rule allows traffic from ASG-Web to ASG-Api. Since web01 is in ASG-Web, traffic from web01 to api01 is only permitted if api01 is a member of ASG-Api. Adding api01's NIC to ASG-Api ensures the destination matches the NSG rule, allowing the traffic.
What should I do if I get this AZ-104 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A web tier and an app tier run on separate Azure VMs in the same region. Each VM's NIC is added to an application security group named WebASG or AppASG. The administrator must allow only the web tier to connect to the app tier on TCP 8443, and future VM scale-outs must be included automatically. Which NSG rule should be created?
medium
A.An inbound rule that uses the current web VM's private IP as the source and the current app VM's private IP as the destination.
✓ B.An inbound rule with source WebASG, destination AppASG, protocol TCP, and destination port 8443.
C.A route table that sends TCP 8443 traffic from the web subnet to the app subnet.
D.An Azure Firewall application rule collection that permits all traffic between the two subnets.
Why B: Option B is correct because application security groups (ASGs) allow you to configure network security as a natural extension of an application's structure, enabling you to group VMs by their roles (e.g., web tier, app tier) and define rules based on those groups. By creating an inbound NSG rule with source WebASG and destination AppASG on TCP port 8443, any VM added to WebASG can initiate traffic to any VM in AppASG, and future scale-outs are automatically included without manual IP updates. This approach is dynamic, scalable, and aligns with the requirement for automatic inclusion of new VMs.
Variation 2. A team manages many application VMs and backend VMs. The VM IP addresses change whenever they are rebuilt, but the same traffic rule must always allow the app tier to reach the backend tier on TCP 8443. What should the administrator use in the NSG rule?
easy
A.Static private IP addresses for each virtual machine.
✓ B.Application Security Groups for the app and backend VMs.
C.A user-defined route between the app and backend subnets.
D.An availability set for each tier.
Why B: Application Security Groups (ASGs) allow you to group VMs logically and reference them directly in NSG rules without relying on static IP addresses. Since the VM IPs change on rebuild, ASGs ensure the NSG rule for TCP 8443 always applies to the correct app and backend tiers, regardless of IP changes.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.