A company has frontend and backend VMs in the same subnet. Security rules must allow the frontend tier to reach only the backend tier on TCP 443, without assigning rules to individual VM IP addresses. What should the administrator use in the NSG rule?

A user-defined route that sends frontend traffic to the backend subnet.

Routes control next hop selection, not fine-grained east-west access rules.

A network security group rule that references both subnets by address prefix only.

Subnet prefixes are broader than required and do not identify application tiers cleanly.

A VNet peering connection between the two tiers.

Peering is for separate VNets, not for separating roles inside one subnet.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Application security groups for the frontend and backend VMs. — Application security groups are designed for this exact pattern: grouping VMs by workload role and then writing NSG rules against those logical groups instead of IP addresses. That makes the rule set easier to maintain when VMs scale or are replaced. In this scenario, the frontend ASG can be allowed to reach the backend ASG on TCP 443, while other lateral traffic remains blocked by the NSG design. Why others are wrong: A route table cannot enforce application-level access control. Using raw subnet prefixes is less precise and does not cleanly represent the two tiers. VNet peering is only relevant between different virtual networks, not between roles in the same subnet. The requirement is to simplify NSG management with logical workload grouping, which is exactly what ASGs provide.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.