AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  An application security group lets you reference a set of virtual machines in NSG rules.

  Why this is correct

  An application security group (ASG) is a logical grouping of virtual machine network interfaces, often based on workload such as web servers or database servers. When you write an NSG rule, you can use the ASG name as the source or destination instead of individual IP addresses or CIDR blocks. This simplifies rule management because adding or removing VMs from the ASG automatically updates which interfaces match the rule, without requiring edits to the NSG itself. ASGs are supported only for NICs in the same virtual network as the NSG that references them.

• ✓

  A service tag is a Microsoft-managed label for a service or address range.

  Why this is correct

  A service tag is a Microsoft-defined and automatically updated label that represents a set of Azure service IP address prefixes, such as AzureLoadBalancer, Storage, or Sql. When you reference a service tag in an NSG rule, Azure expands it to the current regional ranges for that service, so you do not need to track Azure's ever-changing public IP lists or create update mechanisms. Unlike application security groups, service tags are not tied to your VM network interface configuration but to Azure's global infrastructure. Service tags cannot be modified, created, or scoped by customers.

• ✗

  Application security groups are used to assign Azure roles.

  Why it's wrong here

  Application security groups operate at the network layer and are used purely to classify VM traffic for NSG rule matching; they have no role in identity or authorization. Azure role-based access control uses service principals, users, groups, and managed identities as security principals, and roles are assigned to those principals through role assignments. There is no mechanism to assign an Azure role to an ASG; thinking otherwise comes from confusing a network metadata grouping with an identity construct. Even if an ASG contains many VMs, it still cannot grant permissions to those VMs or their users.

  When this WOULD be correct

  If the question were about a feature that groups resources for role assignment, such as 'management groups' or 'Azure AD groups', then a similar statement about grouping for role assignment would be correct. For example: 'Which feature allows you to assign Azure roles to a set of users?'

• ✗

  Service tags are custom labels you create for your own subscriptions.

  Why it's wrong here

  Service tags are not custom labels you define for your own subscriptions; they are a Microsoft-managed ontology of service prefixes, and attempting to create your own tag of this type is not supported. Azure does have user-defined resource tags (key/value pairs for resource metadata, costing, and organization), but those are a completely different feature and do not influence NSG rule matching. Service tags such as AzureFrontDoor.Backend or AzureMonitor are predefined and updated by Microsoft whenever the underlying service IP ranges change. You can only choose from the existing catalog of service tags when authoring rules.

  When this WOULD be correct

  If the question asked 'Which statement about Azure tags is correct?' and an option said 'Tags are custom labels you create for your own subscriptions,' that would be correct, as resource tags are user-defined metadata.

• ✗

  Service tags create a private IP address for a service.

  Why it's wrong here

  Service tags do not allocate or create any kind of private IP address; they simply represent a collection of existing IP ranges that Microsoft owns or publishes for its services. The actual services continue to use their own public or private endpoints, and the service tag is only a convenient identifier in NSG rules and route tables that Microsoft updates automatically. If a service tag were able to create a private IP address, it would imply that Azure dynamically provisions addresses on demand, which is not the function of a tag. The abstraction exists solely to make rule maintenance easier.

  When this WOULD be correct

  If the question asked 'Which feature provides a static public IP address for an Azure service?' then 'Service tags create a private IP address for a service' would be incorrect, but a similar wrong option might be 'Azure Front Door creates a private IP address for a service'—however, no scenario makes this statement correct. A correct scenario would be: 'Which statement about service endpoints is true?' where 'Service endpoints create a private IP address for a service' is still wrong. This option is never correct.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”