AZ-500 Secure networking Practice Question
A company deploys multiple Azure virtual machines across several subnets in a virtual network. The VMs are grouped by application tiers: web, application, and database. The security team wants to apply network security group (NSG) rules that target all VMs in a specific tier, and they need a way to easily add or remove VMs from these groups without updating NSG rules. Which Azure feature should they use to define these logical VM groups?
⚠ Common exam trap
It's easy for candidates to confuse Azure Resource Manager tags with ASGs, thinking tags can be used in NSG rules, but NSG rules only support IP addresses, service tags, and application security groups, not tags.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Application Security Group (ASG).
Application Security Groups (ASGs) allow you to group VMs logically by application tier (e.g., web, application, database) without relying on IP addresses or subnet boundaries. NSG rules can reference ASGs as source or destination, so adding or removing a VM from an ASG automatically updates the effective security policy without modifying the NSG rules themselves.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network security group (NSG) with multiple IP address ranges.
Why it's wrong here
Using an NSG with multiple IP address ranges means explicitly listing CIDRs in rule sources/destinations. This requires manual updates whenever VMs are added or removed, and it has no knowledge of application roles, so an administrator must determine which IPs correspond to a tier. It provides static filtering, not a logical group that NSG rules can reference and automatically maintain. Therefore, while it filters traffic, it does not deliver the dynamic, role-based grouping that Application Security Groups offer.
- ✓
Application Security Group (ASG).
Why this is correct
ASGs enable you to define logical groups of VMs based on their function. You can reference an ASG in NSG rules, and as VMs are added or removed from the ASG, the rule applies to the current members automatically.
- ✗
Azure Resource Manager tags.
Why it's wrong here
ARM tags are key-value metadata attached to resources for organization, cost tracking, or automation, but they are not interpreted by the NSG data plane. NSG rules can reference IP prefixes, service tags, application security groups, and more, but they cannot reference tags, nor do tags alter routing or security policy. Tags are useful for identifying resources, but membership in a tag does not cause NSG rules to apply to the tagged VMs. Thus, tags cannot group VMs for security rule evaluation.
- ✗
Virtual Network peering.
Why it's wrong here
Virtual Network peering establishes connectivity between two VNets so resources in each can communicate over the backbone, but it does not group VMs within a single subnet or enable an NSG rule to apply to an application tier. Peering operates at the network layer for routing, not at the policy layer for rule scoping. It also does not provide automatic membership of VM NICs in a logical security group. VNet peering is a connectivity mechanism, so it is irrelevant to the requirement of dynamically grouping VMs for security.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.