nerdexam
Microsoft

AZ-104 · Question #111

Drag and Drop Question You have an Azure subscription. The subscription includes a virtual network named VNet1. Currently, VNet1 does not contain any subnets. You plan to create subnets on VNet1 and…

The correct answer is New-AzureRmApplicationSecurityGroup; New-AzureRmNetworkSecurityRuleConfig; New-AzureRmNetworkSecurityGroup; Add-AzureRmVirtualNetworkSubnetConfig. The correct sequence follows the logical dependency chain: first create the Application Security Groups (ASGs) that will be referenced in rules, then create a Network Security Rule Config that references those ASGs to define traffic restrictions, then bundle that rule into a…

Submitted by kwame.gh· Mar 4, 2026Configure and manage virtual networking - implementing network security with NSGs and Application Security Groups using Azure PowerShell (AZ-104 / AZ-303 Network Security domain)

Question

Drag and Drop Question You have an Azure subscription. The subscription includes a virtual network named VNet1. Currently, VNet1 does not contain any subnets. You plan to create subnets on VNet1 and to use application security groups to restrict the traffic between the subnets. You need to create the application security groups and to assign them to the subnets. Which four cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order. Answer:

Exhibits

AZ-104 question #111 exhibit 1
AZ-104 question #111 exhibit 2

Answer Area

Drag items

New-AzureRmVirtualNetworkNew-AzureRmNetworkSecurityGroupNew-AzureRmApplicationSecurityGroupNew-AzureRmNetworkSecurityRuleConfigAdd-AzureRmVirtualNetworkSubnetConfig

Correct arrangement

  • New-AzureRmApplicationSecurityGroup
  • New-AzureRmNetworkSecurityRuleConfig
  • New-AzureRmNetworkSecurityGroup
  • Add-AzureRmVirtualNetworkSubnetConfig

Explanation

The correct sequence follows the logical dependency chain: first create the Application Security Groups (ASGs) that will be referenced in rules, then create a Network Security Rule Config that references those ASGs to define traffic restrictions, then bundle that rule into a Network Security Group (NSG), and finally attach the NSG to a subnet via Add-AzureRmVirtualNetworkSubnetConfig. This order ensures each resource exists before it is referenced by the next cmdlet. The NSG with its rules is what gets associated to subnets to enforce the ASG-based traffic restrictions.

Topics

#Application Security Groups#Network Security Groups#Azure Virtual Networking#Azure PowerShell

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-104 Practice