You have the Azure virtual machines shown in the following table. Each virtual machine has a single network interface. You add the network interface of VM1 to an application security group named…

Question

Exhibits

Options

• AVM2 only
• BVM2 and VM3 only
• CVM2, VM3, VM4, and VM5
• DVM2, VM3, and VM5 only

• A
  10% (5)
• B
  79% (38)
• C
  4% (2)
• D
  6% (3)

Explanation

Explanation

Option B is correct because Application Security Groups (ASGs) in Azure require that all network interfaces within the same ASG must belong to virtual machines in the same virtual network. Since VM1 is already added to ASG1, only VMs sharing VM1's virtual network are eligible - and based on the table, VM2 and VM3 reside in the same VNet as VM1, making them the only valid candidates.

Why the distractors are wrong:

• A (VM2 only) is incorrect because VM3 also shares the same VNet as VM1, so it qualifies.
• C (VM2, VM3, VM4, VM5) is incorrect because VM4 and VM5 are in a different VNet, and ASGs cannot span multiple virtual networks.
• D (VM2, VM3, VM5) is incorrect because VM5, despite possibly appearing similar, belongs to a different VNet and therefore cannot join ASG1.

Memory Tip

Think of an ASG as a "same neighborhood club" - all members must live in the same VNet "neighborhood." If a VM lives in a different VNet, it simply cannot join the club, no matter how similar it looks. When you see ASG questions, always check VNet membership first.

No community discussion yet for this question.