Tugboat-app VMs are added and removed weekly, and the NSG that lets the web tier talk to the API tier keeps breaking because someone edits IP prefixes. What should the security engineer use instead?
Select an answer to reveal the explanation.
Short Explanation
Stop rewriting IP prefixes every time a tugboat VM docks. Drop both tiers into Application Security Groups and let the NSG talk ASG-to-ASG.
Full Explanation
Application Security Groups group NICs by workload role inside a virtual network so NSG rules can reference logical names instead of changing IP prefixes. That survives weekly VM churn for web-to-API east-west traffic. Entra security groups are identity objects, not NSG address fields. Azure Firewall IP Groups serve Firewall rules, not this NSG redesign. Public IP allow lists do not solve private tier-to-tier churn.