Woodgrove Bank runs a three-tier application: WEB, APP, and DB. Each tier runs on multiple VMs in the same subnet group. The security team wants NSG rules that allow WEB to APP and APP to DB traffic while minimizing the number of NSG rules and future changes as instances scale. Which approach best accomplishes this using Azure features?

Application Security Groups (ASGs) are the most effective solution here. By creating ASGs for each tier (WEB, APP, DB) and associating the respective VM NICs with these ASGs, you can write NSG rules that reference the ASGs directly. This approach centralizes security policy for each application tier. When new VMs are added to a tier, they automatically inherit the security rules associated with their ASG, minimizing future changes and ensuring scalability without modifying NSG rules. Service Tags are predefined by Azure for specific services (e.g., Storage, SQL) and cannot be customized for application tiers. Placing each tier in its own subscription is an organizational/billing strategy, not a security mechanism for inter-tier communication. Using a single NSG with port-based rules from 'VirtualNetwork' is too broad and does not differentiate between application tiers, failing to meet the security requirement of allowing specific tier-to-tier communication.