You have a virtual network Vnet1 with 20 subnets and 500 virtual machines. Each subnet contains a virtual machine that runs network monitoring software. An NSG named NSG1 is associated with every subnet. When a new subnet is created, an automated process creates the monitoring VM in that subnet and associates the subnet with NSG1. You need to add an inbound security rule to NSG1 that allows connections from the IP address 131.107.1.15 to the monitoring virtual machines. Requirements: • Only the monitoring virtual machines should receive connections from 131.107.1.15. • When a new subnet is created, you should minimize changes required to NSG1. For the inbound rule, which destination type should you use?

An Application Security Group (ASG) allows you to group virtual machines and define network security policies based on these groups, rather than individual IP addresses. By creating an ASG for your monitoring VMs and using it as the destination for the inbound rule in NSG1, only those VMs will receive connections from 131.107.1.15. When new monitoring VMs are created, you simply add them to the ASG, and the existing NSG rule automatically applies, minimizing changes to NSG1. Using a service tag would apply to all services within that tag, not just specific VMs. A virtual network as a destination would allow traffic to all VMs in the VNet, violating the "only monitoring VMs" requirement. An IP address as a destination would require updating NSG1 every time a new monitoring VM is added, failing the "minimize changes" requirement.