Exercise 3: How Application Security Groups Solve the Churn Problem — Possible Solution
====================================================================

Without Application Security Groups, an NSG rule referencing a
specific application tier would need to list that tier's own actual
IP addresses directly. Every time a VM is added to or removed from
that tier, someone would need to manually go back and edit every NSG
rule that referenced those IP addresses -- a real, error-prone,
ongoing maintenance burden that scales poorly as VMs churn
frequently.

An Application Security Group (ASG) breaks this dependency by letting
the team group VMs logically, by their real application role, rather
than by IP address. An NSG rule can then reference the ASG itself as
its source or destination, instead of a list of specific addresses.

ANSWER: Application Security Groups solve this by decoupling the NSG
rule from any specific IP address entirely -- the rule references the
ASG, and VM membership in that ASG is what actually changes over
time. When a VM is added to or removed from the ASG, every NSG rule
that references that ASG automatically applies (or stops applying) to
it, with zero need to manually edit any rule's own IP address list
each time the application tier's own membership changes.

WHY THIS WORKS AS AN ANSWER
------------------------------
This correctly explains the real mechanism (referencing a group
rather than specific addresses) and why it directly eliminates the
manual-editing burden described in the scenario, rather than simply
stating that ASGs "make things easier" without explaining the
specific structural reason they do.