Objective 4.019% of exam

Implement and Manage Virtual Networking

AZ-104 Practice Questions

This domain covers Azure virtual networks, subnets, IP addressing, network security groups, routing, peering, private endpoints, and name resolution. The exam tests these through scenario-based questions requiring you to configure, secure, and troubleshoot connectivity using the portal, CLI, or PowerShell. Expect tasks on NSG rules, UDRs, VNet peering, and Azure DNS.

Full Practice Test →All Objectives

What this objective tests

AZ-104 Implement and Manage Virtual Networking — Key Topics

Candidates must configure VNets, subnets, NSGs, UDRs, peering, private endpoints, and Azure DNS using portal, CLI, or PowerShell. Get subnet delegation and NSG rule priority right, since misconfigured rules block traffic.

Create and configure VNets, subnets, and IP addressing including service endpoints.
Configure NSG rules and application security groups to filter traffic.
Implement VNet peering, user-defined routes, and Azure DNS zones.
Set up private endpoints and Azure Bastion for secure access.

Common exam traps

Where candidates lose marks on Implement and Manage Virtual Networking

⚠Forgetting that NSG rules are stateful and that default rules allow VNet traffic but deny internet inbound.
⚠Assuming VNet peering is transitive; it is not, so you need UDRs or gateways for spoke-to-spoke.
⚠Overlooking that Azure reserves the first four and last IP address in each subnet.

AZ-104 Implement and Manage Virtual Networking — Practice Questions

30 questions from this objective · 19% of your AZ-104 exam

Question 2mediummultiple choice

Read the full VPN explanation →

A network team wants to send diagnostic logs from an Azure VPN gateway to a Log Analytics workspace. Which command should be used to configure this?

Exhibit

Goal: Centralized logging server = 192.0.2.50

Question 3hardmultiple choice

Implement and Manage Virtual Networking

AZ-104 Implement and Manage Virtual Networking — Key Topics

Where candidates lose marks on Implement and Manage Virtual Networking

AZ-104 Implement and Manage Virtual Networking — Practice Questions

A network team wants to send diagnostic logs from an Azure VPN gateway to a Log Analytics workspace. Which command should be used to configure this?

Exhibit

Which statement best explains the value of enabling both Azure Network Watcher NSG flow logs and Azure role-based access control (RBAC) for your Azure network resources?

A network team wants name resolution and visibility into traffic patterns. Which two Azure services directly match those goals?

An administrator needs to collect activity logs and performance data from multiple Azure virtual machines into a single workspace for querying and alerting. What should be configured?

A network administrator wants a subscription-based mechanism to receive real-time operational updates from Azure virtual network resources as configurations change, instead of polling periodically. Which Azure service should be used?

Exhibit

Traffic from VM-App01 is unexpectedly reaching the internet through a virtual appliance. You need to see which routes are currently applied to the VM network interface. Which Azure tool should you use?

A workload in a VNet must connect to Azure SQL Database over a private IP address, and the database must not be reachable through its public endpoint. Users should still connect by using the normal server name. What should you configure?

A subnet has a user-defined route for 0.0.0.0/0 that sends all outbound traffic to a virtual appliance. Traffic to 10.20.4.12 must instead go directly to an Azure VPN gateway. What should you configure?

A Windows VM in VNet-App must access an Azure Files share over a private IP address. The storage account must not be reachable through its public endpoint, and the VM should resolve the file share name without custom host-file entries. Which three actions are required? Select three.

Two virtual networks are in different subscriptions. VNet-A uses 10.20.0.0/16 and VNet-B uses 10.20.128.0/17. A design review also states that traffic between two spoke VNets should flow through a hub VNet instead of directly between spokes. Which two statements are correct? Select two.

A VM in VNet-Prod must connect to Azure SQL Database over a private IP address, and the VM should resolve the server name automatically without manual DNS entries. Which three actions are required? Select three.

A subnet contains 15 backend VMs that only need outbound internet access for patching and package downloads. Security wants all outbound connections to use one static public IP address, and no VM should have a public IP assigned directly. What should you configure?

Based on the exhibit, HTTPS traffic from the admin workstation is still being blocked. What change should the administrator make?

Exhibit

Based on the exhibit, what should the administrator change so outbound internet traffic uses the NAT gateway?

Exhibit

Based on the exhibit, which subnet prefix is the smallest that can support the planned resources in Azure?

Exhibit

A new spoke virtual network will peer with an existing hub that uses 10.10.0.0/16 and an on-premises network that uses 10.20.0.0/16. Which two address spaces could you assign to the new spoke without overlapping those ranges? Select two.

Based on the exhibit, why is TCP 8443 traffic from the web tier still denied to the app tier, and what should you do to allow only the web tier?

Exhibit

Which two Network Watcher tools can help you diagnose whether a VM can reach another address and whether a specific flow is allowed or denied? Select two.

A spoke subnet has a user-defined route for 10.60.0.0/16 that sends traffic to a virtual appliance at 10.1.0.4. The same subnet also learns a propagated route for 10.60.0.0/16 from a VPN gateway. A VM in the subnet sends traffic to 10.60.7.25. Which next hop will Azure use?

A team is creating a subnet for 48 small Linux VMs, two internal load balancer frontend IPs, and one Azure Bastion host. Azure reserves five IP addresses in every subnet. Which subnet prefix is the smallest that will still meet the requirement?

A subnet has these inbound NSG rules: Rule 100 denies TCP 3389 from Internet, Rule 200 allows TCP 3389 from 10.0.0.0/8, and Rule 300 allows TCP 3389 from AzureLoadBalancer. An administrator in 10.20.5.4 cannot RDP to a VM in the subnet. Why is the connection denied?

All AZ-104 Objectives

Implement and Manage Virtual Networking

AZ-104 Implement and Manage Virtual Networking — Key Topics

Where candidates lose marks on Implement and Manage Virtual Networking

AZ-104 Implement and Manage Virtual Networking — Practice Questions

A network team wants to send diagnostic logs from an Azure VPN gateway to a Log Analytics workspace. Which command should be used to configure this?

Exhibit

Which statement best explains the value of enabling both Azure Network Watcher NSG flow logs and Azure role-based access control (RBAC) for your Azure network resources?

A network team wants name resolution and visibility into traffic patterns. Which two Azure services directly match those goals?

An administrator needs to collect activity logs and performance data from multiple Azure virtual machines into a single workspace for querying and alerting. What should be configured?

A network administrator wants a subscription-based mechanism to receive real-time operational updates from Azure virtual network resources as configurations change, instead of polling periodically. Which Azure service should be used?

Exhibit

Traffic from VM-App01 is unexpectedly reaching the internet through a virtual appliance. You need to see which routes are currently applied to the VM network interface. Which Azure tool should you use?

A workload in a VNet must connect to Azure SQL Database over a private IP address, and the database must not be reachable through its public endpoint. Users should still connect by using the normal server name. What should you configure?

A subnet has a user-defined route for 0.0.0.0/0 that sends all outbound traffic to a virtual appliance. Traffic to 10.20.4.12 must instead go directly to an Azure VPN gateway. What should you configure?

A Windows VM in VNet-App must access an Azure Files share over a private IP address. The storage account must not be reachable through its public endpoint, and the VM should resolve the file share name without custom host-file entries. Which three actions are required? Select three.

Two virtual networks are in different subscriptions. VNet-A uses 10.20.0.0/16 and VNet-B uses 10.20.128.0/17. A design review also states that traffic between two spoke VNets should flow through a hub VNet instead of directly between spokes. Which two statements are correct? Select two.

A VM in VNet-Prod must connect to Azure SQL Database over a private IP address, and the VM should resolve the server name automatically without manual DNS entries. Which three actions are required? Select three.

A subnet contains 15 backend VMs that only need outbound internet access for patching and package downloads. Security wants all outbound connections to use one static public IP address, and no VM should have a public IP assigned directly. What should you configure?

Based on the exhibit, HTTPS traffic from the admin workstation is still being blocked. What change should the administrator make?

Exhibit

Based on the exhibit, what should the administrator change so outbound internet traffic uses the NAT gateway?

Exhibit

Based on the exhibit, which subnet prefix is the smallest that can support the planned resources in Azure?

Exhibit

A new spoke virtual network will peer with an existing hub that uses 10.10.0.0/16 and an on-premises network that uses 10.20.0.0/16. Which two address spaces could you assign to the new spoke without overlapping those ranges? Select two.

Based on the exhibit, why is TCP 8443 traffic from the web tier still denied to the app tier, and what should you do to allow only the web tier?

Exhibit

Which two Network Watcher tools can help you diagnose whether a VM can reach another address and whether a specific flow is allowed or denied? Select two.

A spoke subnet has a user-defined route for 10.60.0.0/16 that sends traffic to a virtual appliance at 10.1.0.4. The same subnet also learns a propagated route for 10.60.0.0/16 from a VPN gateway. A VM in the subnet sends traffic to 10.60.7.25. Which next hop will Azure use?

A team is creating a subnet for 48 small Linux VMs, two internal load balancer frontend IPs, and one Azure Bastion host. Azure reserves five IP addresses in every subnet. Which subnet prefix is the smallest that will still meet the requirement?

A subnet has these inbound NSG rules: Rule 100 denies TCP 3389 from Internet, Rule 200 allows TCP 3389 from 10.0.0.0/8, and Rule 300 allows TCP 3389 from AzureLoadBalancer. An administrator in 10.20.5.4 cannot RDP to a VM in the subnet. Why is the connection denied?

All AZ-104 Objectives