AZ-104 Implement and Manage Virtual Networking — 10 Questions

Question 1

A network team wants to send diagnostic logs from an Azure VPN gateway to a Log Analytics workspace. Which command should be used to configure this?

Accepted Answer

New-AzDiagnosticSetting -ResourceId $gw.Id -WorkspaceId $ws.Id. The correct command is 'New-AzDiagnosticSetting -ResourceId $gw.Id -WorkspaceId $ws.Id' (option B) because it creates a diagnostic setting for the specified Azure resource (VPN gateway) to stream logs to the specified Log Analytics workspace. This is the Azure-native way to forward logs to a centralized monitoring solution. Option D, 'Add-AzLogAnalyticsSolution', adds a management solution (like VPN Gateway solution) to a workspace, but it does not configure diagnostic logging from a specific resource; it only enables log collection for the solution type if logs are already flowing. Therefore, option B is the correct approach.

Answer

Set-AzVpnGateway -LoggingConfiguration

Answer

Set-AzVNetGateway -DiagnosticLogging

Answer

Add-AzLogAnalyticsSolution

Question 2

Which statement best explains the value of enabling both Azure Network Watcher NSG flow logs and Azure role-based access control (RBAC) for your Azure network resources?

Accepted Answer

Azure RBAC reduces unauthorized changes, and NSG flow logs improve visibility and investigation.. Azure Network Watcher NSG flow logs provide a centralized record of allowed and denied traffic to network interfaces, which is critical for security analysis and compliance. Azure RBAC restricts who can create, modify, or delete network resources, preventing unauthorized configuration changes. Together they provide preventive (RBAC) and detective (NSG flow logs) controls, implementing a defense-in-depth strategy.

Answer

Both features do the exact same job, so using both is redundant.

Answer

NSG flow logs remove the need for authentication.

Answer

Azure RBAC makes log timestamps irrelevant.

Question 3

A network team wants name resolution and visibility into traffic patterns. Which two Azure services directly match those goals?

Accepted Answer

Azure DNS. Azure DNS provides name resolution for Azure resources, and Azure Network Watcher provides traffic visibility through NSG flow logs and traffic analytics. Azure Monitor centralizes logs and metrics, which is not one of the two stated requirements, and Azure Firewall filters traffic but does not provide visibility into traffic patterns.

Answer

Azure Monitor

Answer

Azure Firewall

Question 4

An administrator needs to collect activity logs and performance data from multiple Azure virtual machines into a single workspace for querying and alerting. What should be configured?

Accepted Answer

Log Analytics workspace. Azure Monitor Log Analytics workspaces are used to collect, query, and alert on log and performance data from Azure resources. Diagnostic settings on each VM can send logs and metrics to a Log Analytics workspace, providing centralized analysis.

Answer

Azure DNS

Answer

Azure Network Watcher

Answer

Azure Traffic Manager

Question 5

A network administrator wants a subscription-based mechanism to receive real-time operational updates from Azure virtual network resources as configurations change, instead of polling periodically. Which Azure service should be used?

Accepted Answer

Azure Event Grid. Azure Event Grid provides an event-driven, publish-subscribe model that delivers real-time notifications when Azure resources change state. It uses event subscriptions to push updates to subscribers as changes occur, eliminating the need for polling. This aligns with the requirement for a subscription-based mechanism to stream operational updates.

Answer

Azure Backup

Answer

Azure Network Watcher

Answer

Azure Virtual Network peering

Question 6

Traffic from VM-App01 is unexpectedly reaching the internet through a virtual appliance. You need to see which routes are currently applied to the VM network interface. Which Azure tool should you use?

Accepted Answer

Effective routes for the network interface. Effective routes for the network interface shows the actual, evaluated routes applied to a specific VM NIC, including system routes, BGP-advertised routes, and user-defined routes (UDRs). This tool resolves the order of route preference (longest prefix match) and confirms whether traffic is being forced through a virtual appliance (e.g., via a UDR with next hop type VirtualAppliance). It directly answers why VM-App01's traffic is reaching the internet unexpectedly.

Answer

NSG flow logs

Answer

Azure Policy compliance

Answer

Activity log

Question 7

A VM in subnet S1 has two network security groups applied: one at the subnet and one directly on the NIC. The subnet NSG contains DenyAllInbound at priority 100 and AllowHTTPSFromOffice at priority 200. The NIC NSG contains AllowHTTPSFromOffice at priority 150 and no deny rules. Office users still cannot reach the VM on TCP 443. Which statement is correct? Select one.

Accepted Answer

The subnet-level deny rule is evaluated before the later allow rule because lower priority numbers are processed first.. Azure evaluates effective NSG rules in priority order. The subnet's DenyAllInbound rule at priority 100 is evaluated before any allow rule (including the NIC's allow at 150 and the subnet's allow at 200). Because this rule matches all inbound traffic and denies it, evaluation stops and the NIC NSG is not evaluated. Therefore, C is false. The only correct statement is A.

Answer

The NIC allow rule can override a deny decision already made by the subnet NSG.

Answer

Both the subnet NSG and the NIC NSG are evaluated, and a deny in either one blocks the packet.

Answer

The allow rule must use a private IP source range because public source ranges are not valid in NSG rules.

Answer

A user-defined route with next hop Internet would bypass the NSG deny and restore access.

Question 8

A workload in a VNet must connect to Azure SQL Database over a private IP address, and the database must not be reachable through its public endpoint. Users should still connect by using the normal server name. What should you configure?

Accepted Answer

A private endpoint for Azure SQL Database and a private DNS zone linked to the VNet.. A private endpoint assigns Azure SQL Database a private IP address from the VNet, making it accessible over a private connection. By creating a private DNS zone linked to the VNet, the normal server name resolves to that private IP, allowing users to connect without using the public endpoint. However, to ensure the database is not reachable via its public endpoint, you must also set the SQL server's Public network access to Disabled. The private endpoint alone does not automatically disable public access.

Answer

A service endpoint on the subnet and a public firewall rule on the SQL server.

Answer

A network security group rule that denies all public internet traffic to the subnet.

Answer

A NAT gateway on the subnet so the SQL connection uses a private source address.

Question 9

A Windows VM in VNet-App must access an Azure Files share over a private IP address. The storage account must not be reachable through its public endpoint, and the VM should resolve the file share name without custom host-file entries. Which three actions are required? Select three.

Accepted Answer

Create a private endpoint for the file service in VNet-App.. To access an Azure Files share over a private IP and block the public endpoint, you must create a private endpoint for the file service in VNet-App, which assigns a private IP address to the storage account. However, the private endpoint alone does not block public endpoint access; you must also disable public network access on the storage account. For DNS resolution without custom host entries, you must create and link the private DNS zone `privatelink.file.core.windows.net` to VNet-App. Service endpoints do not provide a private IP and do not block public access. Granting the VM's managed identity a role is unrelated to networking.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet instead of a private endpoint.

Answer

Grant the VM's managed identity the Storage File Data SMB Share Reader role to create the private path.

Question 10

A VM in VNet-Prod must connect to Azure SQL Database over a private IP address, and the VM should resolve the server name automatically without manual DNS entries. Which three actions are required? Select three.

Accepted Answer

Create a private endpoint for the Azure SQL server in VNet-Prod.. A private endpoint assigns a private IP address from VNet-Prod to the SQL server. To resolve the server name automatically, create the private DNS zone privatelink.database.windows.net and link it to VNet-Prod. Service endpoints do not provide a private IP, and leaving public network access enabled with a firewall rule does not meet the private IP requirement.

Answer

Enable a service endpoint for Microsoft.Sql on the subnet instead of using a private endpoint.

Answer

Leave public network access enabled and add the VNet as an allowed firewall rule.