AZ-104 Implement and Manage Virtual Networking — 20 Questions

Question 1

A network team wants to send diagnostic logs from an Azure VPN gateway to a Log Analytics workspace. Which command should be used to configure this?

Accepted Answer

New-AzDiagnosticSetting -ResourceId $gw.Id -WorkspaceId $ws.Id. The correct command is 'New-AzDiagnosticSetting -ResourceId $gw.Id -WorkspaceId $ws.Id' (option B) because it creates a diagnostic setting for the specified Azure resource (VPN gateway) to stream logs to the specified Log Analytics workspace. This is the Azure-native way to forward logs to a centralized monitoring solution. Option D, 'Add-AzLogAnalyticsSolution', adds a management solution (like VPN Gateway solution) to a workspace, but it does not configure diagnostic logging from a specific resource; it only enables log collection for the solution type if logs are already flowing. Therefore, option B is the correct approach.

Answer

Set-AzVpnGateway -LoggingConfiguration

Answer

Set-AzVNetGateway -DiagnosticLogging

Answer

Add-AzLogAnalyticsSolution

Question 2

Which statement best explains the value of enabling both Azure Network Watcher NSG flow logs and Azure role-based access control (RBAC) for your Azure network resources?

Accepted Answer

Azure RBAC reduces unauthorized changes, and NSG flow logs improve visibility and investigation.. Azure Network Watcher NSG flow logs provide a centralized record of allowed and denied traffic to network interfaces, which is critical for security analysis and compliance. Azure RBAC restricts who can create, modify, or delete network resources, preventing unauthorized configuration changes. Together they provide preventive (RBAC) and detective (NSG flow logs) controls, implementing a defense-in-depth strategy.

Answer

Both features do the exact same job, so using both is redundant.

Answer

NSG flow logs remove the need for authentication.

Answer

Azure RBAC makes log timestamps irrelevant.

Question 3

A network team wants name resolution and visibility into traffic patterns. Which two Azure services directly match those goals?

Accepted Answer

Azure DNS. Azure DNS provides name resolution for Azure resources, and Azure Network Watcher provides traffic visibility through NSG flow logs and traffic analytics. Azure Monitor centralizes logs and metrics, which is not one of the two stated requirements, and Azure Firewall filters traffic but does not provide visibility into traffic patterns.

Answer

Azure Monitor

Answer

Azure Firewall

Question 4

An administrator needs to collect activity logs and performance data from multiple Azure virtual machines into a single workspace for querying and alerting. What should be configured?

Accepted Answer

Log Analytics workspace. Azure Monitor Log Analytics workspaces are used to collect, query, and alert on log and performance data from Azure resources. Diagnostic settings on each VM can send logs and metrics to a Log Analytics workspace, providing centralized analysis.

Answer

Azure DNS

Answer

Azure Network Watcher

Answer

Azure Traffic Manager

Question 5

A network administrator wants a subscription-based mechanism to receive real-time operational updates from Azure virtual network resources as configurations change, instead of polling periodically. Which Azure service should be used?

Accepted Answer

Azure Event Grid. Azure Event Grid provides an event-driven, publish-subscribe model that delivers real-time notifications when Azure resources change state. It uses event subscriptions to push updates to subscribers as changes occur, eliminating the need for polling. This aligns with the requirement for a subscription-based mechanism to stream operational updates.

Answer

Azure Backup

Answer

Azure Network Watcher

Answer

Azure Virtual Network peering

Question 6

Traffic from VM-App01 is unexpectedly reaching the internet through a virtual appliance. You need to see which routes are currently applied to the VM network interface. Which Azure tool should you use?

Accepted Answer

Effective routes for the network interface. Effective routes for the network interface shows the actual, evaluated routes applied to a specific VM NIC, including system routes, BGP-advertised routes, and user-defined routes (UDRs). This tool resolves the order of route preference (longest prefix match) and confirms whether traffic is being forced through a virtual appliance (e.g., via a UDR with next hop type VirtualAppliance). It directly answers why VM-App01's traffic is reaching the internet unexpectedly.

Answer

NSG flow logs

Answer

Azure Policy compliance

Answer

Activity log

Question 7

A VM in subnet S1 has two network security groups applied: one at the subnet and one directly on the NIC. The subnet NSG contains DenyAllInbound at priority 100 and AllowHTTPSFromOffice at priority 200. The NIC NSG contains AllowHTTPSFromOffice at priority 150 and no deny rules. Office users still cannot reach the VM on TCP 443. Which statement is correct? Select one.

Accepted Answer

The subnet-level deny rule is evaluated before the later allow rule because lower priority numbers are processed first.. Azure evaluates effective NSG rules in priority order. The subnet's DenyAllInbound rule at priority 100 is evaluated before any allow rule (including the NIC's allow at 150 and the subnet's allow at 200). Because this rule matches all inbound traffic and denies it, evaluation stops and the NIC NSG is not evaluated. Therefore, C is false. The only correct statement is A.

Answer

The NIC allow rule can override a deny decision already made by the subnet NSG.

Answer

Both the subnet NSG and the NIC NSG are evaluated, and a deny in either one blocks the packet.

Answer

The allow rule must use a private IP source range because public source ranges are not valid in NSG rules.

Answer

A user-defined route with next hop Internet would bypass the NSG deny and restore access.

Question 8

A workload in a VNet must connect to Azure SQL Database over a private IP address, and the database must not be reachable through its public endpoint. Users should still connect by using the normal server name. What should you configure?

Accepted Answer

A private endpoint for Azure SQL Database and a private DNS zone linked to the VNet.. A private endpoint assigns Azure SQL Database a private IP address from the VNet, making it accessible over a private connection. By creating a private DNS zone linked to the VNet, the normal server name resolves to that private IP, allowing users to connect without using the public endpoint. However, to ensure the database is not reachable via its public endpoint, you must also set the SQL server's Public network access to Disabled. The private endpoint alone does not automatically disable public access.

Answer

A service endpoint on the subnet and a public firewall rule on the SQL server.

Answer

A network security group rule that denies all public internet traffic to the subnet.

Answer

A NAT gateway on the subnet so the SQL connection uses a private source address.

Question 9

A Windows VM in VNet-App must access an Azure Files share over a private IP address. The storage account must not be reachable through its public endpoint, and the VM should resolve the file share name without custom host-file entries. Which three actions are required? Select three.

Accepted Answer

Create a private endpoint for the file service in VNet-App.. To access an Azure Files share over a private IP and block the public endpoint, you must create a private endpoint for the file service in VNet-App, which assigns a private IP address to the storage account. However, the private endpoint alone does not block public endpoint access; you must also disable public network access on the storage account. For DNS resolution without custom host entries, you must create and link the private DNS zone `privatelink.file.core.windows.net` to VNet-App. Service endpoints do not provide a private IP and do not block public access. Granting the VM's managed identity a role is unrelated to networking.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet instead of a private endpoint.

Answer

Grant the VM's managed identity the Storage File Data SMB Share Reader role to create the private path.

Question 10

A VM in VNet-Prod must connect to Azure SQL Database over a private IP address, and the VM should resolve the server name automatically without manual DNS entries. Which three actions are required? Select three.

Accepted Answer

Create a private endpoint for the Azure SQL server in VNet-Prod.. A private endpoint assigns a private IP address from VNet-Prod to the SQL server. To resolve the server name automatically, create the private DNS zone privatelink.database.windows.net and link it to VNet-Prod. Service endpoints do not provide a private IP, and leaving public network access enabled with a firewall rule does not meet the private IP requirement.

Answer

Enable a service endpoint for Microsoft.Sql on the subnet instead of using a private endpoint.

Answer

Leave public network access enabled and add the VNet as an allowed firewall rule.

Question 11

A subnet contains 15 backend VMs that only need outbound internet access for patching and package downloads. Security wants all outbound connections to use one static public IP address, and no VM should have a public IP assigned directly. What should you configure?

Accepted Answer

A NAT gateway associated with the subnet.. A NAT gateway is the recommended and purpose-built service for providing outbound internet access to VMs in a subnet without assigning public IPs directly. It performs SNAT and uses a single static public IP. While a Standard Load Balancer with outbound rules could technically also meet the requirements, NAT Gateway is the simpler, more cost-effective, and recommended solution for outbound-only scenarios.

Answer

A public Standard Load Balancer with outbound rules for the backend pool.

Answer

A public IP address on each virtual machine so all outbound traffic is traceable.

Answer

An internal load balancer with a private frontend IP.

Question 12

A route table on a subnet contains this user-defined route:
- 0.0.0.0/0 -> Virtual appliance 10.0.0.4
The subnet is peered to another VNet with address space 10.2.0.0/16. A VM in the subnet sends traffic to 10.2.2.7, and Network Watcher shows the next hop as Virtual network peering instead of the appliance. What explains this result?

Accepted Answer

The peering route is more specific than the default route, so it is selected first.. Azure uses the longest prefix match to determine the next hop for traffic. The user-defined route (UDR) for 0.0.0.0/0 is a default route, while the peering route for 10.2.0.0/16 is more specific. Since 10.2.2.7 falls within the 10.2.0.0/16 range, the peering route is preferred over the default route, directing traffic through the VNet peering instead of the virtual appliance.

Answer

User-defined routes never apply to peered networks.

Answer

NSG rules always override any route table entry.

Answer

Peering only works when both VNets are in the same region.

Question 13

An administrator plans to peer VNet-A with VNet-B so two application tiers can communicate over private IPs. VNet-A uses 10.20.0.0/16. VNet-B currently uses 10.20.1.0/24, and both VNets already contain subnets that must remain intact. The peering operation fails. What should the administrator do first?

Accepted Answer

Change VNet-B to a non-overlapping address space before creating the peering.. Azure VNet peering requires non-overlapping address spaces. However, you cannot change an existing VNet's address space if the address space contains subnets; the subnets must be deleted first. Since the subnets must remain intact, the administrator cannot simply change VNet-B's address space. The correct first step would be to create a new VNet with a non-overlapping address space, recreate or migrate the subnets, and then peer. None of the provided options correctly addresses the situation.

Answer

Add a route table to VNet-B so traffic can bypass the overlap.

Answer

Create a network security group rule to allow all traffic between the VNets.

Answer

Enable gateway transit on VNet-A so the address conflict is ignored.

Question 14

Based on the exhibit, HTTPS traffic from the admin workstation is still being blocked. What change should the administrator make?

Accepted Answer

Change Allow-HTTPS-Admin to priority 100.. The Deny-All-Inbound rule shown in the exhibit must be a custom rule with a lower numeric priority (higher priority) than the Allow-HTTPS-Admin rule at priority 200. Since Azure NSG rules are processed in priority order (lowest number = highest priority), the deny rule is evaluated first and blocks HTTPS traffic. By changing Allow-HTTPS-Admin to priority 100, it becomes higher priority than the custom deny rule, allowing HTTPS traffic.

Answer

Delete the Deny-All-Inbound rule.

Answer

Change Allow-HTTPS-Admin protocol from TCP to Any.

Answer

Move the allow rule to outbound traffic.

Question 15

Two VM scale sets named Web and App run in separate subnets. The App subnet NSG already contains Deny-All-Inbound at priority 300. The business wants only the Web tier to connect to the App tier on TCP 8443, and any new scale-out instances must be included automatically. What should the administrator add?

Accepted Answer

An inbound allow rule using source WebASG, destination AppASG, TCP 8443, with a priority lower than 300.. It uses an Application Security Group (ASG) as the source and destination, which automatically includes all current and future VM instances in the Web and App scale sets. The rule allows TCP 8443 from WebASG to AppASG with a priority lower than 300 (e.g., 250) so it is evaluated before the Deny-All-Inbound rule at priority 300. This ensures that only the Web tier can connect to the App tier on the specified port, and new scale-out instances are included automatically without manual NSG updates.

Answer

A rule that allows TCP 8443 from the current Web subnet address range to the App subnet.

Answer

A load balancer NAT rule that maps port 8443 from the Internet to the App tier.

Answer

A service endpoint for Microsoft.Web on both subnets.

Question 16

A subnet must send traffic to on-premises networks through a VPN gateway, but internet-bound traffic should use the Azure platform's normal outbound path and not be forced through a virtual appliance. The administrator wants to avoid creating a 0.0.0.0/0 user-defined route. Which design meets the requirement?

Accepted Answer

Associate a route table that contains only the specific on-premises prefixes and disable gateway route propagation.. To send traffic to on-premises prefixes via the VPN gateway while keeping internet traffic on the normal Azure path, create a route table with specific user-defined routes (UDRs) for the on-premises prefixes pointing to the VPN gateway. Disable virtual network gateway route propagation on the route table so that the subnet does not inherit any default route from the VPN gateway. With propagation disabled, the subnet's effective routes combine the specific UDRs with Azure's system default route (0.0.0.0/0 to the internet), naturally directing internet traffic outbound without a forced tunnel.

Answer

Add a 0.0.0.0/0 route to the VPN gateway and disable gateway route propagation.

Answer

Create a service endpoint for the subnet and use it as the default next hop.

Answer

Attach an NSG rule that allows on-premises traffic and blocks all internet traffic.

Question 17

Based on the exhibit, which subnet prefix should be used for Subnet A so it can support about 30 VM NICs?

Accepted Answer

/26. (/26) is correct because a /26 subnet provides 64 IP addresses (2^(32-26) = 64), but Azure reserves 5 IP addresses per subnet (first four and last one), leaving 59 usable addresses. This comfortably supports about 30 VM NICs while leaving room for growth. Options /27 and /28 do not provide enough usable addresses after Azure's reservation (27 provides 27 usable, 28 provides 11 usable), and /25 provides more than needed but is not the most efficient.

Answer

/28

Answer

/27

Answer

/25

Question 18

An application in AppSubnet must access an Azure Storage account over the public endpoint, but only traffic from that subnet should be allowed, and the traffic should stay on the Microsoft backbone. The administrator does not want to create a private IP for the service. Which two actions should be taken? Select two.

Accepted Answer

Enable a service endpoint for Microsoft.Storage on AppSubnet.. Enabling a service endpoint for Microsoft.Storage on AppSubnet (Option A) allows traffic from that subnet to route to the Azure Storage account over the Microsoft backbone while still using the public endpoint. In addition, the storage account firewall must be configured to allow traffic from AppSubnet (Option B); without this rule, the service endpoint traffic will be rejected. Together these actions fulfill the requirements without creating a private IP.

Answer

Create a private endpoint in AppSubnet.

Answer

Disable public network access on the storage account.

Answer

Assign a public IP address to the storage account.

Question 19

A storage account must be reachable only from resources in one Azure subnet, and traffic must use a private IP rather than the public endpoint. Which configuration should the administrator implement?

Accepted Answer

A private endpoint in the subnet. A private endpoint assigns a private IP address from the subnet to the storage account, making it accessible only via that private IP within the virtual network. This ensures traffic never traverses the public endpoint, meeting both the reachability and private IP requirements.

Answer

A service endpoint on the subnet

Answer

A shared access signature scoped to the subnet

Answer

Allow trusted Microsoft services on the storage firewall

Question 20

Based on the exhibit, what should the administrator change so outbound internet traffic uses the NAT gateway?

Accepted Answer

Remove the 0.0.0.0/0 user-defined route to the virtual appliance.. The user-defined route (UDR) with destination 0.0.0.0/0 pointing to the virtual appliance overrides the system route that enables the NAT gateway for outbound internet. To use the NAT gateway, remove the conflicting 0.0.0.0/0 UDR so the system route takes effect and the NAT gateway handles outbound traffic.

Answer

Detach the subnet from the NAT gateway.

Answer

Change the route table source address to 10.1.0.4.

Answer

Enable a service endpoint on the subnet.