AZ-104 Implement and Manage Virtual Networking Practice Test 10 — 15 Questions

Question 1

Based on the exhibit, what inbound NSG rule should the administrator add to allow only the web tier to reach the app tier on TCP 8080?

Accepted Answer

Source: WebASG, Destination: AppASG, Protocol: TCP, Port: 8080, Priority: 250. The inbound NSG rule must allow traffic from the web tier (source: WebASG) to the app tier (destination: AppASG) on TCP port 8080. A priority of 250 is lower than the default rules (65000+) and ensures this rule is evaluated before any higher-numbered deny rules, while being high enough to leave room for more specific rules if needed.

Answer

Source: Internet, Destination: VirtualNetwork, Protocol: TCP, Port: 8080, Priority: 250

Answer

Source: AppASG, Destination: WebASG, Protocol: TCP, Port: 8080, Priority: 250

Answer

Source: WebASG, Destination: AppASG, Protocol: TCP, Port: 8080, Priority: 350

Question 2

Two VNets are peered successfully, and a VM in the spoke can reach a private endpoint in the hub by IP address. However, the VM cannot resolve the storage account name to the private endpoint FQDN. The private DNS zone is linked only to the hub VNet. What should the administrator do?

Accepted Answer

Link the private DNS zone to the spoke VNet as well.. The VM can reach the private endpoint by IP, confirming that network connectivity (peering and routing) is working. However, name resolution fails because the private DNS zone, which contains the private endpoint FQDN mapping, is linked only to the hub VNet. By linking the private DNS zone to the spoke VNet (option B), the spoke VMs will use Azure-provided DNS to resolve the storage account name to the private IP, enabling seamless name resolution across the peered VNets.

Answer

Add a route table to the spoke subnet pointing to the private endpoint IP.

Answer

Enable gateway transit on the peering connection.

Answer

Create an NSG rule to allow DNS traffic to the storage account.

Question 3

A team is creating a new spoke VNet that will later be peered to an existing hub VNet and connected to on-premises networks. The proposed address space for the spoke is 10.60.1.0/24. The hub already uses 10.60.0.0/16. What should the administrator do before deploying the spoke?

Accepted Answer

Choose a non-overlapping address space for the spoke, such as 10.61.1.0/24.. VNet address spaces must not overlap when peered or connected via VPN/ExpressRoute. The proposed spoke address 10.60.1.0/24 falls within the hub's 10.60.0.0/16 range, creating an overlap that would prevent successful peering and routing. A non-overlapping address space like 10.61.1.0/24 ensures unique IP ranges, allowing proper route propagation and connectivity.

Answer

Use the proposed address space because the spoke subnet is smaller than the hub address space.

Answer

Create a private endpoint in the spoke to separate its routing table from the hub.

Answer

Enable gateway transit on the hub peering before creating the spoke.

Question 4

Based on the exhibit, the administrator cannot create VNet peering between the hub and spoke networks. What should be changed?

Accepted Answer

Change the spoke VNet address space so it does not overlap the hub.. VNet peering requires that the address spaces of the peered VNets do not overlap. Overlapping address spaces cause routing conflicts because Azure cannot distinguish between resources in the hub and spoke when IP addresses are identical or within the same CIDR range. Changing the spoke VNet address space to a non-overlapping range resolves this issue and allows peering to be established.

Answer

Change the hub VNet to use a smaller subnet mask.

Answer

Add a route table to the spoke VNet before creating peering.

Answer

Enable a service endpoint on both VNets.

Question 5

A company wants to peer a new spoke virtual network with an existing hub VNet. The hub uses 10.20.0.0/16. The spoke was created with 10.20.1.0/24 because that range was still available in the IPAM spreadsheet. VNet peering creation fails. What should the administrator do first?

Accepted Answer

Change the spoke VNet address space to a non-overlapping range, then recreate or update peering.. VNet peering in Azure requires that the address spaces of the peered virtual networks do not overlap. The hub uses 10.20.0.0/16, and the spoke uses 10.20.1.0/24, which is a subset of the hub's range. This overlap causes the peering creation to fail. The administrator must first change the spoke's address space to a non-overlapping range (e.g., 10.21.0.0/24) and then recreate or update the peering.

Answer

Enable gateway transit on the hub and retry the peering.

Answer

Add a route table to the spoke subnet so the networks can communicate.

Answer

Configure a custom DNS server in the spoke to translate the overlapping range.

Question 6

A subnet uses a route table with gateway route propagation disabled so internet-bound traffic can be forced through a network virtual appliance. After the change, VMs in the subnet can no longer reach servers in the on-premises network 172.16.0.0/16 over the VPN gateway. What should the administrator add to the route table?

Accepted Answer

A user-defined route for 172.16.0.0/16 with next hop type Virtual network gateway.. When gateway route propagation is disabled on a route table, the subnet no longer receives the default system routes that include the VPN gateway route for on-premises networks. To restore connectivity to 172.16.0.0/16, you must add a user-defined route (UDR) with next hop type 'Virtual network gateway', which explicitly directs traffic for that prefix through the VPN gateway. This overrides the missing propagated route and forces the traffic to the on-premises network correctly.

Answer

A user-defined route for 172.16.0.0/16 with next hop type Internet.

Answer

An NSG allow rule for TCP 172.16.0.0/16.

Answer

A service endpoint for the on-premises network range.

Question 7

A subnet has a NAT gateway attached, but outbound internet traffic from the VMs is still leaving through a network virtual appliance. The subnet's route table includes a user-defined route for 0.0.0.0/0 with the next hop set to Virtual appliance. The business wants internet traffic to use the NAT gateway while keeping any required specific routes to on-premises networks. What should the administrator do?

Accepted Answer

Remove the 0.0.0.0/0 user-defined route and keep only specific routes for private prefixes.. The user-defined route (UDR) for 0.0.0.0/0 with next hop Virtual appliance is overriding the NAT gateway's default route. NAT gateways require a default route (0.0.0.0/0) with next hop 'Internet' to direct outbound traffic through them. By removing the conflicting UDR and keeping only specific routes for on-premises prefixes, the subnet will use the NAT gateway for internet traffic while maintaining connectivity to on-premises networks via the remaining UDRs.

Answer

Keep the default route and add a second NAT gateway to the subnet.

Answer

Disable network security groups on the subnet so the NAT gateway becomes active.

Answer

Set gateway route propagation to Disabled so the NAT gateway is preferred.

Question 8

A subnet has a route table with a 0.0.0.0/0 user-defined route to an on-premises virtual appliance. The business now wants Azure VM outbound internet traffic to use a NAT gateway so the public source IP stays consistent, and the firewall appliance is no longer required for internet egress. What should the administrator do?

Accepted Answer

Remove the 0.0.0.0/0 UDR and associate the NAT gateway with the subnet.. Removing the 0.0.0.0/0 user-defined route (UDR) that points to the on-premises virtual appliance and associating a NAT gateway with the subnet ensures that all outbound internet traffic from Azure VMs uses the NAT gateway's public IP address. The NAT gateway automatically creates a default route (0.0.0.0/0) with a next hop type of 'Internet' for the subnet, overriding any conflicting UDRs. This provides a consistent source IP for internet egress without requiring the firewall appliance.

Answer

Keep the default route to the virtual appliance and add the NAT gateway to the subnet.

Answer

Change the route next hop to Virtual network gateway.

Answer

Create an NSG outbound rule that allows internet traffic from the subnet.

Question 9

Based on the exhibit, what should the administrator configure so the VM in the spoke VNet can resolve internal hostnames that are hosted on the DNS server in the hub VNet?

The team has already verified that IP connectivity between the spoke VM and the hub VM works.

Accepted Answer

Set the SpokeVNet DNS server list to use 10.40.0.4 so the spoke queries the hub resolver directly.. Setting the SpokeVNet DNS server list to 10.40.0.4 (the IP of the DNS server in the hub VNet) configures the spoke VNet to forward all DNS queries to that custom DNS server. Since IP connectivity between the VNets is already verified, the spoke VM can resolve internal hostnames hosted on the hub DNS server. This is the standard method for cross-VNet DNS resolution when using a custom DNS server in a hub-and-spoke topology.

Answer

Create a private endpoint for web01.corp.contoso.local in the spoke VNet so DNS resolves automatically.

Answer

Enable gateway transit on the peering so the spoke inherits the hub VNet DNS configuration.

Answer

Add inbound and outbound NSG rules allowing UDP and TCP port 53 between the two VNets.

Question 10

Based on the exhibit, why is the administrator's HTTPS test still being denied, and what should be changed?

Accepted Answer

Move Allow-HTTPS-Admin to a priority lower than 200.. The administrator's HTTPS test is denied because Azure Network Security Groups (NSGs) process rules in priority order, from lowest to highest numeric value. The deny rule at priority 200 is evaluated before the allow rule at priority 300, so the HTTPS traffic is blocked. To allow HTTPS traffic, the allow rule must have a lower priority number (e.g., 100) than the deny rule, ensuring it is evaluated first. Option B correctly identifies that moving Allow-HTTPS-Admin to a priority lower than 200 (i.e., a smaller number) will allow the traffic before the deny rule is applied.

Answer

Increase the deny rule priority number from 200 to 300.

Answer

Change Allow-HTTPS-Admin to use protocol Any.

Answer

Assign a public IP address to the VM.

Question 11

Based on the exhibit, what should the administrator create so the storage account is reachable only by private IP from AppSubnet?

Accepted Answer

A private endpoint in AppSubnet for the storage account.. A private endpoint assigns a private IP address from the AppSubnet to the storage account, making it reachable only via private IP within that subnet. This ensures all traffic to the storage account stays within the Microsoft Azure backbone network, eliminating public internet exposure. The private endpoint uses Azure Private Link to map the storage account's PaaS resource to a network interface in the virtual network.

Answer

A service endpoint on AppSubnet for Microsoft.Storage.

Answer

A user-defined route to the storage account public IP.

Answer

An application security group that contains the storage account.

Question 12

A subnet is associated with a NAT gateway, but outbound traffic from the VMs still leaves through a network virtual appliance because the subnet has a user-defined route for 0.0.0.0/0 with next hop type Virtual appliance. The workload must use the NAT gateway for internet-bound traffic while keeping more specific routes intact. What should the administrator change?

Accepted Answer

Remove the 0.0.0.0/0 user-defined route from the subnet route table.. The NAT gateway is designed to provide outbound connectivity for VMs in the subnet, but a user-defined route (UDR) for 0.0.0.0/0 with next hop type Virtual appliance overrides the default route to the NAT gateway. By removing that UDR, the subnet's default route reverts to the system route, which directs internet-bound traffic to the NAT gateway's public IP. More specific routes (e.g., to on-premises networks) remain intact because they are not affected by the removal of the 0.0.0.0/0 route.

Answer

Disable the subnet's network security group so the NAT gateway can take effect.

Answer

Enable gateway route propagation on the route table.

Answer

Attach a public IP address to each virtual machine NIC.

Question 13

A subnet NSG contains these inbound rules: Deny-All-Inbound at priority 300, Allow-HTTPS-From-Bastion at priority 200, and Allow-HTTPS-From-AdminIP at priority 350. An administrator expects a management workstation on the internet to connect to a VM over TCP 443, but the connection is blocked. What is the most likely reason?

Accepted Answer

The deny rule at priority 300 is matched before the allow rule at priority 350.. NSG rules are evaluated in priority order, from the lowest priority number (highest priority) to the highest priority number (lowest priority). The Allow-HTTPS-From-AdminIP rule at priority 350 is evaluated after the Deny-All-Inbound rule at priority 300. Since the deny rule at priority 300 matches all inbound traffic before the allow rule at priority 350 is evaluated, the traffic is blocked. The administrator's connection from the internet is denied because the deny rule with a lower priority number (300) takes precedence over the allow rule with a higher priority number (350).

Answer

NSG rules are evaluated from the highest priority number to the lowest priority number.

Answer

Azure NSGs cannot allow inbound traffic from public IP addresses.

Answer

TCP 443 requires an application security group to be used as the source.

Question 14

Based on the exhibit, VM name resolution works for IP addresses but fails for internal hostnames. What should the administrator configure on the spoke VNet?

Accepted Answer

Configure the spoke VNet to use 10.20.0.4 as a custom DNS server.. The hub VNet uses a custom DNS server at 10.20.0.4 (likely a Windows Server with DNS role) that can resolve internal hostnames like app01.corp.local. The spoke VNet is currently using Azure-provided DNS, which cannot resolve custom private DNS zones. By configuring the spoke VNet to use 10.20.0.4 as a custom DNS server, the spoke VMs will forward DNS queries to the hub DNS server, enabling hostname resolution for internal resources.

Answer

Keep Azure-provided DNS because the spoke can already reach the hub by IP.

Answer

Create a private endpoint for app01.corp.local in the spoke VNet.

Answer

Enable a NAT gateway on the spoke subnet.

Question 15

A company has a hub virtual network with a DNS server VM at 10.50.0.4 that hosts internal names such as app01.corp.local. A spoke virtual network is already peered to the hub. VMs in the spoke can reach resources in the hub by IP address, but they cannot resolve the internal host names. The company wants to keep DNS centralized and avoid deploying another DNS server in the spoke. What should the administrator configure?

Accepted Answer

Set the spoke virtual network to use 10.50.0.4 as a custom DNS server.. The spoke virtual network must be configured to use the hub DNS server (10.50.0.4) as a custom DNS server. This ensures that all VMs in the spoke send DNS queries to the hub server, which hosts the internal zone for corp.local. Since the hub and spoke are already peered, DNS traffic can flow over the peering connection without additional routing, keeping DNS centralized.

Answer

Create a private DNS zone for corp.local and link it only to the spoke subnet.

Answer

Add a user-defined route in the spoke to send DNS traffic to the hub VNet.

Answer

Enable gateway transit on the peering and set use remote gateways on the spoke.