AZ-104 Implement and Manage Virtual Networking Practice Test 10 — 15 Questions

Question 1

Based on the exhibit, what should the administrator change so outbound internet traffic uses the NAT gateway?

Accepted Answer

Remove the 0.0.0.0/0 user-defined route to the virtual appliance.. The correct answer is B because the user-defined route (UDR) with destination 0.0.0.0/0 pointing to the virtual appliance is overriding the default route to the NAT gateway. For outbound internet traffic to use the NAT gateway, the 0.0.0.0/0 route must point to the NAT gateway's private IP address or be removed entirely so the system route to the NAT gateway takes precedence. Removing this UDR allows the NAT gateway to handle all outbound traffic from the subnet.

Answer

Detach the subnet from the NAT gateway.

Answer

Change the route table source address to 10.1.0.4.

Answer

Enable a service endpoint on the subnet.

Question 2

A subnet is connected to a NAT gateway, but outbound connections to a public software update site are still leaving through a network virtual appliance. The route table contains a 0.0.0.0/0 user-defined route to the appliance, and the business wants the NAT gateway to handle internet traffic while preserving private routes to the appliance. What is the best fix?

Accepted Answer

Remove the default UDR to the appliance and leave only the private-prefix routes in place.. The 0.0.0.0/0 user-defined route (UDR) to the network virtual appliance (NVA) has a higher priority than the NAT gateway's default route, so all internet-bound traffic is forced through the appliance. Removing that UDR while keeping private-prefix routes (e.g., 10.0.0.0/8) ensures that only private traffic uses the appliance, and internet traffic follows the NAT gateway's default route. This satisfies the business requirement of using the NAT gateway for internet traffic while preserving private routes through the NVA.

Answer

Increase the priority of the NSG rules on the subnet.

Answer

Associate the NAT gateway with the virtual network instead of the subnet.

Answer

Enable service endpoints on the subnet to bypass the appliance.

Question 3

A branch office has a single edge device with a static public IP and must connect securely to Azure so users can reach private VMs in a virtual network. The company wants traffic encrypted across the internet and does not need point-to-site access from individual laptops. Which solution should the administrator deploy?

Accepted Answer

A site-to-site VPN gateway connection.. A site-to-site VPN gateway connection (Option B) is correct because it creates an encrypted tunnel over the internet between the branch office's edge device with a static public IP and an Azure VPN gateway, allowing users to securely access private VMs in the virtual network. This solution meets the requirement for encrypted traffic across the internet without needing point-to-site access for individual laptops, as the entire branch network is connected via the VPN tunnel.

Answer

A point-to-site VPN configuration for each user laptop.

Answer

A private endpoint to each virtual machine in Azure.

Answer

VNet peering between the branch and Azure.

Question 4

A three-tier application uses separate web and app VMs. The requirement is to allow only the web tier to reach the app tier on TCP 8080. The app subnet NSG already contains a DenyAllInbound rule at priority 200. What should the administrator do?

Accepted Answer

Create an inbound allow rule for the web ASG to the app ASG on TCP 8080 with priority 150.. Option A is correct because the existing DenyAllInbound rule at priority 200 will block all traffic to the app subnet unless a higher-priority (lower number) allow rule is created. By creating an inbound allow rule for the web Application Security Group (ASG) to the app ASG on TCP 8080 with priority 150, the administrator ensures that traffic from the web tier is explicitly permitted before the deny rule is evaluated, satisfying the requirement.

Answer

Move the DenyAllInbound rule to priority 300 so all traffic is blocked first.

Answer

Add a user-defined route from the web subnet to the app subnet.

Answer

Associate the web and app NICs with the same application security group.

Question 5

A company plans a new spoke virtual network that must be peered to an existing hub VNet using 10.0.0.0/16. The spoke will need two subnets: one sized for about 120 VMs and another for about 40 VMs. The new address space must not overlap the hub or the on-premises range 10.1.0.0/16. Which VNet address space is the best choice?

Accepted Answer

10.2.0.0/22. Option C (10.2.0.0/22) is correct because it provides a non-overlapping address space with the hub VNet (10.0.0.0/16) and on-premises (10.1.0.0/16). The /22 prefix offers 1024 IP addresses, which is sufficient for subnets supporting 120 VMs and 40 VMs, while avoiding any overlap with the existing ranges.

Answer

10.0.1.0/24

Answer

10.1.0.0/22

Answer

10.0.0.0/24

Question 6

A storage account already has a private endpoint for Blob service in a VNet. Virtual machines in AppSubnet still resolve the account name to the public endpoint, so traffic never reaches the private IP. Which two actions should the administrator take? Select two.

Accepted Answer

Create a private DNS zone for privatelink.blob.core.windows.net.. Option A is correct because a private DNS zone for `privatelink.blob.core.windows.net` is required to override the default public DNS resolution for the storage account. When a private endpoint is created, the storage account's FQDN (e.g., `mystorageaccount.blob.core.windows.net`) must resolve to the private IP address of the endpoint within the VNet. Without this DNS zone, the VM in AppSubnet will continue to resolve the name to the public IP via Azure's public DNS servers, bypassing the private endpoint.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet.

Answer

Set the storage account firewall to Selected networks without a private endpoint.

Answer

Assign a static public IP to the private endpoint.

Question 7

An administrator added an NSG rule named Allow-Admin-HTTPS with priority 250 to permit inbound TCP 443 from a single public IP. The NSG also contains a Deny-All-Inbound rule with priority 200. The administrator still cannot connect to the VM over HTTPS from the allowed IP. What should be changed to resolve the issue?

Accepted Answer

Change the allow rule priority to a number lower than 200.. The Deny-All-Inbound rule with priority 200 is evaluated before the Allow-Admin-HTTPS rule with priority 250 because NSG rules are processed in order of ascending priority (lower numbers are evaluated first). Since the deny rule matches all inbound traffic, it blocks the HTTPS connection before the allow rule can be evaluated. To resolve this, the allow rule must have a priority lower than 200 (e.g., 150) so it is evaluated first and permits the traffic from the specified public IP.

Answer

Change the deny rule priority to 65000 so it is evaluated first.

Answer

Convert the allow rule to an outbound rule instead of inbound.

Answer

Replace the NSG with a route table so HTTPS can pass through the subnet.

Question 8

A storage account must be reachable only from resources in a specific Azure subnet, and connections must not use the public endpoint. Which option should the administrator configure?

Accepted Answer

A private endpoint for the storage account in the subnet.. A private endpoint assigns the storage account a private IP address from the subnet, effectively bringing the service into the virtual network. This ensures all traffic to the storage account stays within the Microsoft Azure backbone and never traverses the public internet, meeting the requirement that connections must not use the public endpoint.

Answer

A service endpoint on the subnet, because it keeps traffic on the Azure backbone.

Answer

A NAT gateway attached to the subnet.

Answer

A storage firewall rule that allows all Azure services.

Question 9

A storage account should use a private IP address inside a virtual network, and workloads in that VNet must resolve the storage name to the private address. Which two items are required? Select two.

Accepted Answer

Create a private endpoint for the storage account in the virtual network so the service gets a private IP.. Option A is correct because a private endpoint assigns a private IP address from the virtual network to the storage account, enabling secure, direct connectivity over the Microsoft backbone without traversing the public internet. This is achieved by creating a network interface in the VNet that receives a private IP from the subnet range, which then routes traffic to the storage service via a private link.

Answer

Enable a service endpoint on the subnet, because service endpoints create a private IP for the storage service.

Answer

Assign a Reader role on the storage account, because RBAC determines the private address used by clients.

Answer

Disable the storage account firewall, because private endpoints only work when the public endpoint is open.

Question 10

A storage account must be reachable only from one Azure virtual network. The team wants the storage service to have a private IP in that VNet, public network access disabled, and name resolution to work without using the public endpoint. What should the administrator configure?

Accepted Answer

A private endpoint and a private DNS zone linked to the VNet. A private endpoint assigns the storage account a private IP from the VNet's address space, making it reachable only within that VNet. Disabling public network access ensures no traffic can reach the storage account via its public endpoint. A private DNS zone linked to the VNet enables name resolution to resolve the storage account's FQDN to the private IP without using the public endpoint.

Answer

A service endpoint on the subnet and a storage firewall rule

Answer

A public IP address and IP-based firewall exceptions

Answer

A shared access signature and blob container ACLs

Question 11

A storage account must be reachable only from workloads in one Azure subnet. The team wants to keep using the storage account's public FQDN, avoid creating a private IP address in the virtual network, and avoid managing private DNS zones. What should the administrator configure?

Accepted Answer

A service endpoint on the subnet and a storage firewall rule for that subnet. A service endpoint on the subnet and a storage firewall rule for that subnet is correct because it allows the storage account to be reachable only from workloads in one Azure subnet while still using the storage account's public FQDN. Service endpoints extend the virtual network identity to the storage account over the Microsoft backbone, and the firewall rule restricts access to that specific subnet. This avoids creating a private IP address in the virtual network and eliminates the need to manage private DNS zones, as the public endpoint is retained.

Answer

A private endpoint for the storage account

Answer

An NSG rule that allows TCP 443 to the storage account

Answer

An application security group tied to the storage account

Question 12

A company is building a hub-and-spoke Azure network. The hub VNet already uses 10.50.0.0/16. A new spoke VNet will later be peered to the hub and connected to on-premises through VPN. What is the most important planning step before creating the peering?

Accepted Answer

Choose a non-overlapping address space for the spoke and reserve room for future subnets.. Option B is correct because Azure VNet peering requires non-overlapping address spaces to establish connectivity. If the spoke uses the same address space as the hub (10.50.0.0/16), routing conflicts will occur, and the peering will fail or cause unpredictable traffic behavior. Additionally, reserving room for future subnets ensures the spoke can scale without needing to re-architect the network.

Answer

Reuse 10.50.0.0/16 in the spoke so routing to the hub is simpler.

Answer

Create a route table first so peering can learn the spoke routes.

Answer

Enable a service endpoint to allow the spoke to communicate with the hub.

Question 13

A web tier and a backend tier are deployed in separate subnets. Backend VMs are rebuilt regularly, so their private IP addresses change. The web tier must reach the backend on TCP 8443, and administrators do not want to update NSG rules whenever a backend VM is replaced. What should be used in the NSG rule?

Accepted Answer

Application security groups for both tiers, because they track the VMs even when IP addresses change.. Option C is correct because Application Security Groups (ASGs) allow you to group VMs logically and reference them in NSG rules. When backend VMs are rebuilt and their private IPs change, the ASG membership (based on the VM's NIC configuration) remains intact, so the NSG rule continues to apply without manual updates. This decouples security rules from dynamic IP addresses.

Answer

The backend subnet CIDR, because subnet ranges never change during VM rebuilds.

Answer

The AzureLoadBalancer service tag, because it identifies internal traffic between tiers.

Answer

A user-defined route to the backend subnet, because route tables follow the VM even if the IP changes.

Question 14

A subnet already has a user-defined default route (0.0.0.0/0) that sends all outbound traffic to a network virtual appliance. The administrator now needs traffic to the on-premises network 10.50.0.0/16 to use the VPN gateway instead of the appliance. What should be added to the route table?

Accepted Answer

Add a user-defined route for 10.50.0.0/16 with next hop type Virtual network gateway. Option B is correct because adding a user-defined route (UDR) for the specific prefix 10.50.0.0/16 with next hop type 'Virtual network gateway' creates a more specific route (longest prefix match) than the existing default route (0.0.0.0/0). This ensures traffic destined for the on-premises network is forwarded to the VPN gateway instead of the network virtual appliance, while all other outbound traffic continues to use the appliance.

Answer

Remove the default route so the system route to the VPN gateway is used

Answer

Change the subnet address space to a smaller CIDR block

Answer

Enable a service endpoint for the on-premises prefix

Question 15

A backend VM must accept TCP 8443 only from the web tier. The subnet NSG already has a deny-all inbound rule at priority 200. The administrator adds an allow rule for the web tier at priority 300, but the connection still fails. What should be changed?

Accepted Answer

Change the allow rule to a lower priority number than 200.. Azure Network Security Groups (NSGs) process rules in priority order, with lower numbers evaluated first. The existing deny-all inbound rule at priority 200 is evaluated before the new allow rule at priority 300, so the deny rule blocks the traffic before the allow rule can be considered. To permit TCP 8443 from the web tier, the allow rule must have a priority number lower than 200 (e.g., 100) so it is evaluated first and allows the traffic.

Answer

Change the allow rule protocol from TCP to Any.

Answer

Move the VM to a different subnet so the rule can apply.

Answer

Add a route table entry for TCP 8443 to bypass the NSG.

AZ-104 Implement and Manage Virtual Networking Practice Test 10 — 15 Questions

Exhibit

AZ-104 Implement and Manage Virtual Networking Practice Test 10 — 15 Questions

Exhibit