AZ-104 Implement and Manage Virtual Networking Practice Test 11 — 15 Questions

Question 1

A branch office with a fixed public IP needs encrypted access to private Azure virtual machines and internal services in a VNet. Traffic must travel across the public internet in an encrypted tunnel, and the connection should use a route-based design. What should the administrator deploy in Azure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A VPN gateway with a site-to-site connection.. A VPN gateway with a site-to-site connection is the correct choice because it establishes an encrypted IPSec tunnel over the public internet between the branch office's fixed public IP and Azure, using a route-based (IKEv2) configuration. This allows the branch office to securely access private Azure VMs and internal services in the VNet, meeting the requirement for encrypted traffic across the internet.

Answer

An Azure Virtual Network peering connection to the branch office network.

Answer

A service endpoint on the target subnet.

Answer

An Azure private endpoint for the virtual machines.

Question 2

Based on the exhibit, what is the best change so the VNet peering can be created successfully?

Accepted Answer

Change VNet-B to a non-overlapping address space, such as 10.1.0.0/24.. VNet peering requires that the address spaces of the two virtual networks do not overlap. If VNet-A uses 10.0.0.0/16 and VNet-B also uses 10.0.0.0/16, they conflict, preventing peering. Changing VNet-B to a non-overlapping address space like 10.1.0.0/24 resolves this conflict, allowing the peering to be established.

Answer

Add a route table to VNet-B before creating the peering.

Answer

Enable gateway transit on VNet-A.

Answer

Resize VNet-A to 10.0.0.0/15 so both VNets fit.

Question 3

A team manages 20 web VMs and 15 app VMs that scale independently. The administrator needs an NSG rule that allows only the web tier to reach the app tier on TCP 8443, and future VM additions must be included automatically without editing IP addresses. What should the administrator use in the NSG rule?

Accepted Answer

A source application security group for the web tier and a destination application security group for the app tier.. Application security groups (ASGs) allow you to define network security rules based on logical groupings of VMs, regardless of their IP addresses. By assigning the web tier VMs to a source ASG and the app tier VMs to a destination ASG, the NSG rule automatically includes any new VMs added to those groups, meeting the requirement for dynamic inclusion without manual IP edits.

Answer

A service endpoint on the subnet where the app VMs are deployed.

Answer

A user-defined route between the web subnet and app subnet.

Answer

A load balancer backend pool for both tiers.

Question 4

An administrator creates a new spoke virtual network with address space 10.100.1.0/24 and tries to peer it to an existing hub virtual network that already uses 10.100.0.0/16. The peering fails. The business wants private connectivity between the hub and spoke. What action should the administrator take first?

Accepted Answer

Change the spoke VNet to a non-overlapping address range before attempting peering again.. VNet peering requires that the address spaces of the peered virtual networks do not overlap. The hub already uses 10.100.0.0/16, which includes the spoke's 10.100.1.0/24 range, causing a conflict. Changing the spoke to a non-overlapping address range, such as 10.200.1.0/24, resolves this and allows the peering to succeed.

Answer

Add a route table to the spoke and point the default route to the hub.

Answer

Enable gateway transit on the hub and use the remote gateway from the spoke.

Answer

Deploy a private DNS zone and link it to both VNets.

Question 5

Based on the exhibit, what should the administrator create so VMs in AppSubnet can access the storage account over a private IP address?

Accepted Answer

A private endpoint for the storage account in AppSubnet.. A private endpoint assigns a private IP address from AppSubnet to the storage account, enabling VMs in that subnet to access the storage account over a private IP within the VNet. This eliminates exposure to the public internet and uses Azure Private Link for secure, direct connectivity.

Answer

A service endpoint for Microsoft.Storage on AppSubnet.

Answer

A site-to-site VPN gateway between AppVNet and the storage account.

Answer

An application security group for the storage account and subnet.

Question 6

A subnet has a user-defined route for 0.0.0.0/0 that sends all outbound traffic to a network virtual appliance for inspection. The business now attaches a NAT gateway to the subnet and wants internet-bound traffic to use the NAT gateway's public IP, while traffic to private corporate prefixes should still go to the appliance. What should the administrator change?

Accepted Answer

Remove the 0.0.0.0/0 UDR and add only the specific private-prefix routes that must go to the appliance.. The 0.0.0.0/0 user-defined route (UDR) sends all outbound traffic to the network virtual appliance (NVA). A NAT gateway provides outbound connectivity with a public IP, but it only takes effect when there is no explicit 0.0.0.0/0 route overriding it. By removing the 0.0.0.0/0 UDR and adding only specific private-prefix routes (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) pointing to the NVA, internet-bound traffic will use the NAT gateway (via its default route), while corporate traffic is still forced through the appliance.

Answer

Leave the route table unchanged because the NAT gateway always overrides a default UDR.

Answer

Disable source NAT on the network virtual appliance.

Answer

Create a private endpoint for internet traffic so outbound packets stay in Azure.

Question 7

A development team runs Windows and Linux VMs in a single Azure subnet. The VMs must access an Azure Storage account, and the security team wants to restrict the storage account so only that subnet can reach it. The team does not want to create a private IP for the storage account or change DNS records. What should the administrator configure?

Accepted Answer

A service endpoint on the subnet and a storage account network rule allowing that subnet.. A service endpoint extends the subnet's identity to the storage account, allowing the storage firewall to accept traffic from that subnet without assigning a private IP. This meets the security requirement of restricting access to only that subnet while avoiding private IPs or DNS changes.

Answer

A private endpoint for the storage account and a private DNS zone.

Answer

A site-to-site VPN between the subnet and the storage account.

Answer

A user-defined route that sends storage traffic to the default internet next hop.

Question 8

A company has a hub VNet and two peered spoke VNets, AppSpoke and DataSpoke. Both spokes can reach on-premises networks through the hub gateway. The app VM in AppSpoke must connect privately to the data VM in DataSpoke without using the internet or sending traffic on-premises first. What should the administrator do?

Accepted Answer

Create a direct VNet peering between AppSpoke and DataSpoke.. A direct VNet peering between AppSpoke and DataSpoke establishes a private, low-latency connection between the two VNets without routing traffic through the hub gateway or on-premises networks. This satisfies the requirement for a private connection that does not use the internet or traverse on-premises, as VNet peering uses the Microsoft backbone infrastructure.

Answer

Add an NSG rule that allows traffic from AppSpoke to DataSpoke.

Answer

Enable gateway transit on both spoke peerings.

Answer

Add a user-defined route in AppSpoke pointing DataSpoke traffic to the hub gateway.

Question 9

Remote administrators work from home laptops and need secure access to Azure VMs in a virtual network. There is no branch office device to configure, and each administrator should connect individually using Azure-side VPN authentication. Which option should be implemented?

Accepted Answer

A point-to-site VPN connection to an Azure VPN gateway.. A point-to-site (P2S) VPN connection allows individual remote clients to connect securely to an Azure virtual network using an Azure VPN gateway. This solution requires no on-premises device, supports per-user authentication (e.g., Azure AD, certificate, or RADIUS), and is ideal for ad-hoc remote access from home laptops.

Answer

VNet peering between the administrators' home networks and Azure.

Answer

An ExpressRoute circuit from each administrator's home internet connection.

Answer

A service endpoint enabled on the VM subnet.

Question 10

Based on the exhibit, what configuration should the administrator change so VMs in the spoke can resolve internal names from the hub?

Accepted Answer

Set the spoke VNet custom DNS server to 10.50.0.4.. The hub VNet has a DNS server at 10.50.0.4 that is configured to resolve internal names. By setting the spoke VNet's custom DNS server to 10.50.0.4, VMs in the spoke will forward DNS queries to that server, enabling resolution of internal names from the hub. This overrides the default Azure-provided DNS and directs name resolution to the hub's DNS infrastructure.

Answer

Add a route table entry that points to the hub DNS server.

Answer

Enable a service endpoint for Microsoft.Storage on the spoke subnet.

Answer

Create a private endpoint for the spoke VM subnet.

Question 11

A subnet is connected to a NAT gateway, but outbound connections to a public software update site are still leaving through a network virtual appliance. The route table contains a 0.0.0.0/0 user-defined route to the appliance, and the business wants the NAT gateway to handle internet traffic while preserving private routes to the appliance. What is the best fix?

Accepted Answer

Remove the default UDR to the appliance and leave only the private-prefix routes in place.. The 0.0.0.0/0 user-defined route (UDR) to the network virtual appliance (NVA) has a higher priority than the NAT gateway's default route, so all internet-bound traffic is forced through the appliance. Removing that UDR while keeping private-prefix routes (e.g., 10.0.0.0/8) ensures that only private traffic uses the appliance, and internet traffic follows the NAT gateway's default route. This satisfies the business requirement of using the NAT gateway for internet traffic while preserving private routes through the NVA.

Answer

Increase the priority of the NSG rules on the subnet.

Answer

Associate the NAT gateway with the virtual network instead of the subnet.

Answer

Enable service endpoints on the subnet to bypass the appliance.

Question 12

A branch office has a single edge device with a static public IP and must connect securely to Azure so users can reach private VMs in a virtual network. The company wants traffic encrypted across the internet and does not need point-to-site access from individual laptops. Which solution should the administrator deploy?

Accepted Answer

A site-to-site VPN gateway connection.. A site-to-site VPN gateway connection (Option B) is correct because it creates an encrypted tunnel over the internet between the branch office's edge device with a static public IP and an Azure VPN gateway, allowing users to securely access private VMs in the virtual network. This solution meets the requirement for encrypted traffic across the internet without needing point-to-site access for individual laptops, as the entire branch network is connected via the VPN tunnel.

Answer

A point-to-site VPN configuration for each user laptop.

Answer

A private endpoint to each virtual machine in Azure.

Answer

VNet peering between the branch and Azure.

Question 13

A three-tier application uses separate web and app VMs. The requirement is to allow only the web tier to reach the app tier on TCP 8080. The app subnet NSG already contains a DenyAllInbound rule at priority 200. What should the administrator do?

Accepted Answer

Create an inbound allow rule for the web ASG to the app ASG on TCP 8080 with priority 150.. The existing DenyAllInbound rule at priority 200 will block all traffic to the app subnet unless a higher-priority (lower number) allow rule is created. By creating an inbound allow rule for the web Application Security Group (ASG) to the app ASG on TCP 8080 with priority 150, the administrator ensures that traffic from the web tier is explicitly permitted before the deny rule is evaluated, satisfying the requirement.

Answer

Move the DenyAllInbound rule to priority 300 so all traffic is blocked first.

Answer

Add a user-defined route from the web subnet to the app subnet.

Answer

Associate the web and app NICs with the same application security group.

Question 14

A company plans a new spoke virtual network that must be peered to an existing hub VNet using 10.0.0.0/16. The spoke will need two subnets: one sized for about 120 VMs and another for about 40 VMs. The new address space must not overlap the hub or the on-premises range 10.1.0.0/16. Which VNet address space is the best choice?

Accepted Answer

10.2.0.0/22. (10.2.0.0/22) is correct because it provides a non-overlapping address space with the hub VNet (10.0.0.0/16) and on-premises (10.1.0.0/16). The /22 prefix offers 1024 IP addresses, which is sufficient for subnets supporting 120 VMs and 40 VMs, while avoiding any overlap with the existing ranges.

Answer

10.0.1.0/24

Answer

10.1.0.0/22

Answer

10.0.0.0/24

Question 15

A storage account already has a private endpoint for Blob service in a VNet. Virtual machines in AppSubnet still resolve the account name to the public endpoint, so traffic never reaches the private IP. Which two actions should the administrator take? Select two.

Accepted Answer

Create a private DNS zone for privatelink.blob.core.windows.net.. A private DNS zone for `privatelink.blob.core.windows.net` is required to override the default public DNS resolution for the storage account. When a private endpoint is created, the storage account's FQDN (e.g., `mystorageaccount.blob.core.windows.net`) must resolve to the private IP address of the endpoint within the VNet. Without this DNS zone, the VM in AppSubnet will continue to resolve the name to the public IP via Azure's public DNS servers, bypassing the private endpoint.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet.

Answer

Set the storage account firewall to Selected networks without a private endpoint.

Answer

Assign a static public IP to the private endpoint.