AZ-104 Implement and Manage Virtual Networking Practice Test 11 — 15 Questions

Question 1

Based on the exhibit, which subnet prefix is the smallest that can support the planned resources in Azure?

Accepted Answer

/26. The subnet prefix /26 provides 64 IP addresses per subnet (2^(32-26) = 64), of which 59 are usable after Azure reserves 5 addresses (first 4 and last 1). The planned resources require 50 IP addresses, so /26 is the smallest prefix that meets this requirement without waste. A /27 would only provide 32 total addresses (27 usable), which is insufficient.

Answer

/27

Answer

/25

Answer

/24

Question 2

A company is creating a new spoke virtual network that will be peered to an existing hub VNet. The hub uses 10.40.0.0/16, and an on-premises network already uses 10.41.0.0/16. The spoke must support about 120 endpoints now and should allow room for growth. Which address space should you assign to the new spoke VNet?

Accepted Answer

10.42.0.0/24. Option B (10.42.0.0/24) is correct because it provides 256 IP addresses (251 usable) for the spoke, which exceeds the requirement of ~120 endpoints with room for growth, and it does not overlap with the hub VNet (10.40.0.0/16) or the on-premises network (10.41.0.0/16). This ensures successful VNet peering without IP address conflicts.

Answer

10.40.64.0/25

Answer

10.41.128.0/24

Answer

192.168.10.0/26

Question 3

Based on the exhibit, what next hop will the VM use when it sends traffic to 10.30.5.10?

Accepted Answer

Virtual network gateway. The VM's effective route table shows a route for 10.30.5.0/24 with a next hop type of 'Virtual network gateway'. Since 10.30.5.10 falls within this prefix, the VM will use the virtual network gateway as the next hop. This overrides the default virtual network (local) route because it is a more specific prefix match.

Answer

Virtual appliance at the user-defined next hop

Answer

Internet

Answer

Virtual network

Question 4

A VM in VNet A can reach a storage account through a private endpoint, but when the VM resolves the storage account name it still gets the public IP address. What should you configure so name resolution returns the private endpoint address?

Accepted Answer

The private DNS zone linked to the VNet. When a private endpoint is created for a storage account, the DNS configuration must be updated so that the storage account's fully qualified domain name resolves to the private endpoint's private IP address instead of the public IP. Linking a private DNS zone (privatelink.blob.core.windows.net) to the virtual network and configuring a virtual network link ensures that the VM's DNS queries for the storage account are answered with the private endpoint IP. Without this, the VM continues to use the public IP from public DNS.

Answer

A user-defined route to the storage private endpoint

Answer

A resource lock on the storage account

Answer

A managed identity for the VM

Question 5

A company already uses the address space 10.20.0.0/16 for a hub virtual network and 10.21.0.0/16 on-premises. A new spoke virtual network will be peered to the hub and may later connect to the on-premises network. Which address space should the administrator choose for the spoke to avoid future routing conflicts?

Accepted Answer

10.22.0.0/16. Option C (10.22.0.0/16) is correct because it is a unique, non-overlapping address space that does not conflict with the existing hub VNet (10.20.0.0/16) or the on-premises network (10.21.0.0/16). When a spoke VNet is peered to the hub and later connected to on-premises via VPN or ExpressRoute, Azure requires that all peered and connected address spaces be unique to avoid routing conflicts. Choosing a completely separate /16 ensures no future overlap.

Answer

10.20.64.0/19

Answer

10.21.0.0/16

Answer

10.20.128.0/17

Question 6

A storage account must be reachable only from a single subnet. The team wants to keep the storage public endpoint in place, avoid a private endpoint, and avoid managing any custom DNS records. Which change best meets the requirement?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account firewall allow list.. Option B is correct because enabling a service endpoint for Microsoft.Storage on the subnet injects the subnet's identity into the traffic to the storage account, allowing the storage account firewall to permit access only from that subnet while keeping the public endpoint active. This avoids the need for a private endpoint, custom DNS records, or additional routing appliances, directly meeting the requirement of restricting access to a single subnet.

Answer

Add a network security group rule to the subnet that allows outbound TCP 443 to the storage account.

Answer

Create a private endpoint and set the storage account to use a private DNS zone.

Answer

Create a route table that sends storage traffic through an Azure Firewall appliance.

Question 7

A subnet NSG contains these inbound rules: Priority 100 denies TCP 8443 from VirtualNetwork to any destination, Priority 110 allows TCP 8443 from AzureLoadBalancer to any destination, and Priority 200 allows TCP 8443 from ASG-Web to ASG-App. The app VM NIC has no additional inbound rules. Web servers are members of ASG-Web and the app VM is a member of ASG-App. The web tier still cannot connect to TCP 8443. What should the administrator change?

Accepted Answer

Move the allow rule for ASG-Web to ASG-App to a priority lower than 100.. The correct answer is A because NSG rules are evaluated in priority order, from lowest to highest number. The deny rule at priority 100 explicitly blocks TCP 8443 from VirtualNetwork, which includes traffic from ASG-Web (since ASG-Web members are within the virtual network). The allow rule at priority 110 only permits traffic from AzureLoadBalancer, not from ASG-Web. The allow rule at priority 200 is never evaluated because the deny rule at priority 100 matches first. By moving the allow rule for ASG-Web to ASG-App to a priority lower than 100 (e.g., 90), it will be evaluated before the deny rule, allowing the web servers to connect.

Answer

Replace ASG-Web with the VirtualNetwork service tag in the allow rule.

Answer

Add a route table that sends TCP 8443 traffic to the app subnet.

Answer

Create a second NSG on the app NIC with an allow rule at priority 50.

Question 8

A VM cannot connect to another VM on TCP 1433. You need to determine whether an NSG is blocking the flow and identify which rule applies. Which Network Watcher tool should you use?

Accepted Answer

IP flow verify. IP flow verify is the correct Network Watcher tool because it tests whether a packet is allowed or denied to or from a specific VM, based on a 5-tuple (source IP, destination IP, protocol, source port, destination port). For TCP 1433 (SQL Server), you can specify the exact flow parameters, and IP flow verify will evaluate all effective security rules, including NSG rules, and return the specific rule that allowed or denied the traffic.

Answer

Packet capture

Answer

Connection troubleshoot

Answer

Effective routes

Question 9

A VM sends traffic to 172.16.5.10, but the administrator suspects the traffic is taking an unexpected next hop. They want to see the effective route table applied to the VM NIC, including system routes, user-defined routes, and propagated routes. Which Network Watcher tool should be used?

Accepted Answer

Effective routes. Effective routes is the correct Network Watcher tool because it displays the complete route table applied to a VM NIC, including system routes, user-defined routes (UDRs), and BGP-propagated routes from virtual network gateways. This allows the administrator to see exactly which next hop is selected for traffic to 172.16.5.10 based on the longest prefix match, identifying any unexpected routing behavior.

Answer

IP flow verify

Answer

Packet capture

Answer

Connection troubleshoot

Question 10

A subnet has a user-defined route for 0.0.0.0/0 that sends traffic to a network virtual appliance at 10.10.1.4. The VM in the subnet still reaches an Azure Storage account using the public endpoint, but the administrator expected all outbound traffic to go through the NVA. What is the most likely reason?

Accepted Answer

The storage account traffic is using a more specific route than the 0.0.0.0/0 route.. The most likely reason is that the storage account traffic is using a more specific route than the 0.0.0.0/0 route. Azure uses longest prefix match routing, so a route with a smaller prefix (e.g., a specific public IP range for Azure Storage) will take precedence over the default route. The 0.0.0.0/0 route only applies when no more specific route exists, and Azure automatically adds platform routes for Azure services like Storage, which can override user-defined routes.

Answer

Azure always ignores user-defined routes for storage traffic.

Answer

NSG outbound rules override user-defined routes in Azure.

Answer

The subnet needs a public IP address assigned to each VM for the route to take effect.

Question 11

Based on the exhibit, which Network Watcher tool should the administrator use to identify the exact NSG rule that is blocking TCP 1433 traffic?

Accepted Answer

IP flow verify. IP flow verify is the correct Network Watcher tool because it tests whether a packet is allowed or denied to or from a specific virtual machine based on a 5-tuple (source IP, destination IP, source port, destination port, and protocol). By specifying TCP 1433 as the destination port, the tool evaluates all effective security rules (NSG and ASG) and returns the exact rule name and direction that is blocking the traffic.

Answer

Connection troubleshoot

Answer

Next hop

Answer

Packet capture

Question 12

Based on the exhibit, what should the administrator change to allow only the web tier to reach the app tier on TCP 8443?

Accepted Answer

Move the allow rule for WebTier-ASG to a priority lower than 100.. The exhibit shows a default-deny NSG rule at priority 100 that blocks all traffic from VirtualNetwork to VirtualNetwork. To allow only the web tier (WebTier-ASG) to reach the app tier (AppTier-ASG) on TCP 8443, the administrator must move the allow rule for WebTier-ASG to a priority lower than 100 (e.g., 90). This ensures the allow rule is evaluated before the deny rule, as NSG rules are processed in priority order (lowest number first).

Answer

Change the deny rule source from VirtualNetwork to Internet.

Answer

Associate the NSG with the virtual machine NIC instead of the subnet.

Answer

Replace the ASG destination with the subnet address range.

Question 13

Which two statements about application security groups and service tags are correct? Select two.

Accepted Answer

An application security group lets you reference a set of virtual machines in NSG rules.. Option A is correct because an application security group (ASG) allows you to group virtual machines logically, and then reference that group as a source or destination in network security group (NSG) rules. This simplifies rule management by decoupling the rule from individual VM IP addresses or NICs, enabling dynamic membership based on application tiers.

Answer

Application security groups are used to assign Azure roles.

Answer

Service tags are custom labels you create for your own subscriptions.

Answer

Service tags create a private IP address for a service.

Question 14

A company wants to peer a new spoke virtual network to an existing hub VNet. The hub uses 10.40.0.0/16, and the new spoke was created with 10.40.128.0/17 because that range seemed available in the branch office plan. Peering creation fails. What should the administrator do?

Accepted Answer

Change the spoke VNet to a non-overlapping address space before peering.. VNet peering requires that the address spaces of the peered virtual networks do not overlap. The hub uses 10.40.0.0/16, and the spoke uses 10.40.128.0/17, which is a subset of the hub’s range. Azure blocks peering when there is any overlap to prevent routing conflicts. The correct fix is to change the spoke VNet to a non-overlapping address space, such as a different RFC 1918 range like 10.1.0.0/16, before attempting to peer.

Answer

Add a second address prefix to the spoke VNet and keep the overlapping range.

Answer

Enable gateway transit on the hub VNet before retrying peering.

Answer

Create custom DNS records for the spoke VNet so the address ranges no longer conflict.

Question 15

A storage account has a blob private endpoint in VNet-A. A VM in peered VNet-B can reach the storage account by private IP, but name resolution for the storage account still returns the public IP address. The private DNS zone privatelink.blob.core.windows.net is already linked only to VNet-A. What should the administrator do next?

Accepted Answer

Create a virtual network link from the private DNS zone to VNet-B.. The private DNS zone `privatelink.blob.core.windows.net` is linked only to VNet-A, so VMs in VNet-B cannot resolve the storage account's FQDN to its private IP. By creating a virtual network link from the private DNS zone to VNet-B, the zone's records become available for resolution in VNet-B, allowing the VM to resolve the storage FQDN to the private endpoint's IP address instead of the public IP.

Answer

Create a second private endpoint in VNet-B for the same storage account.

Answer

Enable a service endpoint on VNet-B and remove the private endpoint.

Answer

Add a user-defined route in VNet-B that points the storage FQDN to the private IP.

AZ-104 Implement and Manage Virtual Networking Practice Test 11 — 15 Questions

Exhibit

AZ-104 Implement and Manage Virtual Networking Practice Test 11 — 15 Questions

Exhibit