AZ-104 Implement and Manage Virtual Networking Practice Test 12 — 15 Questions

Question 1

An administrator added an NSG rule named Allow-Admin-HTTPS with priority 250 to permit inbound TCP 443 from a single public IP. The NSG also contains a Deny-All-Inbound rule with priority 200. The administrator still cannot connect to the VM over HTTPS from the allowed IP. What should be changed to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the allow rule priority to a number lower than 200.. The Deny-All-Inbound rule with priority 200 is evaluated before the Allow-Admin-HTTPS rule with priority 250 because NSG rules are processed in order of ascending priority (lower numbers are evaluated first). Since the deny rule matches all inbound traffic, it blocks the HTTPS connection before the allow rule can be evaluated. To resolve this, the allow rule must have a priority lower than 200 (e.g., 150) so it is evaluated first and permits the traffic from the specified public IP.

Answer

Change the deny rule priority to 65000 so it is evaluated first.

Answer

Convert the allow rule to an outbound rule instead of inbound.

Answer

Replace the NSG with a route table so HTTPS can pass through the subnet.

Question 2

A storage account must be reachable only from resources in a specific Azure subnet, and connections must not use the public endpoint. Which option should the administrator configure?

Accepted Answer

A private endpoint for the storage account in the subnet.. A private endpoint assigns the storage account a private IP address from the subnet, effectively bringing the service into the virtual network. This ensures all traffic to the storage account stays within the Microsoft Azure backbone and never traverses the public internet, meeting the requirement that connections must not use the public endpoint.

Answer

A service endpoint on the subnet, because it keeps traffic on the Azure backbone.

Answer

A NAT gateway attached to the subnet.

Answer

A storage firewall rule that allows all Azure services.

Question 3

A storage account should use a private IP address inside a virtual network, and workloads in that VNet must resolve the storage name to the private address. Which two items are required? Select two.

Accepted Answer

Create a private endpoint for the storage account in the virtual network so the service gets a private IP.. A private endpoint assigns a private IP address from the virtual network to the storage account, enabling secure, direct connectivity over the Microsoft backbone without traversing the public internet. This is achieved by creating a network interface in the VNet that receives a private IP from the subnet range, which then routes traffic to the storage service via a private link.

Answer

Enable a service endpoint on the subnet, because service endpoints create a private IP for the storage service.

Answer

Assign a Reader role on the storage account, because RBAC determines the private address used by clients.

Answer

Disable the storage account firewall, because private endpoints only work when the public endpoint is open.

Question 4

A storage account must be reachable only from one Azure virtual network. The team wants the storage service to have a private IP in that VNet, public network access disabled, and name resolution to work without using the public endpoint. What should the administrator configure?

Accepted Answer

A private endpoint and a private DNS zone linked to the VNet. A private endpoint assigns the storage account a private IP from the VNet's address space, making it reachable only within that VNet. Disabling public network access ensures no traffic can reach the storage account via its public endpoint. A private DNS zone linked to the VNet enables name resolution to resolve the storage account's FQDN to the private IP without using the public endpoint.

Answer

A service endpoint on the subnet and a storage firewall rule

Answer

A public IP address and IP-based firewall exceptions

Answer

A shared access signature and blob container ACLs

Question 5

A storage account must be reachable only from workloads in one Azure subnet. The team wants to keep using the storage account's public FQDN, avoid creating a private IP address in the virtual network, and avoid managing private DNS zones. What should the administrator configure?

Accepted Answer

A service endpoint on the subnet and a storage firewall rule for that subnet. A service endpoint on the subnet and a storage firewall rule for that subnet is correct because it allows the storage account to be reachable only from workloads in one Azure subnet while still using the storage account's public FQDN. Service endpoints extend the virtual network identity to the storage account over the Microsoft backbone, and the firewall rule restricts access to that specific subnet. This avoids creating a private IP address in the virtual network and eliminates the need to manage private DNS zones, as the public endpoint is retained.

Answer

A private endpoint for the storage account

Answer

An NSG rule that allows TCP 443 to the storage account

Answer

An application security group tied to the storage account

Question 6

A company is building a hub-and-spoke Azure network. The hub VNet already uses 10.50.0.0/16. A new spoke VNet will later be peered to the hub and connected to on-premises through VPN. What is the most important planning step before creating the peering?

Accepted Answer

Choose a non-overlapping address space for the spoke and reserve room for future subnets.. Azure VNet peering requires non-overlapping address spaces to establish connectivity. If the spoke uses the same address space as the hub (10.50.0.0/16), routing conflicts will occur, and the peering will fail or cause unpredictable traffic behavior. Additionally, reserving room for future subnets ensures the spoke can scale without needing to re-architect the network.

Answer

Reuse 10.50.0.0/16 in the spoke so routing to the hub is simpler.

Answer

Create a route table first so peering can learn the spoke routes.

Answer

Enable a service endpoint to allow the spoke to communicate with the hub.

Question 7

A subnet already has a user-defined default route (0.0.0.0/0) that sends all outbound traffic to a network virtual appliance. The administrator now needs traffic to the on-premises network 10.50.0.0/16 to use the VPN gateway instead of the appliance. What should be added to the route table?

Accepted Answer

Add a user-defined route for 10.50.0.0/16 with next hop type Virtual network gateway. Adding a user-defined route (UDR) for the specific prefix 10.50.0.0/16 with next hop type 'Virtual network gateway' creates a more specific route (longest prefix match) than the existing default route (0.0.0.0/0). This ensures traffic destined for the on-premises network is forwarded to the VPN gateway instead of the network virtual appliance, while all other outbound traffic continues to use the appliance.

Answer

Remove the default route so the system route to the VPN gateway is used

Answer

Change the subnet address space to a smaller CIDR block

Answer

Enable a service endpoint for the on-premises prefix

Question 8

A backend VM must accept TCP 8443 only from the web tier. The subnet NSG already has a deny-all inbound rule at priority 200. The administrator adds an allow rule for the web tier at priority 300, but the connection still fails. What should be changed?

Accepted Answer

Change the allow rule to a lower priority number than 200.. Azure Network Security Groups (NSGs) process rules in priority order, with lower numbers evaluated first. The existing deny-all inbound rule at priority 200 is evaluated before the new allow rule at priority 300, so the deny rule blocks the traffic before the allow rule can be considered. To permit TCP 8443 from the web tier, the allow rule must have a priority number lower than 200 (e.g., 100) so it is evaluated first and allows the traffic.

Answer

Change the allow rule protocol from TCP to Any.

Answer

Move the VM to a different subnet so the rule can apply.

Answer

Add a route table entry for TCP 8443 to bypass the NSG.

Question 9

A company is creating a new spoke virtual network that will be peered to an existing hub VNet. The hub uses 10.40.0.0/16, and an on-premises network already uses 10.41.0.0/16. The spoke must support about 120 endpoints now and should allow room for growth. Which address space should you assign to the new spoke VNet?

Accepted Answer

10.42.0.0/24. (10.42.0.0/24) is correct because it provides 256 IP addresses (251 usable) for the spoke, which exceeds the requirement of ~120 endpoints with room for growth, and it does not overlap with the hub VNet (10.40.0.0/16) or the on-premises network (10.41.0.0/16). This ensures successful VNet peering without IP address conflicts.

Answer

10.40.64.0/25

Answer

10.41.128.0/24

Answer

192.168.10.0/26

Question 10

Based on the exhibit, what next hop will the VM use when it sends traffic to 10.30.5.10?

Accepted Answer

Virtual network gateway. The VM's effective route table shows a route for 10.30.5.0/24 with a next hop type of 'Virtual network gateway'. Since 10.30.5.10 falls within this prefix, the VM will use the virtual network gateway as the next hop. This overrides the default virtual network (local) route because it is a more specific prefix match.

Answer

Virtual appliance at the user-defined next hop

Answer

Internet

Answer

Virtual network

Question 11

A VM in VNet A can reach a storage account through a private endpoint, but when the VM resolves the storage account name it still gets the public IP address. What should you configure so name resolution returns the private endpoint address?

Accepted Answer

The private DNS zone linked to the VNet. When a private endpoint is created for a storage account, the DNS configuration must be updated so that the storage account's fully qualified domain name resolves to the private endpoint's private IP address instead of the public IP. Linking a private DNS zone (privatelink.blob.core.windows.net) to the virtual network and configuring a virtual network link ensures that the VM's DNS queries for the storage account are answered with the private endpoint IP. Without this, the VM continues to use the public IP from public DNS.

Answer

A user-defined route to the storage private endpoint

Answer

A resource lock on the storage account

Answer

A managed identity for the VM

Question 12

A company already uses the address space 10.20.0.0/16 for a hub virtual network and 10.21.0.0/16 on-premises. A new spoke virtual network will be peered to the hub and may later connect to the on-premises network. Which address space should the administrator choose for the spoke to avoid future routing conflicts?

Accepted Answer

10.22.0.0/16. (10.22.0.0/16) is correct because it is a unique, non-overlapping address space that does not conflict with the existing hub VNet (10.20.0.0/16) or the on-premises network (10.21.0.0/16). When a spoke VNet is peered to the hub and later connected to on-premises via VPN or ExpressRoute, Azure requires that all peered and connected address spaces be unique to avoid routing conflicts. Choosing a completely separate /16 ensures no future overlap.

Answer

10.20.64.0/19

Answer

10.21.0.0/16

Answer

10.20.128.0/17

Question 13

A storage account must be reachable only from a single subnet. The team wants to keep the storage public endpoint in place, avoid a private endpoint, and avoid managing any custom DNS records. Which change best meets the requirement?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account firewall allow list.. Enabling a service endpoint for Microsoft.Storage on the subnet injects the subnet's identity into the traffic to the storage account, allowing the storage account firewall to permit access only from that subnet while keeping the public endpoint active. This avoids the need for a private endpoint, custom DNS records, or additional routing appliances, directly meeting the requirement of restricting access to a single subnet.

Answer

Add a network security group rule to the subnet that allows outbound TCP 443 to the storage account.

Answer

Create a private endpoint and set the storage account to use a private DNS zone.

Answer

Create a route table that sends storage traffic through an Azure Firewall appliance.

Question 14

A subnet NSG contains these inbound rules: Priority 100 denies TCP 8443 from VirtualNetwork to any destination, Priority 110 allows TCP 8443 from AzureLoadBalancer to any destination, and Priority 200 allows TCP 8443 from ASG-Web to ASG-App. The app VM NIC has no additional inbound rules. Web servers are members of ASG-Web and the app VM is a member of ASG-App. The web tier still cannot connect to TCP 8443. What should the administrator change?

Accepted Answer

Move the allow rule for ASG-Web to ASG-App to a priority lower than 100.. NSG rules are evaluated in priority order, from lowest to highest number. The deny rule at priority 100 explicitly blocks TCP 8443 from VirtualNetwork, which includes traffic from ASG-Web (since ASG-Web members are within the virtual network). The allow rule at priority 110 only permits traffic from AzureLoadBalancer, not from ASG-Web. The allow rule at priority 200 is never evaluated because the deny rule at priority 100 matches first. By moving the allow rule for ASG-Web to ASG-App to a priority lower than 100 (e.g., 90), it will be evaluated before the deny rule, allowing the web servers to connect.

Answer

Replace ASG-Web with the VirtualNetwork service tag in the allow rule.

Answer

Add a route table that sends TCP 8443 traffic to the app subnet.

Answer

Create a second NSG on the app NIC with an allow rule at priority 50.

Question 15

A VM cannot connect to another VM on TCP 1433. You need to determine whether an NSG is blocking the flow and identify which rule applies. Which Network Watcher tool should you use?

Accepted Answer

IP flow verify. IP flow verify is the correct Network Watcher tool because it tests whether a packet is allowed or denied to or from a specific VM, based on a 5-tuple (source IP, destination IP, protocol, source port, destination port). For TCP 1433 (SQL Server), you can specify the exact flow parameters, and IP flow verify will evaluate all effective security rules, including NSG rules, and return the specific rule that allowed or denied the traffic.

Answer

Packet capture

Answer

Connection troubleshoot

Answer

Effective routes