AZ-104 Implement and Manage Virtual Networking Practice Test 13 — 15 Questions

Question 1

A VM sends traffic to 172.16.5.10, but the administrator suspects the traffic is taking an unexpected next hop. They want to see the effective route table applied to the VM NIC, including system routes, user-defined routes, and propagated routes. Which Network Watcher tool should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Effective routes. Effective routes is the correct Network Watcher tool because it displays the complete route table applied to a VM NIC, including system routes, user-defined routes (UDRs), and BGP-propagated routes from virtual network gateways. This allows the administrator to see exactly which next hop is selected for traffic to 172.16.5.10 based on the longest prefix match, identifying any unexpected routing behavior.

Answer

IP flow verify

Answer

Packet capture

Answer

Connection troubleshoot

Question 2

A subnet has a user-defined route for 0.0.0.0/0 that sends traffic to a network virtual appliance at 10.10.1.4. The VM in the subnet still reaches an Azure Storage account using the public endpoint, but the administrator expected all outbound traffic to go through the NVA. What is the most likely reason?

Accepted Answer

The storage account traffic is using a more specific route than the 0.0.0.0/0 route.. The most likely reason is that the storage account traffic is using a more specific route than the 0.0.0.0/0 route. Azure uses longest prefix match routing, so a route with a smaller prefix (e.g., a specific public IP range for Azure Storage) will take precedence over the default route. The 0.0.0.0/0 route only applies when no more specific route exists, and Azure automatically adds platform routes for Azure services like Storage, which can override user-defined routes.

Answer

Azure always ignores user-defined routes for storage traffic.

Answer

NSG outbound rules override user-defined routes in Azure.

Answer

The subnet needs a public IP address assigned to each VM for the route to take effect.

Question 3

Based on the exhibit, which Network Watcher tool should the administrator use to identify the exact NSG rule that is blocking TCP 1433 traffic?

Accepted Answer

IP flow verify. IP flow verify is the correct Network Watcher tool because it tests whether a packet is allowed or denied to or from a specific virtual machine based on a 5-tuple (source IP, destination IP, source port, destination port, and protocol). By specifying TCP 1433 as the destination port, the tool evaluates all effective security rules (NSG and ASG) and returns the exact rule name and direction that is blocking the traffic.

Answer

Connection troubleshoot

Answer

Next hop

Answer

Packet capture

Question 4

Based on the exhibit, what should the administrator change to allow only the web tier to reach the app tier on TCP 8443?

Accepted Answer

Move the allow rule for WebTier-ASG to a priority lower than 100.. The exhibit shows a default-deny NSG rule at priority 100 that blocks all traffic from VirtualNetwork to VirtualNetwork. To allow only the web tier (WebTier-ASG) to reach the app tier (AppTier-ASG) on TCP 8443, the administrator must move the allow rule for WebTier-ASG to a priority lower than 100 (e.g., 90). This ensures the allow rule is evaluated before the deny rule, as NSG rules are processed in priority order (lowest number first).

Answer

Change the deny rule source from VirtualNetwork to Internet.

Answer

Associate the NSG with the virtual machine NIC instead of the subnet.

Answer

Replace the ASG destination with the subnet address range.

Question 5

Which two statements about application security groups and service tags are correct? Select two.

Accepted Answer

An application security group lets you reference a set of virtual machines in NSG rules.. An application security group (ASG) allows you to group virtual machines logically, and then reference that group as a source or destination in network security group (NSG) rules. This simplifies rule management by decoupling the rule from individual VM IP addresses or NICs, enabling dynamic membership based on application tiers.

Answer

Application security groups are used to assign Azure roles.

Answer

Service tags are custom labels you create for your own subscriptions.

Answer

Service tags create a private IP address for a service.

Question 6

A company wants to peer a new spoke virtual network to an existing hub VNet. The hub uses 10.40.0.0/16, and the new spoke was created with 10.40.128.0/17 because that range seemed available in the branch office plan. Peering creation fails. What should the administrator do?

Accepted Answer

Change the spoke VNet to a non-overlapping address space before peering.. VNet peering requires that the address spaces of the peered virtual networks do not overlap. The hub uses 10.40.0.0/16, and the spoke uses 10.40.128.0/17, which is a subset of the hub’s range. Azure blocks peering when there is any overlap to prevent routing conflicts. The correct fix is to change the spoke VNet to a non-overlapping address space, such as a different RFC 1918 range like 10.1.0.0/16, before attempting to peer.

Answer

Add a second address prefix to the spoke VNet and keep the overlapping range.

Answer

Enable gateway transit on the hub VNet before retrying peering.

Answer

Create custom DNS records for the spoke VNet so the address ranges no longer conflict.

Question 7

A storage account has a blob private endpoint in VNet-A. A VM in peered VNet-B can reach the storage account by private IP, but name resolution for the storage account still returns the public IP address. The private DNS zone privatelink.blob.core.windows.net is already linked only to VNet-A. What should the administrator do next?

Accepted Answer

Create a virtual network link from the private DNS zone to VNet-B.. The private DNS zone `privatelink.blob.core.windows.net` is linked only to VNet-A, so VMs in VNet-B cannot resolve the storage account's FQDN to its private IP. By creating a virtual network link from the private DNS zone to VNet-B, the zone's records become available for resolution in VNet-B, allowing the VM to resolve the storage FQDN to the private endpoint's IP address instead of the public IP.

Answer

Create a second private endpoint in VNet-B for the same storage account.

Answer

Enable a service endpoint on VNet-B and remove the private endpoint.

Answer

Add a user-defined route in VNet-B that points the storage FQDN to the private IP.

Question 8

Third-party support engineers connect from the public internet and need browser-based RDP and SSH access to Azure VMs that have only private IPs. The security team will not allow public IPs on the VMs, inbound 3389 or 22 from the internet, or a client VPN on each laptop. What should you deploy?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless browser-based RDP and SSH connectivity to Azure VMs directly from the Azure portal over TLS, without requiring public IPs on the VMs or exposing inbound RDP/SSH ports (3389/22) to the internet. It uses a hardened bastion host deployed in a dedicated subnet, which brokers the connection via the Azure portal, satisfying the security team's constraints of no public IPs on VMs, no inbound internet access to those ports, and no client VPN software.

Answer

VPN Gateway with point-to-site configuration

Answer

A public load balancer with inbound NAT rules

Answer

A NAT gateway attached to the VM subnet

Question 9

A storage account must be reachable only from a single Azure VNet. The team wants the storage account to have a private IP in that VNet and wants to disable public network access. Which solution should the administrator implement?

Accepted Answer

Create a private endpoint for the storage account and disable public network access.. A private endpoint assigns the storage account a private IP from the VNet, making it accessible only within that VNet over a private connection. Disabling public network access ensures no traffic can reach the storage account from the internet, meeting both requirements. This is the only option that provides a private IP and blocks all public access.

Answer

Configure a service endpoint on the subnet and keep public network access enabled.

Answer

Assign a shared access signature and rely on IP-based firewall rules.

Answer

Use a route table to force traffic to the storage account over the virtual network gateway.

Question 10

A private endpoint was created for Azure SQL Database in VNet A. A VM in peered VNet B can reach other resources, but it resolves the SQL server name to the public IP and connection attempts fail because public network access is disabled. What is the best fix?

Accepted Answer

Link the appropriate private DNS zone to VNet B.. When public network access is disabled on an Azure SQL Database, the private endpoint in VNet A provides a private IP address for the SQL server. However, for VMs in peered VNet B to resolve the SQL server's fully qualified domain name (FQDN) to that private IP instead of the public IP, the private DNS zone (typically `privatelink.database.windows.net`) must be linked to VNet B. Without this link, DNS resolution falls back to the public IP, causing connection failures because public access is disabled.

Answer

Add an outbound NSG rule allowing TCP 1433 to the internet.

Answer

Assign a public IP address to the private endpoint.

Answer

Replace the private endpoint with a service endpoint.

Question 11

Based on the exhibit, which address space can you assign to the new spoke virtual network so it can be peered to the hub and later connected to on-premises without an IP overlap?

Accepted Answer

10.52.0.0/16. (10.52.0.0/16) is correct because it does not overlap with the hub virtual network's address space (10.50.0.0/16) or the on-premises network (10.51.0.0/16). This allows the spoke VNet to be peered to the hub and later connected to on-premises via a gateway in the hub without IP address conflicts, which is a requirement for successful VNet peering and VPN/ExpressRoute connectivity.

Answer

10.50.128.0/17

Answer

10.51.0.0/16

Answer

10.50.0.0/24

Question 12

Administrators need to connect to Windows and Linux VMs from the Azure portal using a browser. The VMs do not have public IP addresses, and the security team does not want a VPN client installed on admin laptops. Which service should be deployed?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP and SSH connectivity to Azure VMs directly from the Azure portal over TLS, without requiring public IP addresses on the VMs or a VPN client on the admin's laptop. It uses a hardened bastion host deployed in the same virtual network, acting as a jump server that brokers browser-based connections, meeting both the security and connectivity requirements.

Answer

Azure VPN Gateway

Answer

Azure Load Balancer

Answer

A network security group with RDP and SSH rules

Question 13

A VM in a subnet has both a subnet-level NSG and a NIC-level NSG. The subnet NSG allows inbound TCP 22 from the VirtualNetwork service tag, but the NIC NSG denies inbound TCP 22 from the same source. An administrator says the subnet rule should be enough because it allows the traffic. What is the actual behavior?

Accepted Answer

The traffic is blocked because a deny in either NSG is effective.. When both a subnet-level NSG and a NIC-level NSG are applied to a virtual machine, network traffic is evaluated against both NSGs. The effective rule is the most restrictive: if either NSG contains a deny rule that matches the traffic, the traffic is blocked. In this scenario, the NIC-level NSG explicitly denies inbound TCP 22 from the VirtualNetwork service tag, so even though the subnet NSG allows it, the deny at the NIC level takes precedence and the traffic is blocked.

Answer

The allow rule wins because subnet NSGs always override NIC NSGs.

Answer

The traffic is allowed because service tags bypass NIC-level rules.

Answer

The connection succeeds unless a route table sends the traffic elsewhere.

Question 14

Based on the exhibit, what should the administrator do so VM-B resolves the storage account name to the private IP address?

Accepted Answer

Link the private DNS zone to VNet-B.. The private DNS zone for the storage account must be linked to VNet-B so that VM-B can resolve the storage account's fully qualified domain name (FQDN) to the private IP address of the private endpoint. Without this link, the DNS resolution will fall back to the public endpoint, bypassing the private connectivity. Linking the zone ensures Azure's default DNS servers return the private IP for the storage account within VNet-B.

Answer

Create a service endpoint on VNet-B and leave DNS unchanged.

Answer

Assign a public IP address to the private endpoint.

Answer

Add a route table with a next hop to the storage account.

Question 15

After a user-defined route and VNet peering were added, a VM in a spoke subnet still does not reach 10.20.4.8 as expected. You need to confirm which route Azure will actually select on that VM's NIC, including any propagated routes and the route that wins. Which Network Watcher tool should you use?

Accepted Answer

Effective routes. Effective routes displays the actual routes applied to a network interface, including user-defined routes (UDRs), BGP-propagated routes, and VNet peering routes, along with the route priority (based on the longest prefix match and route source precedence). This allows you to see exactly which route wins for the destination 10.20.4.8, resolving why the VM cannot reach it despite the configured UDR and peering.

Answer

Connection troubleshoot

Answer

IP flow verify

Answer

Packet capture