AZ-104 Implement and Manage Virtual Networking Practice Test 14 — 15 Questions

Question 1

A subnet has these inbound NSG rules: Rule 100 denies TCP 3389 from Internet, Rule 200 allows TCP 3389 from 10.0.0.0/8, and Rule 300 allows TCP 3389 from AzureLoadBalancer. An administrator in 10.20.5.4 cannot RDP to a VM in the subnet. Why is the connection denied?

Accepted Answer

The deny rule at priority 100 matches before the allow rule at priority 200.. Option A is correct because Network Security Group (NSG) rules are evaluated in priority order, from lowest number to highest. Rule 100 with priority 100 denies TCP port 3389 from the Internet source, which includes all IP addresses not explicitly part of Azure virtual networks, such as the 10.20.5.4 address (since it is not in the 10.0.0.0/8 range). The deny rule matches first, so the connection is blocked before the allow rule at priority 200 can be evaluated.

Answer

The AzureLoadBalancer service tag blocks all other inbound traffic on that port.

Answer

The VM needs a public IP address for RDP to work from a private source.

Answer

NSG rules are processed by longest prefix match, so the /8 source loses to the /32 VM address.

Question 2

Based on the exhibit, which feature should you enable so the subnet can access the storage account without creating a private IP address in the VNet?

Accepted Answer

Service endpoint. Service endpoints allow a subnet to securely and privately connect to Azure PaaS services (like Storage Accounts) over the Azure backbone network without requiring a private IP address in the VNet. They extend the VNet identity to the service, enabling access via the service's public endpoint while restricting traffic to the subnet. This matches the requirement exactly: no private IP is created in the VNet, and the storage account is accessed directly.

Answer

Private endpoint

Answer

VPN Gateway

Answer

Azure Firewall

Question 3

A web application on a VM is failing on TCP 8443. The administrator wants to capture packets on the VM NIC to inspect retransmissions and handshake details after the test run. Which Network Watcher capability should be used?

Accepted Answer

Packet capture. Packet capture in Network Watcher allows you to capture network traffic to and from a VM, including TCP retransmissions and handshake details (SYN, SYN-ACK, ACK). This is the correct tool for inspecting raw packets after a test run to diagnose issues like failed connections on TCP 8443.

Answer

IP flow verify

Answer

Connection troubleshoot

Answer

Effective routes

Question 4

Which two statements about Azure route tables and user-defined routes are correct? Select two.

Accepted Answer

You can associate a route table with a subnet.. Option A is correct because route tables in Azure are associated at the subnet level, not directly to a virtual machine. This association allows the route table's user-defined routes (UDRs) to override system default routes for traffic leaving that subnet. The subnet must be in the same region as the route table, and a single route table can be associated with multiple subnets.

Answer

Route tables can be associated directly to a single virtual machine without using its subnet.

Answer

A user-defined route automatically overrides a network security group deny rule.

Answer

System routes are never used when a route table exists.

Question 5

A company has 25 remote employees who need to connect from their laptops to Azure VMs that have only private IP addresses. No on-premises VPN appliance exists, and the VMs must not be assigned public IP addresses. Which solution should the administrator deploy?

Accepted Answer

Point-to-site VPN Gateway. A Point-to-Site (P2S) VPN Gateway is the correct solution because it allows individual remote clients (laptops) to establish a secure VPN connection from anywhere to Azure VMs with private IP addresses, without requiring a public IP on the VMs or an on-premises VPN appliance. P2S uses SSTP, IKEv2, or OpenVPN protocols to create a tunnel from each client to the Azure virtual network, enabling access to private resources.

Answer

Site-to-site VPN Gateway

Answer

ExpressRoute circuit

Answer

Public load balancer with inbound NAT rules

Question 6

Based on the exhibit, which subnet prefix should you create for the workload subnet so it has enough usable IP addresses for all listed resources?

Accepted Answer

/26. The workload subnet must support 30 VMs, 5 internal load balancer frontend IPs, and 5 backend pool instances, totaling 40 IP addresses. A /26 subnet provides 64 total IPs, with 62 usable (after reserving network and broadcast addresses), which is sufficient. Smaller prefixes like /27 (30 usable) or /28 (14 usable) lack capacity, while /25 (126 usable) is excessive and wastes IP space.

Answer

/27

Answer

/25

Answer

/28

Question 7

A storage account should accept traffic only from one subnet, but the team does not want to create a private IP address for the service in the virtual network. What should they enable?

Accepted Answer

Service endpoint, because it allows the subnet to access the storage service securely over the Azure backbone.. Service endpoints allow a subnet to access Azure PaaS services (like Storage) over the Azure backbone without requiring a private IP address. By enabling a Microsoft.Storage service endpoint on the subnet and configuring the storage account firewall to allow traffic only from that subnet, the team meets the requirement securely and cost-effectively.

Answer

Private endpoint, because it is the only way to allow one subnet.

Answer

User-assigned managed identity, because it controls subnet access.

Answer

Blob soft delete, because it helps restrict where traffic comes from.

Question 8

A team manages three backend servers in one subnet. The servers are replaced periodically, so their private IP addresses change. The NSG must allow inbound traffic from the web tier without updating individual IP addresses each time. Which destination object should be used in the NSG rule?

Accepted Answer

Application security group. An Application Security Group (ASG) allows you to group backend servers logically, regardless of their private IP addresses, and reference that group as the destination in an NSG rule. When servers are replaced and their IPs change, the ASG membership is automatically updated, so the NSG rule continues to apply without manual intervention. This is the correct approach for dynamic workloads where IP addresses are not static.

Answer

Service tag

Answer

Route table

Answer

Private endpoint

Question 9

Your hub virtual network uses 10.40.0.0/16 and the corporate on-premises network uses 10.41.0.0/16. A new spoke VNet must be peered to the hub now and connected to on-premises later. It needs a workload subnet for about 180 hosts and a management subnet for about 50 hosts. Which address space is the best choice for the new spoke?

Accepted Answer

10.42.0.0/23. Option C (10.42.0.0/23) is correct because it provides 512 total IP addresses (510 usable), which is sufficient for the 180-host workload subnet and 50-host management subnet, while avoiding overlap with both the hub VNet (10.40.0.0/16) and the on-premises network (10.41.0.0/16). The /23 prefix allows splitting into two /24 subnets (e.g., 10.42.0.0/24 for workload and 10.42.1.0/24 for management), meeting the host requirements without wasting address space.

Answer

10.40.128.0/17

Answer

10.41.64.0/18

Answer

10.42.0.0/24

Question 10

A storage account has a private endpoint in VNet A. A VM in peered VNet B can reach the storage account by private IP, but when the VM resolves the storage account name it still gets the public IP address. What should be configured so the name resolves to the private IP from VNet B?

Accepted Answer

Link the private DNS zone for the storage service to VNet B.. When a private endpoint is created in VNet A, a private DNS zone (e.g., `privatelink.blob.core.windows.net`) is automatically linked to VNet A, enabling name resolution to the private IP within that VNet. However, VNet B is peered but not linked to that private DNS zone, so VMs in VNet B continue to resolve the storage account name via public DNS, returning the public IP. By linking the private DNS zone to VNet B, the VM will resolve the storage account name to the private IP address of the private endpoint.

Answer

Create a new storage account in VNet B.

Answer

Add an inbound NSG rule allowing DNS traffic from VNet B.

Answer

Replace the private endpoint with a service endpoint.

Question 11

An on-premises datacenter must reach private IP addresses in Azure over an encrypted site-to-site tunnel. The Azure VMs must not have public IP addresses, and the connection should use the company's existing edge device. Which Azure component should be deployed?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway is the correct component because it provides an encrypted site-to-site IPsec/IKE tunnel between an on-premises network and Azure virtual networks. It supports policy-based or route-based VPNs, works with existing edge devices, and allows Azure VMs to remain without public IP addresses by routing traffic through the gateway's private IP space.

Answer

Azure Bastion

Answer

Azure Route Server

Answer

A network security group with inbound allow rules

Question 12

Which two statements about network security group processing are correct? Select two.

Accepted Answer

NSG rules are evaluated starting with the lowest priority number.. Option A is correct because NSG rules are processed in order of increasing priority number, meaning the rule with the lowest priority number (e.g., 100) is evaluated first. This ensures that more specific or critical rules can be applied before broader rules with higher priority numbers.

Answer

An NSG can be linked only to a subnet, not to a network interface card.

Answer

Azure ignores NSG rules whenever a route table is attached to the subnet.

Answer

Security rules are processed alphabetically by name.

Question 13

Based on the exhibit, which Network Watcher tool should you use to determine whether an NSG allows or denies TCP 1433 traffic and which rule is responsible?

Accepted Answer

IP flow verify. IP flow verify tests a specific source/destination IP, port, and protocol (TCP 1433) against the effective NSG rules to report whether traffic is allowed or denied, and it identifies the exact NSG rule (name and priority) responsible for that decision. This makes it the correct tool for determining NSG rule impact on a specific traffic flow.

Answer

Connection troubleshoot

Answer

Packet capture

Answer

Next hop

Question 14

A VM named VM1 cannot establish TCP 1433 connectivity to VM2. The administrator wants to test the exact flow, confirm whether an NSG allows or denies it, and identify the rule that applies if the flow is blocked. Which Network Watcher tool should be used?

Accepted Answer

IP flow verify, because it evaluates the 5-tuple and reports the matching allow or deny rule.. IP flow verify is the correct tool because it evaluates the 5-tuple (source IP, destination IP, source port, destination port, and protocol) against the effective Network Security Group (NSG) rules for a given virtual machine network interface. It explicitly reports whether the traffic is allowed or denied and, if denied, identifies the exact NSG rule (name and priority) that caused the denial. This directly meets the administrator's requirement to test the exact flow and identify the blocking rule.

Answer

Effective routes, because it shows the exact NSG rule name for blocked traffic.

Answer

Packet capture, because it automatically tells you which NSG rule denied the traffic.

Answer

Connection troubleshoot, because it only checks DNS name resolution.

Question 15

A VM in VNet B can reach a blob storage account through a private endpoint that was created in peered VNet A. The storage FQDN still resolves to the public IP when queried from VNet B, so the VM does not use the private path. What should the administrator change?

Accepted Answer

Link the private DNS zone used by the private endpoint to VNet B. The private endpoint in VNet A creates a private IP for the storage account, but DNS resolution in VNet B still returns the public IP because the private DNS zone (privatelink.blob.core.windows.net) is not linked to VNet B. By linking the private DNS zone to VNet B, the VM will resolve the storage FQDN to the private IP, ensuring traffic uses the private endpoint path through the VNet peering.

Answer

Add a service endpoint for Microsoft.Storage to VNet B

Answer

Disable the storage account firewall completely

Answer

Move the storage account into VNet B