AZ-104 Implement and Manage Virtual Networking Practice Test 14 — 15 Questions

Question 1

Based on the exhibit, why is TCP 8443 traffic from the web tier still denied to the app tier, and what should you do to allow only the web tier?

Accepted Answer

Add an inbound allow rule for TCP 8443 from ASG-Web to ASG-App with a priority lower than 100.. In Azure Network Security Groups (NSGs), rules are evaluated in priority order, with lower numbers evaluated first. The existing rule at priority 100 allows traffic from the web tier but does not explicitly allow TCP 8443, so a subsequent deny-all rule at priority 200 blocks it. To allow only the web tier, you must add an inbound allow rule for TCP 8443 from ASG-Web with a priority lower than 100 (e.g., 90). This new rule is evaluated before the existing rule at priority 100, permitting the desired traffic while still blocking other sources.

Answer

Change the deny-all rule at priority 200 to allow TCP 8443 from ASG-Web.

Answer

Add a route table entry for 8443 traffic from the web tier to the app tier.

Answer

Remove the AzureLoadBalancer rule because it is overriding the web tier traffic.

Question 2

Based on the exhibit, which feature should be enabled on the subnet so the storage account remains reachable through its public endpoint but only from that subnet?

Accepted Answer

Service endpoint. Service endpoints (B) extend the virtual network private address space and the identity of the VNet to Azure services over a direct connection. By enabling a Microsoft.Storage service endpoint on the subnet and configuring the storage account firewall to allow access only from that subnet's virtual network, the storage account remains reachable via its public endpoint but only from the specified subnet, without requiring a public IP on the subnet.

Answer

Private endpoint

Answer

Azure Bastion

Answer

VPN Gateway

Question 3

Based on the exhibit, which Azure service should you deploy to provide browser-based administrative access to the VM without assigning it a public IP address?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP/SSH connectivity to virtual machines directly in the Azure portal over TLS, without requiring a public IP address on the VM. It uses a hardened bastion host in your virtual network that brokers the connection, eliminating exposure of the VM to the internet.

Answer

Azure VPN Gateway

Answer

Public IP address on the VM

Answer

Azure Load Balancer

Question 4

A backend VM belongs to AppASG and listens on TCP 8443. The subnet NSG has a deny rule at priority 200 that blocks TCP 8443 from VirtualNetwork to any destination. The backend VM's NIC NSG has an allow rule at priority 100 for TCP 8443 from WebASG to AppASG. Web VMs in WebASG still cannot connect. What should you change to allow only the web tier while keeping other virtual network traffic blocked?

Accepted Answer

Add an allow rule in the subnet NSG at priority 150 for TCP 8443 from WebASG to AppASG.. In Azure, network security group (NSG) rules are evaluated in priority order, and subnet NSG rules are evaluated before NIC NSG rules for inbound traffic. The subnet NSG has a deny rule at priority 200 that blocks TCP 8443 from VirtualNetwork to any destination, which overrides the NIC NSG allow rule because the subnet deny is evaluated first. To allow traffic from WebASG to AppASG while still blocking other virtual network traffic, you must add an allow rule in the subnet NSG at a higher priority (e.g., 150) than the deny rule, explicitly permitting TCP 8443 from WebASG to AppASG.

Answer

Move the NIC NSG allow rule to priority 50.

Answer

Replace the subnet deny rule with a rule for the AzureLoadBalancer service tag.

Answer

Remove the backend VM from AppASG and allow traffic by subnet only.

Question 5

A web application runs on three VMs in a backend subnet. The backend team wants the load balancer in the frontend tier to reach the VMs on TCP 8443, and they want the rule to keep working even if the backend VM IP addresses change. What should you use in the NSG rule?

Accepted Answer

Use an application security group for the frontend tier as the source and another ASG for the backend tier as the destination.. Application Security Groups (ASGs) allow you to define network security rules based on logical groupings of VMs, regardless of their IP addresses. By using an ASG for the frontend tier as the source and another ASG for the backend tier as the destination, the NSG rule remains valid even if backend VM IP addresses change, as ASGs are dynamically updated. This meets the requirement for the load balancer in the frontend tier to reach backend VMs on TCP 8443 without hardcoding IP addresses.

Answer

Use the individual private IP addresses of each backend VM as the source.

Answer

Use the VirtualNetwork service tag for both source and destination.

Answer

Create a route table entry that sends TCP 8443 traffic to the backend subnet.

Question 6

A backend tier runs on three Azure VMs. The VMs are rebuilt frequently and receive new private IP addresses during redeployment. The administrator must allow inbound TCP 1433 from the app tier without rewriting the NSG rule each time the backend VMs change. What should be used?

Accepted Answer

An application security group referenced by the NSG rule. An application security group (ASG) allows you to group VMs logically (e.g., by tier) and reference that group in a network security group (NSG) rule. When backend VMs are rebuilt and receive new private IPs, the ASG membership is automatically updated, so the NSG rule continues to apply without manual changes. This makes ASG the correct choice for dynamic environments where IP addresses change frequently.

Answer

Individual private IP addresses assigned directly in the NSG rule

Answer

A service endpoint enabled on the subnet

Answer

A load balancer inbound NAT rule on port 1433

Question 7

A team is creating a new workload subnet in a spoke virtual network. The subnet must support 41 VM NICs, 2 internal load balancer frontend IP configurations, 3 private endpoint IPs, and 4 spare IPs for near-term growth. Azure reserves 5 IP addresses in every subnet. What is the smallest IPv4 subnet size that satisfies the requirement?

Accepted Answer

/26, because 64 total addresses provide enough usable IPs for the workload and growth.. The total IP addresses required are 41 (VM NICs) + 2 (ILB frontends) + 3 (private endpoints) + 4 (spare) + 5 (Azure reserved) = 55 IPs. A /26 subnet provides 64 total addresses, of which 59 are usable (64 - 5 reserved), which meets the requirement. Option B is correct because /26 is the smallest subnet that provides enough usable IPs.

Answer

/27, because 32 total addresses are enough for a small workload subnet.

Answer

/25, because 128 total addresses are required once private endpoints are included.

Answer

/28, because 16 total addresses are sufficient when load balancers are used.

Question 8

A company wants an Azure Storage account to be reachable privately from a virtual network. Which two statements about a private endpoint are correct? Select two.

Accepted Answer

The storage service gets a private IP address in the selected virtual network.. A private endpoint assigns the Azure Storage service a private IP address from the subnet of the selected virtual network, effectively bringing the service into the VPC-like environment. This ensures that traffic to the storage account stays within the Microsoft backbone network and never traverses the public internet, meeting private connectivity requirements.

Answer

The virtual machine that reaches the service must have its own public IP address.

Answer

A private endpoint replaces the need for any DNS configuration.

Answer

A private endpoint and a service endpoint are the same feature.

Question 9

A storage account must be reachable only from resources in a single VNet. The team wants the storage service to use a private IP address inside that VNet and wants to disable public network access. Which feature should be configured?

Accepted Answer

A private endpoint. A private endpoint assigns the storage account a private IP address from the VNet's address space, effectively bringing the service into the VNet. It also disables public network access by default when configured with the 'Deny public network access' setting, ensuring the storage account is reachable only from within that VNet.

Answer

A service endpoint

Answer

A network security group rule on the subnet

Answer

A storage account firewall IP allow rule

Question 10

A VM in a subnet cannot connect to another VM on TCP 1433. The administrator wants to confirm whether an NSG rule is blocking the flow and which rule is responsible. Which Network Watcher feature should be used?

Accepted Answer

IP flow verify. B is correct because IP flow verify is the Network Watcher feature specifically designed to test whether traffic is allowed or denied to or from a virtual machine. It checks the security rules (NSG and ASG) and returns which rule is blocking the flow, including the direction and priority. For a TCP 1433 connection failure, this tool directly identifies the blocking NSG rule.

Answer

Connection troubleshoot

Answer

Packet capture

Answer

Effective routes

Question 11

A storage account must be reachable only from one subnet. The team does not want to deploy a private endpoint or manage private DNS zones, and they are acceptable with the storage account continuing to use its public endpoint. Which feature should be configured on the subnet?

Accepted Answer

A service endpoint for Microsoft.Storage. A service endpoint for Microsoft.Storage allows a subnet to restrict access to a storage account's public endpoint without deploying a private endpoint or managing private DNS zones. When enabled, Azure adds the subnet's identity to traffic from that subnet, and the storage account's firewall can be configured to allow only that specific subnet, keeping the public endpoint active.

Answer

A private endpoint for the storage account

Answer

A route table with a default route to the storage account

Answer

An application security group containing the subnet

Question 12

A VM has both a default route from a VPN gateway and a user-defined route to an on-premises firewall. Traffic is still not reaching the expected next hop. The administrator wants to see the exact routes currently applied to the VM NIC. Which tool should be used?

Accepted Answer

Effective routes. Effective routes is the correct tool because it displays the actual, consolidated routing table applied to a specific network interface, including user-defined routes (UDRs), BGP routes from the VPN gateway, and system default routes. When traffic fails to reach the expected next hop despite having both a VPN default route and a UDR, the administrator must verify which route is actually active and has the highest priority (based on prefix length and route preference). Effective routes shows the exact next-hop IP and route source for each prefix, allowing the administrator to confirm whether the UDR to the on-premises firewall is being honored or overridden.

Answer

IP flow verify

Answer

Packet capture

Answer

Connection troubleshoot

Question 13

A subnet has an NSG with an inbound allow rule for TCP 3389 at priority 200 and an inbound deny rule for Internet traffic at priority 100. An administrator still cannot RDP to a virtual machine in the subnet from home. What is the most likely reason?

Accepted Answer

The deny rule wins because lower priority numbers are processed first.. In Azure Network Security Groups (NSGs), rules are processed in priority order, with lower numbers evaluated first. The deny rule for Internet traffic at priority 100 is processed before the allow rule for TCP 3389 at priority 200, so the deny rule blocks the inbound RDP connection from the internet. This is why the administrator cannot RDP from home.

Answer

The allow rule is ignored because inbound rules cannot permit RDP.

Answer

NSG rules apply only to outbound traffic, so inbound traffic is unaffected.

Answer

The subnet NSG is ignored whenever the VM has a public IP address.

Question 14

An operations team wants all internet-bound traffic from a workload subnet to pass through a network virtual appliance at 10.1.0.4 for inspection. Which next hop type should be used in a user-defined route for destination 0.0.0.0/0?

Accepted Answer

Virtual appliance. To force all internet-bound traffic from a subnet through a network virtual appliance (NVA) at 10.1.0.4, you must create a user-defined route (UDR) with destination 0.0.0.0/0 and next hop type 'Virtual appliance'. This directs traffic to the NVA's private IP for inspection, overriding Azure's default system route that would otherwise send 0.0.0.0/0 traffic directly to the Internet via the Azure backbone.

Answer

Internet

Answer

Virtual network gateway

Answer

None

Question 15

A storage account is accessed from a VM in VNet A through a private endpoint. A VM in peered VNet B can connect to the storage account by IP, but when it uses the storage account name, it resolves to the public endpoint. What should the administrator configure?

Accepted Answer

Link the private DNS zone for the storage account to VNet B.. The VM in VNet B can reach the storage account by IP because the private endpoint is accessible over the VNet peering, but DNS resolution still returns the public IP because the private DNS zone (privatelink.blob.core.windows.net) is not linked to VNet B. By linking the private DNS zone to VNet B, the VM will resolve the storage account name to the private endpoint IP, ensuring connectivity over the Microsoft backbone instead of the public internet.

Answer

Enable a service endpoint on VNet B for Microsoft.Storage.

Answer

Assign the VM in VNet B a managed identity.

Answer

Create a route table that points storage traffic to the private endpoint subnet.