AZ-104 Implement and Manage Virtual Networking Practice Test 14 — 15 Questions

Question 1

A VM in a subnet has both a subnet-level NSG and a NIC-level NSG. The subnet NSG allows inbound TCP 22 from the VirtualNetwork service tag, but the NIC NSG denies inbound TCP 22 from the same source. An administrator says the subnet rule should be enough because it allows the traffic. What is the actual behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The traffic is blocked because a deny in either NSG is effective.. When both a subnet-level NSG and a NIC-level NSG are applied to a virtual machine, network traffic is evaluated against both NSGs. The effective rule is the most restrictive: if either NSG contains a deny rule that matches the traffic, the traffic is blocked. In this scenario, the NIC-level NSG explicitly denies inbound TCP 22 from the VirtualNetwork service tag, so even though the subnet NSG allows it, the deny at the NIC level takes precedence and the traffic is blocked.

Answer

The allow rule wins because subnet NSGs always override NIC NSGs.

Answer

The traffic is allowed because service tags bypass NIC-level rules.

Answer

The connection succeeds unless a route table sends the traffic elsewhere.

Question 2

Based on the exhibit, what should the administrator do so VM-B resolves the storage account name to the private IP address?

Accepted Answer

Link the private DNS zone to VNet-B.. The private DNS zone for the storage account must be linked to VNet-B so that VM-B can resolve the storage account's fully qualified domain name (FQDN) to the private IP address of the private endpoint. Without this link, the DNS resolution will fall back to the public endpoint, bypassing the private connectivity. Linking the zone ensures Azure's default DNS servers return the private IP for the storage account within VNet-B.

Answer

Create a service endpoint on VNet-B and leave DNS unchanged.

Answer

Assign a public IP address to the private endpoint.

Answer

Add a route table with a next hop to the storage account.

Question 3

After a user-defined route and VNet peering were added, a VM in a spoke subnet still does not reach 10.20.4.8 as expected. You need to confirm which route Azure will actually select on that VM's NIC, including any propagated routes and the route that wins. Which Network Watcher tool should you use?

Accepted Answer

Effective routes. Effective routes displays the actual routes applied to a network interface, including user-defined routes (UDRs), BGP-propagated routes, and VNet peering routes, along with the route priority (based on the longest prefix match and route source precedence). This allows you to see exactly which route wins for the destination 10.20.4.8, resolving why the VM cannot reach it despite the configured UDR and peering.

Answer

Connection troubleshoot

Answer

IP flow verify

Answer

Packet capture

Question 4

Based on the exhibit, which feature should be enabled on the subnet so the storage account remains reachable through its public endpoint but only from that subnet?

Accepted Answer

Service endpoint. Service endpoints (B) extend the virtual network private address space and the identity of the VNet to Azure services over a direct connection. By enabling a Microsoft.Storage service endpoint on the subnet and configuring the storage account firewall to allow access only from that subnet's virtual network, the storage account remains reachable via its public endpoint but only from the specified subnet, without requiring a public IP on the subnet.

Answer

Private endpoint

Answer

Azure Bastion

Answer

VPN Gateway

Question 5

Based on the exhibit, which Azure service should you deploy to provide browser-based administrative access to the VM without assigning it a public IP address?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP/SSH connectivity to virtual machines directly in the Azure portal over TLS, without requiring a public IP address on the VM. It uses a hardened bastion host in your virtual network that brokers the connection, eliminating exposure of the VM to the internet.

Answer

Azure VPN Gateway

Answer

Public IP address on the VM

Answer

Azure Load Balancer

Question 6

A backend VM belongs to AppASG and listens on TCP 8443. The subnet NSG has a deny rule at priority 200 that blocks TCP 8443 from VirtualNetwork to any destination. The backend VM's NIC NSG has an allow rule at priority 100 for TCP 8443 from WebASG to AppASG. Web VMs in WebASG still cannot connect. What should you change to allow only the web tier while keeping other virtual network traffic blocked?

Accepted Answer

Add an allow rule in the subnet NSG at priority 150 for TCP 8443 from WebASG to AppASG.. In Azure, network security group (NSG) rules are evaluated in priority order, and subnet NSG rules are evaluated before NIC NSG rules for inbound traffic. The subnet NSG has a deny rule at priority 200 that blocks TCP 8443 from VirtualNetwork to any destination, which overrides the NIC NSG allow rule because the subnet deny is evaluated first. To allow traffic from WebASG to AppASG while still blocking other virtual network traffic, you must add an allow rule in the subnet NSG at a higher priority (e.g., 150) than the deny rule, explicitly permitting TCP 8443 from WebASG to AppASG.

Answer

Move the NIC NSG allow rule to priority 50.

Answer

Replace the subnet deny rule with a rule for the AzureLoadBalancer service tag.

Answer

Remove the backend VM from AppASG and allow traffic by subnet only.

Question 7

A web application runs on three VMs in a backend subnet. The backend team wants the load balancer in the frontend tier to reach the VMs on TCP 8443, and they want the rule to keep working even if the backend VM IP addresses change. What should you use in the NSG rule?

Accepted Answer

Use an application security group for the frontend tier as the source and another ASG for the backend tier as the destination.. Application Security Groups (ASGs) allow you to define network security rules based on logical groupings of VMs, regardless of their IP addresses. By using an ASG for the frontend tier as the source and another ASG for the backend tier as the destination, the NSG rule remains valid even if backend VM IP addresses change, as ASGs are dynamically updated. This meets the requirement for the load balancer in the frontend tier to reach backend VMs on TCP 8443 without hardcoding IP addresses.

Answer

Use the individual private IP addresses of each backend VM as the source.

Answer

Use the VirtualNetwork service tag for both source and destination.

Answer

Create a route table entry that sends TCP 8443 traffic to the backend subnet.

Question 8

A backend tier runs on three Azure VMs. The VMs are rebuilt frequently and receive new private IP addresses during redeployment. The administrator must allow inbound TCP 1433 from the app tier without rewriting the NSG rule each time the backend VMs change. What should be used?

Accepted Answer

An application security group referenced by the NSG rule. An application security group (ASG) allows you to group VMs logically (e.g., by tier) and reference that group in a network security group (NSG) rule. When backend VMs are rebuilt and receive new private IPs, the ASG membership is automatically updated, so the NSG rule continues to apply without manual changes. This makes ASG the correct choice for dynamic environments where IP addresses change frequently.

Answer

Individual private IP addresses assigned directly in the NSG rule

Answer

A service endpoint enabled on the subnet

Answer

A load balancer inbound NAT rule on port 1433

Question 9

A team is creating a new workload subnet in a spoke virtual network. The subnet must support 41 VM NICs, 2 internal load balancer frontend IP configurations, 3 private endpoint IPs, and 4 spare IPs for near-term growth. Azure reserves 5 IP addresses in every subnet. What is the smallest IPv4 subnet size that satisfies the requirement?

Accepted Answer

/26, because 64 total addresses provide enough usable IPs for the workload and growth.. The total IP addresses required are 41 (VM NICs) + 2 (ILB frontends) + 3 (private endpoints) + 4 (spare) + 5 (Azure reserved) = 55 IPs. A /26 subnet provides 64 total addresses, of which 59 are usable (64 - 5 reserved), which meets the requirement. Option B is correct because /26 is the smallest subnet that provides enough usable IPs.

Answer

/27, because 32 total addresses are enough for a small workload subnet.

Answer

/25, because 128 total addresses are required once private endpoints are included.

Answer

/28, because 16 total addresses are sufficient when load balancers are used.

Question 10

A company wants an Azure Storage account to be reachable privately from a virtual network. Which two statements about a private endpoint are correct? Select two.

Accepted Answer

The storage service gets a private IP address in the selected virtual network.. Option A is correct because an Azure Private Endpoint creates a network interface (NIC) in a chosen subnet of the virtual network and assigns the target PaaS service (here, Azure Storage) a private IP address from that subnet's address space, so traffic reaches the storage account over the private IP rather than the public endpoint. Option D is correct because clients normally address the storage account by its public FQDN (e.g., <account>.blob.core.windows.net), so a private DNS zone such as privatelink.blob.core.windows.net is linked to the virtual network to override that name and resolve it to the endpoint's private IP; without this, name resolution would still return the public address. Option B is wrong because the whole point of a private endpoint is private connectivity from within the VNet, and the client VM does not need a public IP address. Option C is wrong because DNS configuration is still required — a private endpoint does not automatically handle name resolution. Option E is wrong because a service endpoint extends the VNet identity to the service over the Azure backbone while the service keeps its public IP, whereas a private endpoint gives the service a private IP in the VNet; they are distinct features.

Answer

The virtual machine that reaches the service must have its own public IP address.

Answer

A private endpoint replaces the need for any DNS configuration.

Answer

A private endpoint and a service endpoint are the same feature.

Question 11

A storage account must be reachable only from resources in a single VNet. The team wants the storage service to use a private IP address inside that VNet and wants to disable public network access. Which feature should be configured?

Accepted Answer

A private endpoint. A private endpoint assigns the storage account a private IP address from the VNet's address space, effectively bringing the service into the VNet. It also disables public network access by default when configured with the 'Deny public network access' setting, ensuring the storage account is reachable only from within that VNet.

Answer

A service endpoint

Answer

A network security group rule on the subnet

Answer

A storage account firewall IP allow rule

Question 12

A VM in a subnet cannot connect to another VM on TCP 1433. The administrator wants to confirm whether an NSG rule is blocking the flow and which rule is responsible. Which Network Watcher feature should be used?

Accepted Answer

IP flow verify. B is correct because IP flow verify is the Network Watcher feature specifically designed to test whether traffic is allowed or denied to or from a virtual machine. It checks the security rules (NSG and ASG) and returns which rule is blocking the flow, including the direction and priority. For a TCP 1433 connection failure, this tool directly identifies the blocking NSG rule.

Answer

Connection troubleshoot

Answer

Packet capture

Answer

Effective routes

Question 13

A storage account must be reachable only from one subnet. The team does not want to deploy a private endpoint or manage private DNS zones, and they are acceptable with the storage account continuing to use its public endpoint. Which feature should be configured on the subnet?

Accepted Answer

A service endpoint for Microsoft.Storage. A service endpoint for Microsoft.Storage allows a subnet to restrict access to a storage account's public endpoint without deploying a private endpoint or managing private DNS zones. When enabled, Azure adds the subnet's identity to traffic from that subnet, and the storage account's firewall can be configured to allow only that specific subnet, keeping the public endpoint active.

Answer

A private endpoint for the storage account

Answer

A route table with a default route to the storage account

Answer

An application security group containing the subnet

Question 14

A VM has both a default route from a VPN gateway and a user-defined route to an on-premises firewall. Traffic is still not reaching the expected next hop. The administrator wants to see the exact routes currently applied to the VM NIC. Which tool should be used?

Accepted Answer

Effective routes. Effective routes is the correct tool because it displays the actual, consolidated routing table applied to a specific network interface, including user-defined routes (UDRs), BGP routes from the VPN gateway, and system default routes. When traffic fails to reach the expected next hop despite having both a VPN default route and a UDR, the administrator must verify which route is actually active and has the highest priority (based on prefix length and route preference). Effective routes shows the exact next-hop IP and route source for each prefix, allowing the administrator to confirm whether the UDR to the on-premises firewall is being honored or overridden.

Answer

IP flow verify

Answer

Packet capture

Answer

Connection troubleshoot

Question 15

A subnet has an NSG with an inbound allow rule for TCP 3389 at priority 200 and an inbound deny rule for Internet traffic at priority 100. An administrator still cannot RDP to a virtual machine in the subnet from home. What is the most likely reason?

Accepted Answer

The deny rule wins because lower priority numbers are processed first.. In Azure Network Security Groups (NSGs), rules are processed in priority order, with lower numbers evaluated first. The deny rule for Internet traffic at priority 100 is processed before the allow rule for TCP 3389 at priority 200, so the deny rule blocks the inbound RDP connection from the internet. This is why the administrator cannot RDP from home.

Answer

The allow rule is ignored because inbound rules cannot permit RDP.

Answer

NSG rules apply only to outbound traffic, so inbound traffic is unaffected.

Answer

The subnet NSG is ignored whenever the VM has a public IP address.