AZ-104 Implement and Manage Virtual Networking Practice Test 15 — 15 Questions

Question 1

Based on the exhibit, what should the administrator change so the web tier can reach the database tier on TCP 443 without opening the subnet more broadly?

Accepted Answer

Move the allow rule for WebTierASG to a priority lower than 100.. The administrator must ensure the allow rule for WebTierASG is evaluated before the deny-all rule. In Azure Network Security Groups (NSGs), rules are processed in priority order (lower numbers first). The current deny rule at priority 100 blocks all traffic from VirtualNetwork, including TCP 443 from the web tier. By moving the allow rule to a priority lower than 100 (e.g., 90), it will be evaluated first, permitting TCP 443 traffic from WebTierASG to the database tier, while the deny rule still blocks all other traffic from the virtual network.

Answer

Delete the deny rule because default rules already block unwanted traffic.

Answer

Change the deny rule source from VirtualNetwork to Internet.

Answer

Change the default inbound rule to AllowVnetInBound.

Question 2

Based on the exhibit, which feature should you enable so the subnet can access the storage account without creating a private IP address in the VNet?

Accepted Answer

Service endpoint. Service endpoints allow a subnet to securely and privately connect to Azure PaaS services (like Storage Accounts) over the Azure backbone network without requiring a private IP address in the VNet. They extend the VNet identity to the service, enabling access via the service's public endpoint while restricting traffic to the subnet. This matches the requirement exactly: no private IP is created in the VNet, and the storage account is accessed directly.

Answer

Private endpoint

Answer

VPN Gateway

Answer

Azure Firewall

Question 3

A web application on a VM is failing on TCP 8443. The administrator wants to capture packets on the VM NIC to inspect retransmissions and handshake details after the test run. Which Network Watcher capability should be used?

Accepted Answer

Packet capture. Packet capture in Network Watcher allows you to capture network traffic to and from a VM, including TCP retransmissions and handshake details (SYN, SYN-ACK, ACK). This is the correct tool for inspecting raw packets after a test run to diagnose issues like failed connections on TCP 8443.

Answer

IP flow verify

Answer

Connection troubleshoot

Answer

Effective routes

Question 4

Which two statements about Azure route tables and user-defined routes are correct? Select two.

Accepted Answer

You can associate a route table with a subnet.. Route tables in Azure are associated at the subnet level, not directly to a virtual machine. This association allows the route table's user-defined routes (UDRs) to override system default routes for traffic leaving that subnet. The subnet must be in the same region as the route table, and a single route table can be associated with multiple subnets.

Answer

Route tables can be associated directly to a single virtual machine without using its subnet.

Answer

A user-defined route automatically overrides a network security group deny rule.

Answer

System routes are never used when a route table exists.

Question 5

A company has 25 remote employees who need to connect from their laptops to Azure VMs that have only private IP addresses. No on-premises VPN appliance exists, and the VMs must not be assigned public IP addresses. Which solution should the administrator deploy?

Accepted Answer

Point-to-site VPN Gateway. A Point-to-Site (P2S) VPN Gateway is the correct solution because it allows individual remote clients (laptops) to establish a secure VPN connection from anywhere to Azure VMs with private IP addresses, without requiring a public IP on the VMs or an on-premises VPN appliance. P2S uses SSTP, IKEv2, or OpenVPN protocols to create a tunnel from each client to the Azure virtual network, enabling access to private resources.

Answer

Site-to-site VPN Gateway

Answer

ExpressRoute circuit

Answer

Public load balancer with inbound NAT rules

Question 6

A storage account should accept traffic only from one subnet, but the team does not want to create a private IP address for the service in the virtual network. What should they enable?

Accepted Answer

Service endpoint, because it allows the subnet to access the storage service securely over the Azure backbone.. Service endpoints allow a subnet to access Azure PaaS services (like Storage) over the Azure backbone without requiring a private IP address. By enabling a Microsoft.Storage service endpoint on the subnet and configuring the storage account firewall to allow traffic only from that subnet, the team meets the requirement securely and cost-effectively.

Answer

Private endpoint, because it is the only way to allow one subnet.

Answer

User-assigned managed identity, because it controls subnet access.

Answer

Blob soft delete, because it helps restrict where traffic comes from.

Question 7

A team manages three backend servers in one subnet. The servers are replaced periodically, so their private IP addresses change. The NSG must allow inbound traffic from the web tier without updating individual IP addresses each time. Which destination object should be used in the NSG rule?

Accepted Answer

Application security group. An Application Security Group (ASG) allows you to group backend servers logically, regardless of their private IP addresses, and reference that group as the destination in an NSG rule. When servers are replaced and their IPs change, the ASG membership is automatically updated, so the NSG rule continues to apply without manual intervention. This is the correct approach for dynamic workloads where IP addresses are not static.

Answer

Service tag

Answer

Route table

Answer

Private endpoint

Question 8

A storage account has a private endpoint in VNet A. A VM in peered VNet B can reach the storage account by private IP, but when the VM resolves the storage account name it still gets the public IP address. What should be configured so the name resolves to the private IP from VNet B?

Accepted Answer

Link the private DNS zone for the storage service to VNet B.. When a private endpoint is created in VNet A, a private DNS zone (e.g., `privatelink.blob.core.windows.net`) is automatically linked to VNet A, enabling name resolution to the private IP within that VNet. However, VNet B is peered but not linked to that private DNS zone, so VMs in VNet B continue to resolve the storage account name via public DNS, returning the public IP. By linking the private DNS zone to VNet B, the VM will resolve the storage account name to the private IP address of the private endpoint.

Answer

Create a new storage account in VNet B.

Answer

Add an inbound NSG rule allowing DNS traffic from VNet B.

Answer

Replace the private endpoint with a service endpoint.

Question 9

An on-premises datacenter must reach private IP addresses in Azure over an encrypted site-to-site tunnel. The Azure VMs must not have public IP addresses, and the connection should use the company's existing edge device. Which Azure component should be deployed?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway is the correct component because it provides an encrypted site-to-site IPsec/IKE tunnel between an on-premises network and Azure virtual networks. It supports policy-based or route-based VPNs, works with existing edge devices, and allows Azure VMs to remain without public IP addresses by routing traffic through the gateway's private IP space.

Answer

Azure Bastion

Answer

Azure Route Server

Answer

A network security group with inbound allow rules

Question 10

Which two statements about network security group processing are correct? Select two.

Accepted Answer

NSG rules are evaluated starting with the lowest priority number.. NSG rules are processed in order of increasing priority number, meaning the rule with the lowest priority number (e.g., 100) is evaluated first. This ensures that more specific or critical rules can be applied before broader rules with higher priority numbers.

Answer

An NSG can be linked only to a subnet, not to a network interface card.

Answer

Azure ignores NSG rules whenever a route table is attached to the subnet.

Answer

Security rules are processed alphabetically by name.

Question 11

Based on the exhibit, which Network Watcher tool should you use to determine whether an NSG allows or denies TCP 1433 traffic and which rule is responsible?

Accepted Answer

IP flow verify. IP flow verify tests a specific source/destination IP, port, and protocol (TCP 1433) against the effective NSG rules to report whether traffic is allowed or denied, and it identifies the exact NSG rule (name and priority) responsible for that decision. This makes it the correct tool for determining NSG rule impact on a specific traffic flow.

Answer

Connection troubleshoot

Answer

Packet capture

Answer

Next hop

Question 12

A VM named VM1 cannot establish TCP 1433 connectivity to VM2. The administrator wants to test the exact flow, confirm whether an NSG allows or denies it, and identify the rule that applies if the flow is blocked. Which Network Watcher tool should be used?

Accepted Answer

IP flow verify, because it evaluates the 5-tuple and reports the matching allow or deny rule.. IP flow verify is the correct tool because it evaluates the 5-tuple (source IP, destination IP, source port, destination port, and protocol) against the effective Network Security Group (NSG) rules for a given virtual machine network interface. It explicitly reports whether the traffic is allowed or denied and, if denied, identifies the exact NSG rule (name and priority) that caused the denial. This directly meets the administrator's requirement to test the exact flow and identify the blocking rule.

Answer

Effective routes, because it shows the exact NSG rule name for blocked traffic.

Answer

Packet capture, because it automatically tells you which NSG rule denied the traffic.

Answer

Connection troubleshoot, because it only checks DNS name resolution.

Question 13

A VM in VNet B can reach a blob storage account through a private endpoint that was created in peered VNet A. The storage FQDN still resolves to the public IP when queried from VNet B, so the VM does not use the private path. What should the administrator change?

Accepted Answer

Link the private DNS zone used by the private endpoint to VNet B. The private endpoint in VNet A creates a private IP for the storage account, but DNS resolution in VNet B still returns the public IP because the private DNS zone (privatelink.blob.core.windows.net) is not linked to VNet B. By linking the private DNS zone to VNet B, the VM will resolve the storage FQDN to the private IP, ensuring traffic uses the private endpoint path through the VNet peering.

Answer

Add a service endpoint for Microsoft.Storage to VNet B

Answer

Disable the storage account firewall completely

Answer

Move the storage account into VNet B

Question 14

Based on the exhibit, the web tier can reach the API subnet by name, but the traffic is still blocked. What should the administrator do?

Accepted Answer

Add the API VM NICs to the destination application security group.. The web tier can resolve the API subnet's name, but traffic is still blocked. This indicates that the network security group (NSG) rules are not correctly configured to allow traffic from the web VMs (in ASG-Web) to the API VMs (in ASG-API). By adding the API VM NICs to the destination application security group (ASG), the NSG rule that references ASG-API as the destination will match the API VMs, allowing the traffic. Without this, the NSG rule may be referencing an empty or incorrect destination, causing the traffic to be denied by the default deny rule.

Answer

Increase the priority number of the allow rule so it is evaluated earlier.

Answer

Replace the ASG with a service endpoint on the API subnet.

Answer

Remove the web VMs from ASG-Web because ASGs block traffic by default.

Question 15

A storage account has public network access disabled. A VM in a virtual network must access blob data privately, and the application must resolve the storage endpoint name to a private IP address. What should the administrator deploy?

Accepted Answer

A private endpoint for the storage account plus a private DNS zone linked to the virtual network. A private endpoint assigns the storage account a private IP from the VM's virtual network, enabling direct, secure access over the Microsoft backbone. A private DNS zone linked to the virtual network ensures the storage endpoint name (e.g., mystorageaccount.blob.core.windows.net) resolves to that private IP, meeting the requirement for private name resolution without relying on public DNS or hosts file entries.

Answer

A service endpoint for Microsoft.Storage and a custom hosts file entry on the VM

Answer

Allow trusted Microsoft services and keep using the public endpoint

Answer

A route table that sends traffic for the storage account's public IP to the VPN gateway