AZ-104 Implement and Manage Virtual Networking Practice Test 17 — 15 Questions

Question 1

A team manages many application VMs and backend VMs. The VM IP addresses change whenever they are rebuilt, but the same traffic rule must always allow the app tier to reach the backend tier on TCP 8443. What should the administrator use in the NSG rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Application Security Groups for the app and backend VMs.. Application Security Groups (ASGs) allow you to group VMs logically and reference them directly in NSG rules without relying on static IP addresses. Since the VM IPs change on rebuild, ASGs ensure the NSG rule for TCP 8443 always applies to the correct app and backend tiers, regardless of IP changes.

Answer

Static private IP addresses for each virtual machine.

Answer

A user-defined route between the app and backend subnets.

Answer

An availability set for each tier.

Question 2

Two application teams created separate virtual networks so their workloads can communicate through VNet peering. VNet-A uses 10.20.0.0/16. VNet-B was created with 10.20.128.0/17. The peering request fails during validation. What is the best fix?

Accepted Answer

Change one VNet to use a non-overlapping address space.. VNet peering requires that the address spaces of the peered virtual networks do not overlap. VNet-A uses 10.20.0.0/16, which includes the entire range from 10.20.0.0 to 10.20.255.255. VNet-B uses 10.20.128.0/17, which is a subset of VNet-A's range (10.20.128.0 to 10.20.255.255). This overlap causes the peering validation to fail because Azure cannot route traffic between overlapping address spaces. Changing one VNet to a non-overlapping address space resolves the conflict.

Answer

Add an NSG rule to allow traffic between the two VNets.

Answer

Create a private endpoint in each VNet.

Answer

Attach a route table to both subnets.

Question 3

A storage account must remain on its public endpoint, but only one Azure subnet named AppSubnet should be allowed to access it from Azure. No private IP is required. Which two actions should the administrator take? Select two.

Accepted Answer

Enable the Microsoft.Storage service endpoint on AppSubnet.. Enabling the Microsoft.Storage service endpoint on AppSubnet allows traffic from that subnet to the storage account over the Azure backbone network, using the public endpoint while restricting access to only that subnet. Option B is correct because configuring the storage account's networking firewall to allow the selected virtual network and subnet explicitly permits traffic from AppSubnet while blocking all other public access, meeting the requirement to keep the public endpoint but limit access to one subnet.

Answer

Create a private endpoint and disable public network access.

Answer

Link a private DNS zone to AppSubnet.

Answer

Assign the Reader RBAC role to AppSubnet.

Question 4

A web app running on an Azure VM must connect to an Azure SQL Database instance. The security team requires the database to be reachable through a private IP inside the VNet, and the application should keep using the normal SQL server name without any connection string change. What should the administrator implement?

Accepted Answer

A private endpoint for Azure SQL and the corresponding private DNS zone linked to the VNet.. A private endpoint assigns Azure SQL Database a private IP from the VNet, making it reachable via a private IP while preserving the normal SQL server FQDN. The corresponding private DNS zone (privatelink.database.windows.net) linked to the VNet ensures that DNS resolution of the SQL server name resolves to the private IP, so no connection string changes are needed. This meets the security requirement of private IP reachability and the application requirement of unchanged connection strings.

Answer

A service endpoint on the subnet and a firewall rule on the SQL server.

Answer

A public endpoint with selected network access and a network security group on the VM subnet.

Answer

A virtual network peering connection to the SQL service subnet.

Question 5

A hub VNet already has a VPN gateway connected to on-premises. A new spoke VNet must reach on-premises through the hub gateway and should not deploy its own gateway. What configuration should be enabled on the peering?

Accepted Answer

Enable gateway transit on the hub peering and Use remote gateways on the spoke peering.. Enabling 'Use remote gateways' on the spoke VNet peering and 'Allow gateway transit' on the hub VNet peering allows the spoke VNet to route traffic to on-premises through the hub's VPN gateway without deploying its own gateway. This configuration leverages BGP routes (if the VPN gateway is route-based) to propagate on-premises prefixes to the spoke, enabling transitive routing across the peering.

Answer

Create a service endpoint from the spoke to the hub.

Answer

Add a default route to Internet in the spoke subnet.

Answer

Enable accelerated networking on the spoke subnet.

Question 6

Based on the exhibit, two development virtual networks must be peered so the workloads can exchange traffic directly. What should the administrator do first?

Accepted Answer

Change one VNet to a non-overlapping address space before creating the peering.. Azure Virtual Network peering requires that the address spaces of the peered VNets do not overlap. Overlapping address spaces cause routing conflicts because Azure cannot determine which VNet should receive traffic destined for the overlapping range. Therefore, the administrator must first change one VNet to a non-overlapping address space before creating the peering.

Answer

Create a VPN gateway in each VNet before attempting peering.

Answer

Add a user-defined route to each subnet so the VNets can ignore the overlap.

Answer

Enable service endpoints on both VNets to allow cross-network communication.

Question 7

A VM in a subnet must send traffic to 172.16.0.0/16 through a network virtual appliance, but all other destinations should continue using the default Azure system routes. What should the administrator add to the subnet route table?

Accepted Answer

A route for 172.16.0.0/16 with next hop Virtual appliance.. The requirement is to route traffic destined for 172.16.0.0/16 through a network virtual appliance (NVA) while leaving all other traffic to use the default Azure system routes. Adding a user-defined route (UDR) with destination 172.16.0.0/16 and next hop Virtual appliance overrides the default system route for that specific prefix, ensuring traffic to that range is forwarded to the NVA. All other destinations remain unaffected because the 0.0.0.0/0 default route is not modified.

Answer

A route for 0.0.0.0/0 with next hop Virtual appliance.

Answer

An NSG deny rule for all other destinations.

Answer

A service endpoint for the 172.16.0.0/16 network.

Question 8

Backend virtual machines are rebuilt frequently and often receive different private IP addresses. An administrator must allow the frontend tier to reach the backend tier on TCP 8443 without editing NSG rules every time the backend IP changes. What should the administrator use in the NSG rule?

Accepted Answer

An Application Security Group that contains the backend VMs.. An Application Security Group (ASG) allows you to group backend VMs logically and reference that group in a Network Security Group (NSG) rule. When backend VMs are rebuilt and receive new private IPs, you simply add the new VMs to the same ASG, and the existing NSG rule (which references the ASG as the destination) automatically applies to the new IPs without any manual rule edits. This decouples security policy from dynamic IP addresses, making it the ideal solution for frequently changing backend IPs.

Answer

A static private IP address for each backend VM.

Answer

A user-defined route pointing frontend traffic to the backend subnet.

Answer

A private endpoint for the backend tier.

Question 9

An administrator is deploying a new VPN gateway in an existing VNet. The GatewaySubnet currently uses a /28 range, and the deployment fails because the selected gateway configuration does not have enough available IP addresses. What is the best action?

Accepted Answer

Expand GatewaySubnet to a larger range, such as /27, and redeploy the VPN gateway.. The GatewaySubnet requires a minimum /27 range to support most VPN gateway SKUs, as Azure reserves several IP addresses for internal use and the gateway instances need at least 3–6 usable IPs depending on the SKU. Expanding the subnet to /27 provides enough addresses (32 total, minus reserved) to satisfy the gateway's allocation requirements, allowing the deployment to succeed.

Answer

Move one of the gateway's NICs into a normal workload subnet.

Answer

Create a private endpoint inside GatewaySubnet to reserve extra addresses.

Answer

Enable BGP so the gateway needs fewer IP addresses.

Question 10

A company has frontend and backend VMs in the same subnet. Security rules must allow the frontend tier to reach only the backend tier on TCP 443, without assigning rules to individual VM IP addresses. What should the administrator use in the NSG rule?

Accepted Answer

Application security groups for the frontend and backend VMs.. Application Security Groups (ASGs) allow you to group VMs logically by their application tier (e.g., frontend, backend) without relying on individual IP addresses. You can then create an NSG rule that uses the frontend ASG as the source and the backend ASG as the destination, restricting traffic to TCP 443. This meets the requirement of not assigning rules to individual VM IPs while ensuring only frontend VMs can reach backend VMs within the same subnet.

Answer

A user-defined route that sends frontend traffic to the backend subnet.

Answer

A network security group rule that references both subnets by address prefix only.

Answer

A VNet peering connection between the two tiers.

Question 11

A web app in VNet1 must access a storage account by using a private IP address, and the storage account has public network access disabled. The app resolves the storage FQDN from inside the VNet. What should you deploy?

Accepted Answer

A private endpoint for the storage account and the required private DNS zone linkage.. A private endpoint assigns the storage account a private IP address from the VNet, enabling access via a private IP while public network access is disabled. The required private DNS zone linkage ensures the storage FQDN resolves to that private IP from within the VNet, meeting both requirements.

Answer

A service endpoint on the subnet so the storage account gets a private IP.

Answer

A storage account firewall rule that allows the VNet and a public DNS record update.

Answer

A SAS token created for the application service principal.

Question 12

An administrator needs two non-overlapping VNets in the same region to communicate directly over private IP addresses without deploying a gateway. What should be configured?

Accepted Answer

VNet peering between the two virtual networks.. VNet peering enables direct connectivity between two Azure virtual networks using private IP addresses across the Microsoft backbone, without requiring a gateway or public internet. It supports non-overlapping address spaces in the same region and provides low-latency, high-bandwidth communication. This matches the requirement exactly.

Answer

A site-to-site VPN gateway connection.

Answer

A service endpoint on both subnets.

Answer

A route table with default routes to each VNet.

Question 13

A team wants an Azure VM in a subnet to reach a storage account securely without opening the account to the entire internet. Which two configuration choices can be used to achieve this? Select two.

Accepted Answer

Private endpoint. Private endpoint (A) assigns a private IP address from the VM's subnet to the storage account, enabling secure connectivity over the Microsoft backbone network without exposing the account to the public internet. Service endpoint (B) extends the virtual network identity to the storage account via its public endpoint but restricts access to traffic originating from the specified subnet, also avoiding full internet exposure. Both options satisfy the requirement for secure, subnet-restricted access.

Answer

Enable anonymous blob access

Answer

Move the account to the Archive tier

Answer

Apply a delete lock to the storage account

Question 14

A storage account has public network access disabled. An application runs on a VM in a VNet and must access the storage account over a private IP address. The team also wants the storage name to resolve to a private address inside the VNet without changing application code. What should the administrator create?

Accepted Answer

A private endpoint for the storage account and a corresponding private DNS zone link.. A private endpoint assigns the storage account a private IP from the VNet, making it accessible over a private IP address. A corresponding private DNS zone link (e.g., privatelink.blob.core.windows.net) ensures the storage account name resolves to that private IP inside the VNet without modifying application code, meeting both requirements.

Answer

A service endpoint on the subnet and a storage account firewall rule allowing that subnet.

Answer

An account SAS token with read/write permissions for the application.

Answer

Allow trusted Microsoft services to bypass the storage firewall.

Question 15

A VM in a spoke subnet must send all traffic destined for 172.16.0.0/12 to a firewall appliance at 10.1.1.4. All other destinations should continue to use Azure system routes. Which user-defined route should the administrator add to the subnet route table?

Accepted Answer

Destination 172.16.0.0/12 with next hop Virtual appliance and next hop address 10.1.1.4.. A user-defined route (UDR) with destination 172.16.0.0/12 and next hop type 'Virtual appliance' (with IP 10.1.1.4) overrides the default Azure system route for that prefix, forcing all traffic to the 172.16.0.0/12 range through the firewall at 10.1.1.4. This satisfies the requirement while leaving all other destinations (including 0.0.0.0/0) to be handled by Azure's default system routes.

Answer

Destination 0.0.0.0/0 with next hop Internet.

Answer

Destination 172.16.0.0/12 with next hop Virtual network gateway.

Answer

Destination 172.16.0.0/12 with next hop None.