AZ-104 Implement and Manage Virtual Networking Practice Test 17 — 15 Questions

Question 1

A team wants an Azure VM in a subnet to reach a storage account securely without opening the account to the entire internet. Which two configuration choices can be used to achieve this? Select two.

Accepted Answer

Private endpoint. Private endpoint (A) assigns a private IP address from the VM's subnet to the storage account, enabling secure connectivity over the Microsoft backbone network without exposing the account to the public internet. Service endpoint (B) extends the virtual network identity to the storage account via its public endpoint but restricts access to traffic originating from the specified subnet, also avoiding full internet exposure. Both options satisfy the requirement for secure, subnet-restricted access.

Answer

Enable anonymous blob access

Answer

Move the account to the Archive tier

Answer

Apply a delete lock to the storage account

Question 2

A storage account has public network access disabled. An application runs on a VM in a VNet and must access the storage account over a private IP address. The team also wants the storage name to resolve to a private address inside the VNet without changing application code. What should the administrator create?

Accepted Answer

A private endpoint for the storage account and a corresponding private DNS zone link.. A private endpoint assigns the storage account a private IP from the VNet, making it accessible over a private IP address. A corresponding private DNS zone link (e.g., privatelink.blob.core.windows.net) ensures the storage account name resolves to that private IP inside the VNet without modifying application code, meeting both requirements.

Answer

A service endpoint on the subnet and a storage account firewall rule allowing that subnet.

Answer

An account SAS token with read/write permissions for the application.

Answer

Allow trusted Microsoft services to bypass the storage firewall.

Question 3

A VM in a spoke subnet must send all traffic destined for 172.16.0.0/12 to a firewall appliance at 10.1.1.4. All other destinations should continue to use Azure system routes. Which user-defined route should the administrator add to the subnet route table?

Accepted Answer

Destination 172.16.0.0/12 with next hop Virtual appliance and next hop address 10.1.1.4.. Option B is correct because a user-defined route (UDR) with destination 172.16.0.0/12 and next hop type 'Virtual appliance' (with IP 10.1.1.4) overrides the default Azure system route for that prefix, forcing all traffic to the 172.16.0.0/12 range through the firewall at 10.1.1.4. This satisfies the requirement while leaving all other destinations (including 0.0.0.0/0) to be handled by Azure's default system routes.

Answer

Destination 0.0.0.0/0 with next hop Internet.

Answer

Destination 172.16.0.0/12 with next hop Virtual network gateway.

Answer

Destination 172.16.0.0/12 with next hop None.

Question 4

A storage account must remain reachable through its public endpoint for an on-premises integration server, but only one Azure subnet should be allowed to access it from Azure. The team does not want private endpoints or DNS changes. What should the administrator configure?

Accepted Answer

Enable a service endpoint on the subnet and add that subnet to the storage account networking rules. Option B is correct because a service endpoint extends the virtual network identity to the storage account, allowing you to restrict access to a specific subnet while keeping the public endpoint enabled for on-premises access. This meets the requirement of allowing only one Azure subnet to access the storage account from Azure without using private endpoints or DNS changes.

Answer

Add a private endpoint and disable public network access

Answer

Create a SAS token restricted to that subnet

Answer

Assign Storage Blob Data Reader to the subnet

Question 5

A hub VNet is peered to two spoke VNets. The spokes can reach the hub, but they cannot communicate with each other through the hub. The administrator wants centralized inspection in the hub. What should be deployed and configured?

Accepted Answer

An Azure Firewall or other NVA in the hub, plus user-defined routes and forwarding support.. Option A is correct because Azure Firewall or an NVA in the hub can inspect traffic between spokes, but by default, Azure routing does not forward spoke-to-spoke traffic through the hub. To force this traffic through the firewall, you must configure user-defined routes (UDRs) on the spoke subnets with a next hop of the firewall's private IP, and enable IP forwarding on the NVA. This setup enables centralized inspection and transitive routing through the hub.

Answer

Only additional peering links between the hub and both spokes.

Answer

A private endpoint in the hub for each spoke subnet.

Answer

A service endpoint on each spoke subnet to the hub VNet.

Question 6

Frontend VMs in one subnet must reach backend VMs on TCP 8443. The backend VMs are rebuilt frequently, so their private IP addresses change often. The administrator wants to avoid updating NSG rules every time the backend IPs change. What should be used in the NSG rule?

Accepted Answer

Application Security Groups for the frontend and backend tiers.. Application Security Groups (ASGs) allow you to group VMs logically by function (e.g., frontend, backend) and reference those groups in NSG rules. Since the backend VMs are rebuilt frequently and their private IPs change, using ASGs in the NSG rule (source = frontend ASG, destination = backend ASG, port = 8443) eliminates the need to update IP addresses manually. The NSG rule remains valid as long as the VMs are assigned to the correct ASG, regardless of IP changes.

Answer

A service endpoint on the backend subnet.

Answer

A route table with a next hop of Virtual network gateway.

Answer

A private endpoint for each backend VM.

Question 7

A Linux VM in a subnet must accept SSH only from the corporate admin subnet 10.8.4.0/24. The subnet NSG currently has an Allow-SSH rule for Any at priority 300 and a Deny-SSH rule for Any at priority 200. Administrators from 10.8.4.0/24 still cannot connect. What change should the administrator make?

Accepted Answer

Add an Allow-SSH rule for 10.8.4.0/24 with a priority lower than 200.. The subnet NSG has a Deny-SSH rule for Any at priority 200, which blocks all SSH traffic regardless of source. To allow SSH only from 10.8.4.0/24, an Allow-SSH rule for that specific subnet must be added with a priority lower (higher number) than 200, such as 210, so it is evaluated after the deny rule. Since NSG rules are processed in priority order (lowest number first), the deny at 200 will block traffic before the allow rule is reached unless the allow rule has a lower priority number, which is not possible here; instead, the allow rule must have a higher priority number (e.g., 210) to be evaluated after the deny, but the correct approach is to add an allow rule with a priority lower than 200 (i.e., a smaller number) to override the deny. However, the correct answer states 'priority lower than 200' meaning a numerically smaller value (e.g., 100), which would be evaluated before the deny rule, allowing traffic from 10.8.4.0/24 before the deny rule blocks it. This is the standard NSG rule evaluation behavior: the highest priority (lowest number) rule wins.

Answer

Change the deny rule protocol from TCP to Any so the allow rule is evaluated first.

Answer

Move the existing Allow-SSH rule to priority 400 so it applies later.

Answer

Add a route table to the subnet so the SSH packets follow a different path.

Question 8

A storage account has public network access disabled. An app in a VNet must read and write blobs privately, and the team wants the blob endpoint name to resolve to a private IP without exposing the service publicly. What should the administrator configure?

Accepted Answer

A private endpoint for the storage account and a private DNS zone for blob name resolution.. Option D is correct because a private endpoint assigns the storage account a private IP from the VNet, ensuring all traffic to the blob endpoint stays within Microsoft's backbone. A private DNS zone (e.g., `privatelink.blob.core.windows.net`) is required so that the blob endpoint name resolves to that private IP instead of the public IP, meeting the requirement for private name resolution without any public exposure.

Answer

A service endpoint on the subnet and a storage firewall allow rule.

Answer

A public IP address for the app and allow access from that IP in the storage firewall.

Answer

An NSG rule that allows outbound TCP 443 from the app subnet to storage.

Question 9

An administrator is deploying a site-to-site VPN gateway in an existing VNet. The GatewaySubnet already exists, but deployment validation fails because the gateway has no public-facing IP resource. Which configuration is required?

Accepted Answer

Attach a Standard SKU public IP address with static allocation to the VPN gateway.. A site-to-site VPN gateway in Azure requires a public IP address to establish connectivity with the on-premises VPN device. The Standard SKU public IP with static allocation is required because VPN gateways do not support Basic SKU public IPs and must have a static IP that does not change. Without this public IP resource, the gateway cannot be provisioned as it has no public endpoint for the VPN tunnel.

Answer

Attach a private IP address from the GatewaySubnet to the VPN gateway.

Answer

Place the gateway behind an internal load balancer in the GatewaySubnet.

Answer

Create a NAT gateway and associate it with the GatewaySubnet.

Question 10

An app must resolve a storage account name to the private IP address created by a private endpoint. Which two actions are required? Select two.

Accepted Answer

Create the private endpoint in the same virtual network as the app. Option A is correct because a private endpoint must be in the same virtual network as the app to provide a private IP address that the app can directly reach. Without this, the app cannot resolve the storage account name to the private IP, as the private endpoint's network interface is only accessible from within that VNet.

Answer

Enable a service endpoint on the subnet

Answer

Add a public DNS record pointing to the storage account

Answer

Turn on blob versioning

Question 11

A company has VNet-A with address space 10.20.0.0/16 and active workloads in several subnets. The team must peer VNet-A with VNet-B, but VNet-B currently uses 10.20.128.0/17 and cannot be rebuilt from scratch. What should the administrator do first to make peering possible without interrupting current workloads?

Accepted Answer

Add a new non-overlapping address space to VNet-B, create replacement subnets there, and migrate workloads gradually.. Azure Virtual Network peering requires that the address spaces of the peered VNets do not overlap. VNet-A uses 10.20.0.0/16, which fully contains VNet-B's 10.20.128.0/17, creating an overlap. Since VNet-B cannot be rebuilt, the correct first step is to add a new non-overlapping address space (e.g., 10.30.0.0/16) to VNet-B, create subnets in that new range, migrate workloads gradually, and then remove the overlapping address space before establishing the peering. This ensures no IP conflicts and avoids disrupting existing workloads.

Answer

Create the peering now and let Azure automatically route overlapping prefixes.

Answer

Attach a route table to VNet-B so traffic to VNet-A is forced through a firewall appliance.

Answer

Create a private endpoint between the two VNets so Azure ignores the overlap during connectivity checks.

Question 12

Based on the exhibit, the VPN gateway deployment fails during validation. What resource is missing?

Accepted Answer

A public IP address resource associated with the VPN gateway.. A VPN gateway requires a dedicated public IP address resource to establish the IPsec tunnel with the on-premises VPN device. During validation, Azure checks that a public IP address is associated with the gateway; if missing, the deployment fails because the gateway cannot route traffic over the internet or terminate the VPN connection.

Answer

A network security group attached to GatewaySubnet.

Answer

A route table with a default route to the on-premises network.

Answer

A private endpoint for the on-premises VPN device.

Question 13

A company merged with another business, and two Azure virtual networks need to be peered for shared application access. One VNet uses 10.20.0.0/16 and the other uses 10.20.128.0/17. The administrator must make the peering work with minimal operational complexity. What should be done first?

Accepted Answer

Renumber one VNet to a non-overlapping address range before creating the peering.. Azure VNet peering requires non-overlapping address spaces. The two VNets (10.20.0.0/16 and 10.20.128.0/17) overlap because 10.20.128.0/17 is a subset of 10.20.0.0/16. Peering will fail with an error about overlapping address ranges. Renumbering one VNet to a non-overlapping range (e.g., 10.21.0.0/16) is the only way to satisfy the prerequisite for peering with minimal operational complexity.

Answer

Create a route table on both VNets and point the overlapping prefixes to a virtual appliance.

Answer

Enable gateway transit on both VNets so overlapping ranges can be routed around.

Answer

Create a private endpoint in each VNet for the applications that need access.

Question 14

A subnet uses a user-defined route that sends 0.0.0.0/0 to a firewall appliance. One server in the subnet must download updates directly from 40.90.10.25 over the Internet, while all other outbound traffic should continue through the firewall. What is the best change?

Accepted Answer

Add a more specific /32 route for 40.90.10.25 with next hop type Internet.. Option B is correct because adding a more specific /32 route for 40.90.10.25 with next hop type Internet overrides the default route (0.0.0.0/0) for traffic destined to that specific IP. User-defined routes (UDRs) follow the longest prefix match principle, so the /32 route takes precedence over the /0 route, allowing the server to reach the update site directly via the internet while all other outbound traffic continues through the firewall appliance.

Answer

Remove the default route so all traffic uses the system routes.

Answer

Create a service endpoint for the server and the update site.

Answer

Attach a NAT gateway to the subnet so the server can bypass the firewall.

Question 15

Based on the exhibit, the spoke virtual network must use the hub's existing VPN gateway to reach on-premises networks. Which peering setting should be enabled on the spoke-to-hub peering?

Accepted Answer

Use remote gateways on the spoke peering.. Option B is correct because the 'Use remote gateways' setting on the spoke-to-hub peering allows the spoke virtual network to use the hub's existing VPN gateway for connectivity to on-premises networks. This setting forwards traffic from the spoke through the hub's gateway, enabling transitive routing without deploying a separate gateway in the spoke. It requires the hub-to-spoke peering to have 'Allow gateway transit' enabled.

Answer

Allow forwarded traffic on the spoke peering.

Answer

Delete the peering and create a virtual network gateway in the spoke.

Answer

Enable service endpoints on the spoke subnet.