AZ-104 Implement and Manage Virtual Networking Practice Test 18 — 15 Questions

Question 1

An NSG outbound rule allows TCP 8443 traffic from ASG-Web to ASG-Api. The web VM NIC is in ASG-Web, but the API VM NICs were deployed into the correct subnet and never added to ASG-Api. The traffic still fails. What should the administrator do?

Accepted Answer

Add the API VM NICs to ASG-Api.. The NSG rule references ASG-Api as the destination, but the API VM NICs were never added to that application security group. ASGs are logical groupings of VM NICs; a rule targeting an ASG only applies to NICs that are members of that ASG. Since the API NICs are not in ASG-Api, the rule does not match them, and traffic fails. Adding the API VM NICs to ASG-Api resolves the issue by making them valid destinations for the rule.

Answer

Move the NSG to the web subnet so source membership is automatically detected.

Answer

Change the destination port to 443 because ASGs only work with common HTTPS traffic.

Answer

Create a service endpoint for the spoke subnet so the NSG rule becomes effective.

Question 2

A company needs to peer VNet-Prod, which uses 10.30.0.0/16, with VNet-Shared, which uses 10.30.64.0/18. The peering creation fails with an address-space overlap error. The team can renumber the shared environment, but they do not want to change any addresses in VNet-Prod. What should the administrator do before retrying the peering?

Accepted Answer

Reconfigure VNet-Shared to use a non-overlapping address range, then recreate its subnets and migrate workloads.. VNet peering requires that the address spaces of the two VNets do not overlap. VNet-Prod uses 10.30.0.0/16, which includes the range 10.30.64.0/18 used by VNet-Shared, causing the overlap error. The only way to resolve this without changing VNet-Prod is to reconfigure VNet-Shared to use a non-overlapping address range, which involves deleting and recreating its subnets and migrating workloads, as stated in option B.

Answer

Add an NSG that allows traffic between the two VNets.

Answer

Rename VNet-Shared so Azure treats it as a different network.

Answer

Enable gateway transit on both VNets so Azure can route around the overlap.

Question 3

An administrator is preparing an Azure site-to-site VPN gateway deployment for an existing VNet. Which two prerequisites must be in place for the gateway to deploy successfully? Select two.

Accepted Answer

A dedicated GatewaySubnet must exist in the VNet.. Option A is correct because a dedicated GatewaySubnet is a mandatory requirement for deploying any Azure VPN gateway. This subnet must be named 'GatewaySubnet' and must have a minimum address prefix of /29 (though /27 is recommended) to accommodate the gateway VMs and future scaling. Without this subnet, the gateway creation will fail as Azure uses it to host the gateway VMs and route traffic.

Answer

The VNet must already contain a private endpoint for on-premises connectivity.

Answer

A network security group must be attached to the GatewaySubnet.

Answer

The VNet must use a service endpoint for Microsoft.Network.

Question 4

An app running on an Azure VM must access Azure SQL Database over a private IP inside the VNet. The team also wants the SQL server name to resolve to that private address without using custom host-file entries. What should be configured?

Accepted Answer

A private endpoint for Azure SQL Database and a linked private DNS zone.. Option B is correct because a private endpoint assigns Azure SQL Database a private IP address from the VM's VNet, enabling traffic to stay within Microsoft's backbone. Linking a private DNS zone automatically resolves the SQL server's FQDN (e.g., server.database.windows.net) to that private IP, eliminating the need for custom host-file entries. This meets both requirements: private IP connectivity and DNS resolution without manual configuration.

Answer

A service endpoint on the VM subnet and a firewall rule on Azure SQL Database.

Answer

A public IP address on the VM and a SQL server firewall exception.

Answer

An NSG rule that allows outbound TCP 1433 to the SQL server.

Question 5

A VM has an NSG with these inbound rules: Deny-RDP at priority 100 for TCP 3389 from Any, and Allow-RDP-Admins at priority 200 for TCP 3389 from 10.8.1.0/24. Admins from 10.8.1.0/24 still cannot connect by RDP. What change fixes access while keeping all other sources blocked?

Accepted Answer

Move the allow rule to a lower priority number than 100.. C is correct because NSG rules are evaluated in priority order, with lower numbers evaluated first. The Deny-RDP rule at priority 100 is evaluated before the Allow-RDP-Admins rule at priority 200, so traffic from 10.8.1.0/24 is denied before the allow rule is reached. Moving the allow rule to a priority lower than 100 (e.g., 90) ensures it is evaluated first, allowing the admin traffic while the deny rule still blocks all other sources.

Answer

Change the deny rule to protocol Any so the allow rule will be evaluated first.

Answer

Add a UDR that sends TCP 3389 traffic to the VM subnet.

Answer

Associate an application security group with the VM and keep the existing priorities.

Question 6

A storage account has public network access disabled. A VM in VNet-App can reach a private endpoint for the account, but the storage name still resolves to the public IP address from the VM, and connections are denied. What should the administrator configure?

Accepted Answer

A private DNS zone for the storage blob endpoint linked to VNet-App.. When public network access is disabled on a storage account and a private endpoint is configured, the storage account's public DNS name must resolve to the private endpoint's private IP address within the virtual network. By default, the DNS name continues to resolve to the public IP address, causing connection failures. Linking a private DNS zone (privatelink.blob.core.windows.net) to VNet-App enables automatic resolution of the storage blob endpoint to the private IP address, allowing the VM to connect successfully.

Answer

A service endpoint on the subnet so the storage account uses a private IP address.

Answer

A storage account access key on the VM so the public endpoint will accept the connection.

Answer

A user-defined route sending storage traffic to the virtual network gateway.

Question 7

An administrator is deploying a site-to-site VPN gateway in Azure. The GatewaySubnet already exists, but the deployment fails because no public-facing address is available for the gateway. What is required for the gateway to deploy and accept the on-premises connection?

Accepted Answer

Create and associate a public IP address with the VPN gateway.. A site-to-site VPN gateway in Azure requires a public IP address to establish the encrypted tunnel with the on-premises VPN device. The public IP address is assigned to the gateway's frontend configuration, enabling it to send and receive IPsec/IKE traffic over the internet. Without this public-facing address, the gateway cannot be provisioned or accept the on-premises connection.

Answer

Assign a standard Load Balancer to the GatewaySubnet.

Answer

Create a private endpoint for the virtual network gateway.

Answer

Delegate the GatewaySubnet to Microsoft.Network/privateEndpoints.

Question 8

A team wants one subnet to access an existing Storage account over its public endpoint. They do not want a private IP for the account or any DNS changes, but they want to block access from all other subnets. What should the administrator configure?

Accepted Answer

Enable a service endpoint on the subnet and add a virtual network rule on the storage account.. Option B is correct because a service endpoint extends the virtual network's identity to the Azure Storage service, allowing the subnet to access the storage account over its public endpoint without requiring a private IP or DNS changes. By enabling a service endpoint on the subnet and adding a virtual network rule on the storage account, you restrict access to only that subnet while blocking all other subnets, meeting the team's requirements.

Answer

Create a private endpoint and disable public network access on the storage account.

Answer

Assign the Storage Blob Data Reader role to the subnet.

Answer

Associate a route table with a default route to the storage account private IP.

Question 9

A subnet has an NSG with these inbound rules: priority 100 denies TCP 443 from Any, and priority 200 allows TCP 443 from an Application Security Group named WebFrontEnd. A backend VM in the subnet still does not accept traffic from the frontend tier. What should the administrator change?

Accepted Answer

Move the allow rule to a lower priority number than the deny rule.. Network Security Group (NSG) rules are evaluated in priority order, with lower numbers evaluated first. Since the deny rule has priority 100 and the allow rule has priority 200, the deny rule is evaluated first and blocks TCP 443 traffic from any source, including the WebFrontEnd Application Security Group. To allow the frontend traffic, the allow rule must be moved to a lower priority number (e.g., 90) so it is evaluated before the deny rule.

Answer

Change the allow rule source from an Application Security Group to VirtualNetwork.

Answer

Attach a user-defined route to the subnet so traffic bypasses the NSG.

Answer

Place the backend VM in a different availability set so the rule is evaluated differently.

Question 10

An administrator is deploying a site-to-site VPN gateway in Azure. Which resource must be attached to the gateway so it can receive encrypted connections from the on-premises VPN device?

Accepted Answer

A public IP address resource.. A site-to-site VPN gateway in Azure requires a public IP address resource to be attached so that the on-premises VPN device can establish an encrypted IPsec/IKE tunnel to it. The public IP address provides the routable endpoint on the internet that the on-premises device connects to, and it is assigned to the gateway's front-end configuration. Without this public IP, the gateway cannot receive inbound encrypted traffic from the external network.

Answer

A private endpoint.

Answer

A service endpoint.

Answer

A network security group.

Question 11

A web tier and API tier run in different subnets. The API subnet NSG currently has Deny-8443 from Any at priority 200 and Allow-8443-WebToApi from ASG-Web to ASG-Api at priority 300. Web requests on TCP 8443 are failing. Which two changes should the administrator make? Select two.

Accepted Answer

Move the allow rule to a lower priority number than 200.. B is correct because NSG rules are evaluated in priority order, with lower numbers having higher priority. The Deny-8443 rule at priority 200 is evaluated before the Allow-8443-WebToApi rule at priority 300, so the deny rule blocks the traffic. Moving the allow rule to a lower priority number (e.g., 100) ensures it is evaluated first, allowing the traffic. C is correct because the allow rule uses application security groups (ASGs); if the web and API NICs are not assigned to the respective ASGs, the rule will not match any traffic, effectively making it a no-op.

Answer

Move the allow rule to a higher priority number than 200.

Answer

Change the rule protocol from TCP to Any.

Answer

Attach a route table to the API subnet to override the deny behavior.

Question 12

Match each network design requirement or limitation on the left with the best Azure behavior or corrective action on the right.

Question 13

An application in a VNet must access an Azure Storage account over a private IP address. Public network access is disabled on the storage account, and the app must resolve the normal blob FQDN to that private address only from within the VNet. What should the administrator configure?

Accepted Answer

A private endpoint for the blob service and a linked private DNS zone for the VNet.. Option B is correct because a private endpoint assigns the storage account a private IP from the VNet, and linking a private DNS zone (e.g., `privatelink.blob.core.windows.net`) to the VNet ensures that the blob FQDN resolves to that private IP only from within the VNet. This meets the requirement of disabling public network access while providing private connectivity and DNS resolution.

Answer

A service endpoint on the subnet and a storage account firewall rule for the subnet.

Answer

Allow trusted Microsoft services on the storage account and keep the public endpoint enabled.

Answer

Create a public DNS record that maps the blob FQDN to the storage account's public IP address.

Question 14

An application subnet has an NSG outbound rule Deny-HTTPS at priority 200 for TCP 443 to Any. A second outbound rule Allow-HTTPS-API at priority 300 permits TCP 443 from ASG-Web to ASG-Api. Web servers can reach other ports but not the API. What change should the administrator make?

Accepted Answer

Change the allow rule to a higher priority than 200, such as 100.. Option B is correct because NSG rules are evaluated in priority order, with lower numbers having higher precedence. The Deny-HTTPS rule at priority 200 blocks all outbound TCP 443 traffic, including traffic from ASG-Web to ASG-Api. To allow the specific traffic, the Allow-HTTPS-API rule must have a lower priority number (e.g., 100) so it is evaluated before the deny rule, permitting the desired traffic while the deny rule still blocks other outbound HTTPS traffic.

Answer

Delete the deny rule so the allow rule can be evaluated.

Answer

Change the destination from ASG-Api to the entire subnet address range.

Answer

Change the protocol from TCP to Any so the rule matches more traffic.

Question 15

A subnet has a user-defined route for 10.0.0.0/8 with next hop Virtual appliance 10.1.1.4. The VNet is peered with VNet-Shared, whose address space is 10.12.0.0/16. A VM in the subnet sends traffic to 10.12.4.25. Which next hop will Azure use?

Accepted Answer

VNet peering, because the peered VNet prefix is more specific than the broader UDR.. Azure uses the most specific matching route to determine next hop. The user-defined route (UDR) for 10.0.0.0/8 has a broader prefix length (/8) than the VNet peering route for 10.12.0.0/16 (/16). Since 10.12.4.25 falls within the peered VNet's address space, the more specific /16 route from VNet peering takes precedence over the UDR, directing traffic through the peering connection.

Answer

Virtual appliance 10.1.1.4, because the user-defined route controls all 10.x.x.x traffic.

Answer

Internet, because traffic not explicitly matched by the UDR leaves through the default route.

Answer

None, because Azure cannot route to peered VNets when a UDR exists on the subnet.