AZ-104 Implement and Manage Virtual Networking Practice Test 18 — 15 Questions

Question 1

A storage account must remain reachable through its public endpoint for an on-premises integration server, but only one Azure subnet should be allowed to access it from Azure. The team does not want private endpoints or DNS changes. What should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable a service endpoint on the subnet and add that subnet to the storage account networking rules. A service endpoint extends the virtual network identity to the storage account, allowing you to restrict access to a specific subnet while keeping the public endpoint enabled for on-premises access. This meets the requirement of allowing only one Azure subnet to access the storage account from Azure without using private endpoints or DNS changes.

Answer

Add a private endpoint and disable public network access

Answer

Create a SAS token restricted to that subnet

Answer

Assign Storage Blob Data Reader to the subnet

Question 2

A hub VNet is peered to two spoke VNets. The spokes can reach the hub, but they cannot communicate with each other through the hub. The administrator wants centralized inspection in the hub. What should be deployed and configured?

Accepted Answer

An Azure Firewall or other NVA in the hub, plus user-defined routes and forwarding support.. Azure Firewall or an NVA in the hub can inspect traffic between spokes, but by default, Azure routing does not forward spoke-to-spoke traffic through the hub. To force this traffic through the firewall, you must configure user-defined routes (UDRs) on the spoke subnets with a next hop of the firewall's private IP, and enable IP forwarding on the NVA. This setup enables centralized inspection and transitive routing through the hub.

Answer

Only additional peering links between the hub and both spokes.

Answer

A private endpoint in the hub for each spoke subnet.

Answer

A service endpoint on each spoke subnet to the hub VNet.

Question 3

Frontend VMs in one subnet must reach backend VMs on TCP 8443. The backend VMs are rebuilt frequently, so their private IP addresses change often. The administrator wants to avoid updating NSG rules every time the backend IPs change. What should be used in the NSG rule?

Accepted Answer

Application Security Groups for the frontend and backend tiers.. Application Security Groups (ASGs) allow you to group VMs logically by function (e.g., frontend, backend) and reference those groups in NSG rules. Since the backend VMs are rebuilt frequently and their private IPs change, using ASGs in the NSG rule (source = frontend ASG, destination = backend ASG, port = 8443) eliminates the need to update IP addresses manually. The NSG rule remains valid as long as the VMs are assigned to the correct ASG, regardless of IP changes.

Answer

A service endpoint on the backend subnet.

Answer

A route table with a next hop of Virtual network gateway.

Answer

A private endpoint for each backend VM.

Question 4

A Linux VM in a subnet must accept SSH only from the corporate admin subnet 10.8.4.0/24. The subnet NSG currently has an Allow-SSH rule for Any at priority 300 and a Deny-SSH rule for Any at priority 200. Administrators from 10.8.4.0/24 still cannot connect. What change should the administrator make?

Accepted Answer

Add an Allow-SSH rule for 10.8.4.0/24 with a priority lower than 200.. In an NSG, rules are processed in priority order from lowest number to highest, and the first matching rule wins, so the Deny-SSH rule at priority 200 is evaluated before the Allow-SSH rule at priority 300 and blocks all SSH traffic including from 10.8.4.0/24. The correct fix is to add an Allow-SSH rule for 10.8.4.0/24 with a priority lower than 200 (for example 100), so it is evaluated before the deny rule and permits the admin subnet. Option A does not help because changing the protocol to Any still leaves the deny rule at a lower priority number than the allow rule, so it still matches first. Option C makes the problem worse by moving the allow rule to priority 400, which is evaluated even later. Option D is irrelevant because NSG filtering, not routing, is what is blocking the SSH connection.

Answer

Change the deny rule protocol from TCP to Any so the allow rule is evaluated first.

Answer

Move the existing Allow-SSH rule to priority 400 so it applies later.

Answer

Add a route table to the subnet so the SSH packets follow a different path.

Question 5

A storage account has public network access disabled. An app in a VNet must read and write blobs privately, and the team wants the blob endpoint name to resolve to a private IP without exposing the service publicly. What should the administrator configure?

Accepted Answer

A private endpoint for the storage account and a private DNS zone for blob name resolution.. A private endpoint assigns the storage account a private IP from the VNet, ensuring all traffic to the blob endpoint stays within Microsoft's backbone. A private DNS zone (e.g., `privatelink.blob.core.windows.net`) is required so that the blob endpoint name resolves to that private IP instead of the public IP, meeting the requirement for private name resolution without any public exposure.

Answer

A service endpoint on the subnet and a storage firewall allow rule.

Answer

A public IP address for the app and allow access from that IP in the storage firewall.

Answer

An NSG rule that allows outbound TCP 443 from the app subnet to storage.

Question 6

A company has VNet-A with address space 10.20.0.0/16 and active workloads in several subnets. The team must peer VNet-A with VNet-B, but VNet-B currently uses 10.20.128.0/17 and cannot be rebuilt from scratch. What should the administrator do first to make peering possible without interrupting current workloads?

Accepted Answer

Add a new non-overlapping address space to VNet-B, create replacement subnets there, and migrate workloads gradually.. Azure Virtual Network peering requires that the address spaces of the peered VNets do not overlap. VNet-A uses 10.20.0.0/16, which fully contains VNet-B's 10.20.128.0/17, creating an overlap. Since VNet-B cannot be rebuilt, the correct first step is to add a new non-overlapping address space (e.g., 10.30.0.0/16) to VNet-B, create subnets in that new range, migrate workloads gradually, and then remove the overlapping address space before establishing the peering. This ensures no IP conflicts and avoids disrupting existing workloads.

Answer

Create the peering now and let Azure automatically route overlapping prefixes.

Answer

Attach a route table to VNet-B so traffic to VNet-A is forced through a firewall appliance.

Answer

Create a private endpoint between the two VNets so Azure ignores the overlap during connectivity checks.

Question 7

Based on the exhibit, the VPN gateway deployment fails during validation. What resource is missing?

Accepted Answer

A public IP address resource associated with the VPN gateway.. A VPN gateway requires a dedicated public IP address resource to establish the IPsec tunnel with the on-premises VPN device. During validation, Azure checks that a public IP address is associated with the gateway; if missing, the deployment fails because the gateway cannot route traffic over the internet or terminate the VPN connection.

Answer

A network security group attached to GatewaySubnet.

Answer

A route table with a default route to the on-premises network.

Answer

A private endpoint for the on-premises VPN device.

Question 8

A company merged with another business, and two Azure virtual networks need to be peered for shared application access. One VNet uses 10.20.0.0/16 and the other uses 10.20.128.0/17. The administrator must make the peering work with minimal operational complexity. What should be done first?

Accepted Answer

Renumber one VNet to a non-overlapping address range before creating the peering.. Azure VNet peering requires non-overlapping address spaces. The two VNets (10.20.0.0/16 and 10.20.128.0/17) overlap because 10.20.128.0/17 is a subset of 10.20.0.0/16. Peering will fail with an error about overlapping address ranges. Renumbering one VNet to a non-overlapping range (e.g., 10.21.0.0/16) is the only way to satisfy the prerequisite for peering with minimal operational complexity.

Answer

Create a route table on both VNets and point the overlapping prefixes to a virtual appliance.

Answer

Enable gateway transit on both VNets so overlapping ranges can be routed around.

Answer

Create a private endpoint in each VNet for the applications that need access.

Question 9

A subnet uses a user-defined route that sends 0.0.0.0/0 to a firewall appliance. One server in the subnet must download updates directly from 40.90.10.25 over the Internet, while all other outbound traffic should continue through the firewall. What is the best change?

Accepted Answer

Add a more specific /32 route for 40.90.10.25 with next hop type Internet.. Adding a more specific /32 route for 40.90.10.25 with next hop type Internet overrides the default route (0.0.0.0/0) for traffic destined to that specific IP. User-defined routes (UDRs) follow the longest prefix match principle, so the /32 route takes precedence over the /0 route, allowing the server to reach the update site directly via the internet while all other outbound traffic continues through the firewall appliance.

Answer

Remove the default route so all traffic uses the system routes.

Answer

Create a service endpoint for the server and the update site.

Answer

Attach a NAT gateway to the subnet so the server can bypass the firewall.

Question 10

Based on the exhibit, the spoke virtual network must use the hub's existing VPN gateway to reach on-premises networks. Which peering setting should be enabled on the spoke-to-hub peering?

Accepted Answer

Use remote gateways on the spoke peering.. The 'Use remote gateways' setting on the spoke-to-hub peering allows the spoke virtual network to use the hub's existing VPN gateway for connectivity to on-premises networks. This setting forwards traffic from the spoke through the hub's gateway, enabling transitive routing without deploying a separate gateway in the spoke. It requires the hub-to-spoke peering to have 'Allow gateway transit' enabled.

Answer

Allow forwarded traffic on the spoke peering.

Answer

Delete the peering and create a virtual network gateway in the spoke.

Answer

Enable service endpoints on the spoke subnet.

Question 11

An NSG outbound rule allows TCP 8443 traffic from ASG-Web to ASG-Api. The web VM NIC is in ASG-Web, but the API VM NICs were deployed into the correct subnet and never added to ASG-Api. The traffic still fails. What should the administrator do?

Accepted Answer

Add the API VM NICs to ASG-Api.. The NSG rule references ASG-Api as the destination, but the API VM NICs were never added to that application security group. ASGs are logical groupings of VM NICs; a rule targeting an ASG only applies to NICs that are members of that ASG. Since the API NICs are not in ASG-Api, the rule does not match them, and traffic fails. Adding the API VM NICs to ASG-Api resolves the issue by making them valid destinations for the rule.

Answer

Move the NSG to the web subnet so source membership is automatically detected.

Answer

Change the destination port to 443 because ASGs only work with common HTTPS traffic.

Answer

Create a service endpoint for the spoke subnet so the NSG rule becomes effective.

Question 12

A company needs to peer VNet-Prod, which uses 10.30.0.0/16, with VNet-Shared, which uses 10.30.64.0/18. The peering creation fails with an address-space overlap error. The team can renumber the shared environment, but they do not want to change any addresses in VNet-Prod. What should the administrator do before retrying the peering?

Accepted Answer

Reconfigure VNet-Shared to use a non-overlapping address range, then recreate its subnets and migrate workloads.. VNet peering requires that the address spaces of the two VNets do not overlap. VNet-Prod uses 10.30.0.0/16, which includes the range 10.30.64.0/18 used by VNet-Shared, causing the overlap error. The only way to resolve this without changing VNet-Prod is to reconfigure VNet-Shared to use a non-overlapping address range, which involves deleting and recreating its subnets and migrating workloads, as stated in option B.

Answer

Add an NSG that allows traffic between the two VNets.

Answer

Rename VNet-Shared so Azure treats it as a different network.

Answer

Enable gateway transit on both VNets so Azure can route around the overlap.

Question 13

A VM has an NSG with these inbound rules: Deny-RDP at priority 100 for TCP 3389 from Any, and Allow-RDP-Admins at priority 200 for TCP 3389 from 10.8.1.0/24. Admins from 10.8.1.0/24 still cannot connect by RDP. What change fixes access while keeping all other sources blocked?

Accepted Answer

Move the allow rule to a lower priority number than 100.. C is correct because NSG rules are evaluated in priority order, with lower numbers evaluated first. The Deny-RDP rule at priority 100 is evaluated before the Allow-RDP-Admins rule at priority 200, so traffic from 10.8.1.0/24 is denied before the allow rule is reached. Moving the allow rule to a priority lower than 100 (e.g., 90) ensures it is evaluated first, allowing the admin traffic while the deny rule still blocks all other sources.

Answer

Change the deny rule to protocol Any so the allow rule will be evaluated first.

Answer

Add a UDR that sends TCP 3389 traffic to the VM subnet.

Answer

Associate an application security group with the VM and keep the existing priorities.

Question 14

A storage account has public network access disabled. A VM in VNet-App can reach a private endpoint for the account, but the storage name still resolves to the public IP address from the VM, and connections are denied. What should the administrator configure?

Accepted Answer

A private DNS zone for the storage blob endpoint linked to VNet-App.. When public network access is disabled on a storage account and a private endpoint is configured, the storage account's public DNS name must resolve to the private endpoint's private IP address within the virtual network. By default, the DNS name continues to resolve to the public IP address, causing connection failures. Linking a private DNS zone (privatelink.blob.core.windows.net) to VNet-App enables automatic resolution of the storage blob endpoint to the private IP address, allowing the VM to connect successfully.

Answer

A service endpoint on the subnet so the storage account uses a private IP address.

Answer

A storage account access key on the VM so the public endpoint will accept the connection.

Answer

A user-defined route sending storage traffic to the virtual network gateway.

Question 15

An administrator is deploying a site-to-site VPN gateway in Azure. The GatewaySubnet already exists, but the deployment fails because no public-facing address is available for the gateway. What is required for the gateway to deploy and accept the on-premises connection?

Accepted Answer

Create and associate a public IP address with the VPN gateway.. A site-to-site VPN gateway in Azure requires a public IP address to establish the encrypted tunnel with the on-premises VPN device. The public IP address is assigned to the gateway's frontend configuration, enabling it to send and receive IPsec/IKE traffic over the internet. Without this public-facing address, the gateway cannot be provisioned or accept the on-premises connection.

Answer

Assign a standard Load Balancer to the GatewaySubnet.

Answer

Create a private endpoint for the virtual network gateway.

Answer

Delegate the GatewaySubnet to Microsoft.Network/privateEndpoints.