AZ-104 Implement and Manage Virtual Networking Practice Test 19 — 15 Questions

Question 1

A team wants one subnet to access an existing Storage account over its public endpoint. They do not want a private IP for the account or any DNS changes, but they want to block access from all other subnets. What should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable a service endpoint on the subnet and add a virtual network rule on the storage account.. A service endpoint extends the virtual network's identity to the Azure Storage service, allowing the subnet to access the storage account over its public endpoint without requiring a private IP or DNS changes. By enabling a service endpoint on the subnet and adding a virtual network rule on the storage account, you restrict access to only that subnet while blocking all other subnets, meeting the team's requirements.

Answer

Create a private endpoint and disable public network access on the storage account.

Answer

Assign the Storage Blob Data Reader role to the subnet.

Answer

Associate a route table with a default route to the storage account private IP.

Question 2

A subnet has an NSG with these inbound rules: priority 100 denies TCP 443 from Any, and priority 200 allows TCP 443 from an Application Security Group named WebFrontEnd. A backend VM in the subnet still does not accept traffic from the frontend tier. What should the administrator change?

Accepted Answer

Move the allow rule to a lower priority number than the deny rule.. Network Security Group (NSG) rules are evaluated in priority order, with lower numbers evaluated first. Since the deny rule has priority 100 and the allow rule has priority 200, the deny rule is evaluated first and blocks TCP 443 traffic from any source, including the WebFrontEnd Application Security Group. To allow the frontend traffic, the allow rule must be moved to a lower priority number (e.g., 90) so it is evaluated before the deny rule.

Answer

Change the allow rule source from an Application Security Group to VirtualNetwork.

Answer

Attach a user-defined route to the subnet so traffic bypasses the NSG.

Answer

Place the backend VM in a different availability set so the rule is evaluated differently.

Question 3

An administrator is deploying a site-to-site VPN gateway in Azure. Which resource must be attached to the gateway so it can receive encrypted connections from the on-premises VPN device?

Accepted Answer

A public IP address resource.. A site-to-site VPN gateway in Azure requires a public IP address resource to be attached so that the on-premises VPN device can establish an encrypted IPsec/IKE tunnel to it. The public IP address provides the routable endpoint on the internet that the on-premises device connects to, and it is assigned to the gateway's front-end configuration. Without this public IP, the gateway cannot receive inbound encrypted traffic from the external network.

Answer

A private endpoint.

Answer

A service endpoint.

Answer

A network security group.

Question 4

A web tier and API tier run in different subnets. The API subnet NSG currently has Deny-8443 from Any at priority 200 and Allow-8443-WebToApi from ASG-Web to ASG-Api at priority 300. Web requests on TCP 8443 are failing. Which two changes should the administrator make? Select two.

Accepted Answer

Move the allow rule to a lower priority number than 200.. B is correct because NSG rules are evaluated in priority order, with lower numbers having higher priority. The Deny-8443 rule at priority 200 is evaluated before the Allow-8443-WebToApi rule at priority 300, so the deny rule blocks the traffic. Moving the allow rule to a lower priority number (e.g., 100) ensures it is evaluated first, allowing the traffic. C is correct because the allow rule uses application security groups (ASGs); if the web and API NICs are not assigned to the respective ASGs, the rule will not match any traffic, effectively making it a no-op.

Answer

Move the allow rule to a higher priority number than 200.

Answer

Change the rule protocol from TCP to Any.

Answer

Attach a route table to the API subnet to override the deny behavior.

Question 5

Match each network design requirement or limitation on the left with the best Azure behavior or corrective action on the right.

Accepted Answer

High availability across regions: Use multiple regions with Traffic Manager. Ly matches high availability across regions with deploying to multiple Azure regions and using Traffic Manager, which provides geo-redundancy and failover. Option B correctly matches latency-sensitive applications with performance routing, which directs traffic to the closest endpoint to minimize latency. Option C correctly matches data residency requirements with Azure Policy, which can enforce region restrictions. Option D is incorrect because autoscale handles scaling based on demand, not high availability across regions. Option E is incorrect because deploying to multiple regions with Traffic Manager is for high availability, not for reducing latency.

Answer

High availability across regions: Use autoscale

Answer

Latency-sensitive apps: Use multiple regions with Traffic Manager

Question 6

An application in a VNet must access an Azure Storage account over a private IP address. Public network access is disabled on the storage account, and the app must resolve the normal blob FQDN to that private address only from within the VNet. What should the administrator configure?

Accepted Answer

A private endpoint for the blob service and a linked private DNS zone for the VNet.. A private endpoint assigns the storage account a private IP from the VNet, and linking a private DNS zone (e.g., `privatelink.blob.core.windows.net`) to the VNet ensures that the blob FQDN resolves to that private IP only from within the VNet. This meets the requirement of disabling public network access while providing private connectivity and DNS resolution.

Answer

A service endpoint on the subnet and a storage account firewall rule for the subnet.

Answer

Allow trusted Microsoft services on the storage account and keep the public endpoint enabled.

Answer

Create a public DNS record that maps the blob FQDN to the storage account's public IP address.

Question 7

A subnet has a user-defined route for 10.0.0.0/8 with next hop Virtual appliance 10.1.1.4. The VNet is peered with VNet-Shared, whose address space is 10.12.0.0/16. A VM in the subnet sends traffic to 10.12.4.25. Which next hop will Azure use?

Accepted Answer

VNet peering, because the peered VNet prefix is more specific than the broader UDR.. Azure uses the most specific matching route to determine next hop. The user-defined route (UDR) for 10.0.0.0/8 has a broader prefix length (/8) than the VNet peering route for 10.12.0.0/16 (/16). Since 10.12.4.25 falls within the peered VNet's address space, the more specific /16 route from VNet peering takes precedence over the UDR, directing traffic through the peering connection.

Answer

Virtual appliance 10.1.1.4, because the user-defined route controls all 10.x.x.x traffic.

Answer

Internet, because traffic not explicitly matched by the UDR leaves through the default route.

Answer

None, because Azure cannot route to peered VNets when a UDR exists on the subnet.

Question 8

Match each NSG or ASG scenario to the most accurate Azure security behavior.

Accepted Answer

NSG applied to subnet: Traffic filtering is applied to all network interfaces in that subnet.. NSGs filter traffic at subnet or NIC level, while ASGs group VMs for scalable rule application. Service tags simplify rules for Azure services.

Answer

Service tag in NSG: Allows traffic only to specific IP ranges defined by user.

Answer

ASG automatically updates NSG rules: ASGs integrate with NSGs but do not auto-update rules; rules must reference the ASG.

Question 9

A VM in a subnet must send traffic to 10.50.0.0/16 through an on-premises VPN gateway, while all other destinations should use the Internet. Which route should be added to the subnet's route table?

Accepted Answer

Destination 10.50.0.0/16 with next hop type Virtual network gateway.. The VM needs to send traffic destined for 10.50.0.0/16 through the on-premises VPN gateway. Adding a user-defined route (UDR) with destination 10.50.0.0/16 and next hop type 'Virtual network gateway' forces that specific traffic to be routed over the VPN tunnel, while the default route (0.0.0.0/0) to the Internet remains unchanged, allowing all other traffic to egress via the Internet.

Answer

Destination 0.0.0.0/0 with next hop type Virtual network gateway.

Answer

Destination 10.50.0.0/16 with next hop type Service endpoint.

Answer

Destination 10.50.0.0/16 with next hop type Internet.

Question 10

An NSG on a subnet has these inbound rules: Deny-All-Inbound at priority 100 and Allow-RDP-from-AdminSubnet at priority 200. Administrators on AdminSubnet still cannot RDP to a VM in the subnet. What should the network administrator change?

Accepted Answer

Move the allow rule to a lower priority number than 100.. The NSG rules are evaluated in priority order, with lower numbers having higher precedence. The Deny-All-Inbound rule at priority 100 blocks all traffic, including RDP from AdminSubnet, before the Allow-RDP-from-AdminSubnet rule at priority 200 is evaluated. To allow RDP traffic, the allow rule must have a lower priority number (e.g., 90) than the deny rule (100), ensuring it is evaluated first and permits the traffic before the deny rule blocks it.

Answer

Delete the deny rule so only the allow rule remains.

Answer

Change the VM to a different availability zone.

Answer

Create a private endpoint for the VM.

Question 11

Based on the exhibit, an administrator is trying to peer two VNets so workloads can communicate privately. The peering creation fails. What should the administrator do first?

Accepted Answer

Readdress one of the VNets so the address spaces no longer overlap.. VNet peering requires that the address spaces of the two virtual networks do not overlap. Overlapping address spaces cause routing conflicts and prevent the peering from being established. The administrator must readdress one of the VNets so their IP ranges are unique before retrying the peering.

Answer

Create a user-defined route in VNet-Prod to force traffic through a firewall.

Answer

Enable gateway transit on both VNets and retry the peering.

Answer

Add an NSG rule that allows traffic from the other VNet.

Question 12

A subnet NSG contains a deny inbound rule for TCP 3389 from Any at priority 100 and an allow inbound rule for TCP 3389 from 10.4.1.0/24 at priority 200. Admin workstations in 10.4.1.0/24 cannot connect by RDP. What change should the administrator make?

Accepted Answer

Lower the allow rule priority number so it is evaluated before the deny rule.. NSG rules are evaluated in priority order, with lower numbers having higher priority. The deny rule at priority 100 blocks all TCP 3389 traffic from Any, and the allow rule at priority 200 is never reached. Lowering the allow rule's priority number (e.g., to 90) ensures it is evaluated before the deny rule, allowing RDP traffic from 10.4.1.0/24.

Answer

Replace the source IP range with an application security group in the allow rule.

Answer

Change the protocol from TCP to Any in the allow rule.

Answer

Add a user-defined route to the subnet so RDP traffic bypasses the NSG.

Question 13

An administrator is deploying a site-to-site VPN gateway in the Azure portal. The deployment fails validation because the gateway does not have a public-facing address to terminate the tunnel. What must be created and associated with the VPN gateway?

Accepted Answer

A public IP address resource associated with the VPN gateway.. A site-to-site VPN gateway in Azure requires a public IP address to terminate the IPSec tunnel from the on-premises device. The public IP address resource must be created and associated with the VPN gateway during deployment; without it, the gateway has no routable endpoint for the tunnel, causing validation to fail.

Answer

A load balancer frontend IP configuration in front of the gateway subnet.

Answer

A NAT gateway attached to GatewaySubnet.

Answer

A private endpoint for the virtual network gateway resource.

Question 14

A subnet NSG contains a deny RDP rule from Any at priority 200. The administrator must allow RDP from 10.8.0.0/24 to the virtual machines in that subnet. What should the administrator do?

Accepted Answer

Create an allow rule with a lower priority number than 200.. B is correct because NSG rules are evaluated in priority order, with lower numbers having higher priority. The existing deny rule at priority 200 blocks all RDP traffic. To allow RDP from 10.8.0.0/24, a new allow rule must be created with a priority lower than 200 (e.g., 150) so it is evaluated before the deny rule, permitting the specific traffic.

Answer

Create an allow rule with a higher priority number than 200.

Answer

Add a route table entry for TCP 3389.

Answer

Disable the default security rules on the NSG.

Question 15

Match each storage or PaaS access requirement to the correct Azure networking approach or DNS action.

Accepted Answer

Azure VPN Gateway: Connect on-premises network to Azure storage account over the internet using an encrypted tunnel. VPN and ExpressRoute provide private connectivity, Private Link ensures private IP access, and DNS CNAME records map custom domains to Azure endpoints.

Answer

Azure VPN Gateway: Connect on-premises network to Azure storage account with a dedicated private connection that does not traverse the internet

Answer

Azure Private Link: Map a custom domain name to an Azure App Service endpoint