AZ-104 Implement and Manage Virtual Networking Practice Test 19 — 15 Questions

Question 1

Match each NSG or ASG scenario to the most accurate Azure security behavior.

Question 2

A VM in a subnet must send traffic to 10.50.0.0/16 through an on-premises VPN gateway, while all other destinations should use the Internet. Which route should be added to the subnet's route table?

Accepted Answer

Destination 10.50.0.0/16 with next hop type Virtual network gateway.. Option A is correct because the VM needs to send traffic destined for 10.50.0.0/16 through the on-premises VPN gateway. Adding a user-defined route (UDR) with destination 10.50.0.0/16 and next hop type 'Virtual network gateway' forces that specific traffic to be routed over the VPN tunnel, while the default route (0.0.0.0/0) to the Internet remains unchanged, allowing all other traffic to egress via the Internet.

Answer

Destination 0.0.0.0/0 with next hop type Virtual network gateway.

Answer

Destination 10.50.0.0/16 with next hop type Service endpoint.

Answer

Destination 10.50.0.0/16 with next hop type Internet.

Question 3

An NSG on a subnet has these inbound rules: Deny-All-Inbound at priority 100 and Allow-RDP-from-AdminSubnet at priority 200. Administrators on AdminSubnet still cannot RDP to a VM in the subnet. What should the network administrator change?

Accepted Answer

Move the allow rule to a lower priority number than 100.. The NSG rules are evaluated in priority order, with lower numbers having higher precedence. The Deny-All-Inbound rule at priority 100 blocks all traffic, including RDP from AdminSubnet, before the Allow-RDP-from-AdminSubnet rule at priority 200 is evaluated. To allow RDP traffic, the allow rule must have a lower priority number (e.g., 90) than the deny rule (100), ensuring it is evaluated first and permits the traffic before the deny rule blocks it.

Answer

Delete the deny rule so only the allow rule remains.

Answer

Change the VM to a different availability zone.

Answer

Create a private endpoint for the VM.

Question 4

Based on the exhibit, an administrator is trying to peer two VNets so workloads can communicate privately. The peering creation fails. What should the administrator do first?

Accepted Answer

Readdress one of the VNets so the address spaces no longer overlap.. VNet peering requires that the address spaces of the two virtual networks do not overlap. Overlapping address spaces cause routing conflicts and prevent the peering from being established. The administrator must readdress one of the VNets so their IP ranges are unique before retrying the peering.

Answer

Create a user-defined route in VNet-Prod to force traffic through a firewall.

Answer

Enable gateway transit on both VNets and retry the peering.

Answer

Add an NSG rule that allows traffic from the other VNet.

Question 5

A subnet has a route table with these user-defined routes: 172.16.0.0/16 -> Virtual appliance 10.1.1.4 and 172.16.1.0/24 -> Internet. A VM in the subnet sends traffic to 172.16.1.20. Which next hop is used?

Accepted Answer

Internet, because the most specific route prefix always wins.. Azure route selection uses the longest prefix match (most specific route) to determine the next hop. The route 172.16.1.0/24 is more specific than 172.16.0.0/16, so traffic to 172.16.1.20 uses the Internet next hop, not the virtual appliance. This is consistent with how Azure evaluates user-defined routes (UDRs) and system routes.

Answer

Virtual appliance 10.1.1.4, because the broader route was added first.

Answer

Virtual network gateway, because all traffic to private IP addresses uses the gateway by default.

Answer

No next hop, because conflicting user-defined routes disable routing for that destination.

Question 6

A subnet NSG contains a deny inbound rule for TCP 3389 from Any at priority 100 and an allow inbound rule for TCP 3389 from 10.4.1.0/24 at priority 200. Admin workstations in 10.4.1.0/24 cannot connect by RDP. What change should the administrator make?

Accepted Answer

Lower the allow rule priority number so it is evaluated before the deny rule.. The correct answer is C because NSG rules are evaluated in priority order, with lower numbers having higher priority. The deny rule at priority 100 blocks all TCP 3389 traffic from Any, and the allow rule at priority 200 is never reached. Lowering the allow rule's priority number (e.g., to 90) ensures it is evaluated before the deny rule, allowing RDP traffic from 10.4.1.0/24.

Answer

Replace the source IP range with an application security group in the allow rule.

Answer

Change the protocol from TCP to Any in the allow rule.

Answer

Add a user-defined route to the subnet so RDP traffic bypasses the NSG.

Question 7

An administrator is deploying a site-to-site VPN gateway in the Azure portal. The deployment fails validation because the gateway does not have a public-facing address to terminate the tunnel. What must be created and associated with the VPN gateway?

Accepted Answer

A public IP address resource associated with the VPN gateway.. A site-to-site VPN gateway in Azure requires a public IP address to terminate the IPSec tunnel from the on-premises device. The public IP address resource must be created and associated with the VPN gateway during deployment; without it, the gateway has no routable endpoint for the tunnel, causing validation to fail.

Answer

A load balancer frontend IP configuration in front of the gateway subnet.

Answer

A NAT gateway attached to GatewaySubnet.

Answer

A private endpoint for the virtual network gateway resource.

Question 8

Match each routing situation to the next-hop or route-selection behavior Azure will use.

Question 9

A subnet NSG contains a deny RDP rule from Any at priority 200. The administrator must allow RDP from 10.8.0.0/24 to the virtual machines in that subnet. What should the administrator do?

Accepted Answer

Create an allow rule with a lower priority number than 200.. B is correct because NSG rules are evaluated in priority order, with lower numbers having higher priority. The existing deny rule at priority 200 blocks all RDP traffic. To allow RDP from 10.8.0.0/24, a new allow rule must be created with a priority lower than 200 (e.g., 150) so it is evaluated before the deny rule, permitting the specific traffic.

Answer

Create an allow rule with a higher priority number than 200.

Answer

Add a route table entry for TCP 3389.

Answer

Disable the default security rules on the NSG.

Question 10

Match each storage or PaaS access requirement to the correct Azure networking approach or DNS action.

Question 11

An administrator is deploying a route-based site-to-site VPN gateway. The GatewaySubnet already exists, but validation fails because the public IP configuration is incompatible with the chosen gateway. Which public IP setup is required for the gateway?

Accepted Answer

A Standard SKU public IP with static allocation.. For a route-based site-to-site VPN gateway in Azure, the gateway must use a Standard SKU public IP address with static allocation. This is because route-based VPN gateways require the public IP to be statically assigned and the Standard SKU provides the necessary features like availability zones and zone resiliency, which are not supported by the Basic SKU. The Basic SKU public IP is incompatible with route-based VPN gateways, and a private IP from the GatewaySubnet cannot serve as the public endpoint for the VPN connection.

Answer

A Basic SKU public IP with dynamic allocation.

Answer

A Basic SKU public IP with static allocation.

Answer

A private IP address assigned directly from GatewaySubnet.

Question 12

An administrator is deploying an Azure VPN gateway for a site-to-site connection. The deployment fails because required network resources are missing. Which configuration is required before the gateway can be created?

Accepted Answer

A subnet named GatewaySubnet and a public IP address for the VPN gateway.. A VPN gateway in Azure requires a dedicated subnet named 'GatewaySubnet' to host the gateway instances, and a public IP address resource must be allocated to the gateway to establish the site-to-site VPN tunnel over the internet. Without these two prerequisites, the deployment will fail because the gateway cannot be provisioned or addressed externally.

Answer

A subnet named AzureBastionSubnet and a static private IP address.

Answer

A network security group attached directly to the virtual network gateway.

Answer

A load balancer with a public frontend to terminate the VPN connection.

Question 13

You are designing an Azure virtual network for a three-tier application. The frontend, application, and database tiers each require their own subnet. You need to ensure that the frontend tier can communicate with the application tier, but the database tier must be isolated from direct inbound traffic from the internet. Which three of the following actions should you include in your design? (Choose three.)

Accepted Answer

Place all three tiers in the same virtual network using separate subnets.. Assigning a network security group (NSG) to the database subnet that denies all inbound traffic from the internet is correct because NSGs act as a distributed, stateful firewall at the subnet or NIC level. By default, NSGs allow all inbound traffic from within the virtual network, so you must explicitly add a deny rule for internet traffic (source 'Internet') to isolate the database tier. This ensures the database subnet is protected from direct inbound internet traffic while still allowing traffic from the application tier via the default allow rule for virtual network traffic.

Answer

Route traffic from the application tier to the database tier using a user-defined route (UDR) pointing to the Azure Firewall.

Answer

Configure a virtual network peering to connect the frontend and database subnets.

Answer

Use Azure Firewall to inspect traffic between the frontend and application tiers.

Question 14

Your company has two Azure virtual networks in the same region: VNetA (10.0.0.0/16) and VNetB (10.1.0.0/16). You need to enable communication between resources in VNetA and VNetB while ensuring that traffic is encrypted and passes over the Microsoft backbone network. Which three of the following must be configured? (Choose three.)

Accepted Answer

Verify that the virtual network address spaces do not overlap.. Virtual network peering is required to enable direct connectivity between VNetA and VNetB, allowing resources in both networks to communicate over the Microsoft backbone network. Verifying that the address spaces do not overlap (10.0.0.0/16 and 10.1.0.0/16) is a prerequisite for successful peering, as overlapping ranges would cause routing conflicts. Ensuring the virtual networks are in the same Azure region is necessary because standard virtual network peering only works within the same region; global peering would be required for cross-region connectivity, but the question specifies the same region.

Answer

Enable 'Allow gateway transit' on both virtual networks.

Answer

Establish a site-to-site VPN connection between the two virtual networks.

Answer

Create a private endpoint for each resource that needs to communicate.

Question 15

You manage an Azure virtual network with multiple subnets, including a subnet named 'AppSubnet' that hosts critical application servers. You need to monitor and log network traffic to and from AppSubnet for security analysis. The solution must capture all flow logs without impacting application performance. Which three of the following should you implement? (Choose three.)

Accepted Answer

Enable Network Watcher flow logs for AppSubnet.. Network Watcher flow logs capture IP traffic flowing through a subnet, providing security analysis without impacting performance because they are processed by the Azure network fabric, not by the VMs. Storing logs in an Azure Storage account ensures durable, cost-effective retention. Configuring a retention policy is essential to manage storage costs and comply with data lifecycle requirements.

Answer

Deploy a network virtual appliance (NVA) in a transit subnet and route all traffic through it.

Answer

Enable diagnostic settings on each virtual machine in AppSubnet to log network traffic.

Answer

Install a third-party packet capture agent on each application server.