AZ-104 Implement and Manage Virtual Networking Practice Test 2 — 15 Questions

Question 1

A branch office with a static public IP needs encrypted connectivity to an Azure virtual network so users can access private Azure VMs and internal services. The connection should support a site-to-site design and not rely on public IPs for the Azure resources themselves. Which service should the administrator deploy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPN gateway with a site-to-site connection. A VPN gateway with a site-to-site connection (option C) is the correct choice because it provides encrypted connectivity over the public internet between an on-premises branch office with a static public IP and an Azure virtual network. This design uses IPsec/IKE (RFC 4301) to secure traffic, and Azure resources remain private within the VNet, not requiring public IPs. The site-to-site connection establishes a tunnel from the on-premises VPN device to the Azure VPN gateway, enabling users to access private VMs and services securely.

Answer

Azure VNet peering

Answer

Service endpoint

Answer

Azure Front Door

Question 2

Based on the exhibit, HTTPS traffic from the admin workstation is still being blocked. What change should the administrator make?

Accepted Answer

Change Allow-HTTPS-Admin to priority 100.. The Deny-All-Inbound rule shown in the exhibit must be a custom rule with a lower numeric priority (higher priority) than the Allow-HTTPS-Admin rule at priority 200. Since Azure NSG rules are processed in priority order (lowest number = highest priority), the deny rule is evaluated first and blocks HTTPS traffic. By changing Allow-HTTPS-Admin to priority 100, it becomes higher priority than the custom deny rule, allowing HTTPS traffic.

Answer

Delete the Deny-All-Inbound rule.

Answer

Change Allow-HTTPS-Admin protocol from TCP to Any.

Answer

Move the allow rule to outbound traffic.

Question 3

Two VM scale sets named Web and App run in separate subnets. The App subnet NSG already contains Deny-All-Inbound at priority 300. The business wants only the Web tier to connect to the App tier on TCP 8443, and any new scale-out instances must be included automatically. What should the administrator add?

Accepted Answer

An inbound allow rule using source WebASG, destination AppASG, TCP 8443, with a priority lower than 300.. It uses an Application Security Group (ASG) as the source and destination, which automatically includes all current and future VM instances in the Web and App scale sets. The rule allows TCP 8443 from WebASG to AppASG with a priority lower than 300 (e.g., 250) so it is evaluated before the Deny-All-Inbound rule at priority 300. This ensures that only the Web tier can connect to the App tier on the specified port, and new scale-out instances are included automatically without manual NSG updates.

Answer

A rule that allows TCP 8443 from the current Web subnet address range to the App subnet.

Answer

A load balancer NAT rule that maps port 8443 from the Internet to the App tier.

Answer

A service endpoint for Microsoft.Web on both subnets.

Question 4

A subnet must send traffic to on-premises networks through a VPN gateway, but internet-bound traffic should use the Azure platform's normal outbound path and not be forced through a virtual appliance. The administrator wants to avoid creating a 0.0.0.0/0 user-defined route. Which design meets the requirement?

Accepted Answer

Associate a route table that contains only the specific on-premises prefixes and disable gateway route propagation.. To send traffic to on-premises prefixes via the VPN gateway while keeping internet traffic on the normal Azure path, create a route table with specific user-defined routes (UDRs) for the on-premises prefixes pointing to the VPN gateway. Disable virtual network gateway route propagation on the route table so that the subnet does not inherit any default route from the VPN gateway. With propagation disabled, the subnet's effective routes combine the specific UDRs with Azure's system default route (0.0.0.0/0 to the internet), naturally directing internet traffic outbound without a forced tunnel.

Answer

Add a 0.0.0.0/0 route to the VPN gateway and disable gateway route propagation.

Answer

Create a service endpoint for the subnet and use it as the default next hop.

Answer

Attach an NSG rule that allows on-premises traffic and blocks all internet traffic.

Question 5

An application in AppSubnet must access an Azure Storage account over the public endpoint, but only traffic from that subnet should be allowed, and the traffic should stay on the Microsoft backbone. The administrator does not want to create a private IP for the service. Which two actions should be taken? Select two.

Accepted Answer

Enable a service endpoint for Microsoft.Storage on AppSubnet.. Enabling a service endpoint for Microsoft.Storage on AppSubnet (Option A) allows traffic from that subnet to route to the Azure Storage account over the Microsoft backbone while still using the public endpoint. In addition, the storage account firewall must be configured to allow traffic from AppSubnet (Option B); without this rule, the service endpoint traffic will be rejected. Together these actions fulfill the requirements without creating a private IP.

Answer

Create a private endpoint in AppSubnet.

Answer

Disable public network access on the storage account.

Answer

Assign a public IP address to the storage account.

Question 6

Based on the exhibit, what should the administrator change so outbound internet traffic uses the NAT gateway?

Accepted Answer

Remove the 0.0.0.0/0 user-defined route to the virtual appliance.. The user-defined route (UDR) with destination 0.0.0.0/0 pointing to the virtual appliance overrides the system route that enables the NAT gateway for outbound internet. To use the NAT gateway, remove the conflicting 0.0.0.0/0 UDR so the system route takes effect and the NAT gateway handles outbound traffic.

Answer

Detach the subnet from the NAT gateway.

Answer

Change the route table source address to 10.1.0.4.

Answer

Enable a service endpoint on the subnet.

Question 7

A web tier and a backend tier are deployed in separate subnets. Backend VMs are rebuilt regularly, so their private IP addresses change. The web tier must reach only the backend VMs on TCP 8443, and administrators do not want to update NSG rules whenever a backend VM is replaced. The backend subnet also contains management VMs that the web tier must not access. What should be used in the NSG rule?

Accepted Answer

Application security groups for both tiers, because they track the VMs even when IP addresses change.. Application Security Groups (ASGs) allow you to group VMs logically and reference them in NSG rules. When backend VMs are rebuilt and their private IPs change, the ASG membership (based on the VM's NIC configuration) remains intact, so the NSG rule continues to apply without manual updates. Using the backend subnet CIDR would allow traffic to all resources in the backend subnet, including management VMs, so it is too broad for this requirement.

Answer

The backend subnet CIDR, because subnet ranges never change during VM rebuilds.

Answer

The AzureLoadBalancer service tag, because it identifies internal traffic between tiers.

Answer

A user-defined route to the backend subnet, because route tables follow the VM even if the IP changes.

Question 8

Based on the exhibit, which subnet prefix is the smallest that can support the planned resources in Azure?

Accepted Answer

/26. The subnet prefix /26 provides 64 IP addresses per subnet (2^(32-26) = 64), of which 59 are usable after Azure reserves 5 addresses (first 4 and last 1). The planned resources require 30 IP addresses, so /26 is the smallest prefix that meets this requirement. A /27 would only provide 32 total addresses (27 usable), which is insufficient.

Answer

/27

Answer

/25

Answer

/24

Question 9

You are planning a subnet for an application tier in a new spoke virtual network. The subnet must support 34 VM NICs, 5 private endpoints, and 6 extra IP addresses for short-term scale-out during maintenance windows. Azure reserves 5 IP addresses in every subnet. What is the smallest subnet prefix that meets the requirement?

Accepted Answer

/26. The subnet must support 34 VM NICs, 5 private endpoints, and 6 extra IPs for scale-out, totaling 45 required IPs. Azure reserves 5 IP addresses in every subnet (first 4 and last 1). Therefore, the subnet needs at least 50 usable IP addresses. A /26 subnet provides 64 total IPs, of which 59 are usable (64 - 5), meeting the requirement. /27 provides only 32 total IPs (27 usable), which is insufficient.

Answer

/27

Answer

/25

Answer

/28

Question 10

A new spoke virtual network will peer with an existing hub that uses 10.10.0.0/16 and an on-premises network that uses 10.20.0.0/16. Which two address spaces could you assign to the new spoke without overlapping those ranges? Select two.

Accepted Answer

10.11.0.0/16. Options A (10.11.0.0/16) and C (192.168.50.0/24) are both correct because they do not overlap with the hub's 10.10.0.0/16 or the on-premises 10.20.0.0/16. The other options are subsets of those ranges and would cause conflicts in Azure virtual network peering.

Answer

10.10.128.0/17

Answer

10.20.1.0/24

Answer

10.10.1.0/24

Question 11

Based on the exhibit, why is TCP 8443 traffic from the web tier still denied to the app tier, and what should you do to allow only the web tier?

Accepted Answer

Add an inbound allow rule for TCP 8443 from ASG-Web to ASG-App with a priority lower than 100.. In Azure Network Security Groups (NSGs), rules are evaluated in priority order, with lower numbers evaluated first. The existing rule at priority 100 allows traffic from the web tier but does not explicitly allow TCP 8443, so a subsequent deny-all rule at priority 200 blocks it. To allow only the web tier, you must add an inbound allow rule for TCP 8443 from ASG-Web with a priority lower than 100 (e.g., 90). This new rule is evaluated before the existing rule at priority 100, permitting the desired traffic while still blocking other sources.

Answer

Change the deny-all rule at priority 200 to allow TCP 8443 from ASG-Web.

Answer

Add a route table entry for 8443 traffic from the web tier to the app tier.

Answer

Remove the AzureLoadBalancer rule because it is overriding the web tier traffic.

Question 12

Which two Network Watcher tools can help you diagnose whether a VM can reach another address and whether a specific flow is allowed or denied? Select two.

Accepted Answer

Connection troubleshoot. Connection Troubleshoot (A) is correct because it performs end-to-end connectivity checks between a source VM and a target (IP/FQDN/URL), testing latency, packet loss, and hop-by-hop routing. It also identifies whether the connection is blocked by NSG or firewall rules, making it ideal for diagnosing reachability and flow permission issues. IP flow verify (B) is also correct because it checks whether a specific packet flow is allowed or denied by security rules, returning the rule that allowed or denied the traffic for a given source/destination, port, and protocol.

Answer

Packet capture

Answer

Effective routes

Answer

Network topology

Question 13

A spoke subnet has a user-defined route for 10.60.0.0/16 that sends traffic to a virtual appliance at 10.1.0.4. The same subnet also learns a propagated route for 10.60.0.0/16 from a VPN gateway. A VM in the subnet sends traffic to 10.60.7.25. Which next hop will Azure use?

Accepted Answer

The virtual appliance at 10.1.0.4. Azure uses the most specific route match first. Both the user-defined route (UDR) and the propagated BGP route are for 10.60.0.0/16, so their prefix lengths are equal. When multiple routes have the same prefix, Azure prioritizes route origin in this order: user-defined routes (UDRs), then BGP routes, then system routes. Therefore, the UDR with next hop 10.1.0.4 is used for traffic to 10.60.7.25.

Answer

The VPN gateway

Answer

The Internet

Answer

No next hop is available

Question 14

A team is creating a subnet for 48 small Linux VMs, two internal load balancer frontend IPs, and one Azure Bastion host. Azure reserves five IP addresses in every subnet. Which subnet prefix is the smallest that will still meet the requirement?

Accepted Answer

/26. /26 because it provides 64 total IP addresses, of which Azure reserves 5, leaving 59 usable IPs. This is the smallest prefix that accommodates the 48 VMs, 2 load balancer frontend IPs, and 1 Bastion host (total 51 required IPs). A /27 would only yield 32 total IPs (27 usable), which is insufficient.

Answer

/27

Answer

/25

Answer

/28

Question 15

A subnet has these inbound NSG rules: Rule 100 denies TCP 3389 from Internet, Rule 200 allows TCP 3389 from 10.0.0.0/8, and Rule 300 allows TCP 3389 from AzureLoadBalancer. An administrator in 10.20.5.4 cannot RDP to a VM in the subnet. Why is the connection denied?

Accepted Answer

The deny rule at priority 100 matches before the allow rule at priority 200.. The correct answer is A: the deny rule at priority 100 matches before the allow rule at priority 200. In an NSG, inbound rules are evaluated in priority order from the lowest number to the highest, and the first rule that matches the traffic is applied; since Rule 100 denies TCP 3389 from Internet and the administrator's source 10.20.5.4 falls within the Internet tag's scope, the deny takes effect before Rule 200 can allow it. Rule 200 would only apply if no earlier rule matched, so the allow for 10.0.0.0/8 never gets evaluated. Option B is wrong because AzureLoadBalancer is a separate service tag that only affects traffic from the Azure load balancer probe address, not general inbound RDP. Option C is wrong because a public IP is not required for RDP from a private source within allowed address ranges. Option D is wrong because NSGs use priority order, not longest prefix match, to evaluate rules.

Answer

The AzureLoadBalancer service tag blocks all other inbound traffic on that port.

Answer

The VM needs a public IP address for RDP to work from a private source.

Answer

NSG rules are processed by longest prefix match, so the /8 source loses to the /32 VM address.