AZ-104 Implement and Manage Virtual Networking Practice Test 2 — 15 Questions

Question 1

A subnet contains several application servers. You need to allow inbound TCP 3389 only from a management subnet named Subnet-Mgmt and deny RDP from all other sources. What should you do?

Accepted Answer

Create an NSG rule allowing TCP 3389 from the Subnet-Mgmt address range and rely on the default deny afterward.. Option A is correct because Network Security Groups (NSGs) in Azure filter traffic based on rules that are evaluated in priority order. By creating an inbound rule that allows TCP 3389 (RDP) from the Subnet-Mgmt address range, and relying on the default implicit deny rule that blocks all other inbound traffic, you effectively restrict RDP access to only the management subnet. No additional configuration is needed to deny traffic from other sources, as the default deny handles that automatically.

Answer

Create a route table that sends RDP traffic to the management subnet.

Answer

Deploy a private endpoint for each application server.

Answer

Enable service endpoints on the application subnet.

Question 2

Two virtual machines named VM-Web01 and VM-Web02 host the same public web application. Users on the internet must connect through a single public IP address, and incoming requests should be distributed across both VMs. What should you deploy?

Accepted Answer

A public load balancer. A public load balancer (Azure Load Balancer with a public frontend IP) is required because it provides a single public IP address for internet clients and distributes incoming traffic across the backend VMs (VM-Web01 and VM-Web02) using a configured load-balancing rule. This ensures high availability and scalability for the web application.

Answer

An internal load balancer

Answer

A private DNS zone

Answer

A Recovery Services vault

Question 3

Your company deploys a network virtual appliance (NVA) in a hub subnet. All outbound internet traffic from Subnet-App in a spoke VNet must pass through the NVA for inspection. What should you configure on Subnet-App?

Accepted Answer

A user-defined route with a next hop of Virtual Appliance. A user-defined route (UDR) with a next hop of Virtual Appliance forces all outbound traffic from Subnet-App to be forwarded to the NVA for inspection. This overrides Azure's default system route for 0.0.0.0/0, which normally sends internet-bound traffic directly to the internet. By specifying the NVA's private IP as the next hop, you ensure traffic is routed through the hub subnet for inspection before leaving the network.

Answer

A private DNS zone

Answer

A service endpoint for Microsoft.Storage

Answer

A NAT gateway on the NVA subnet only

Question 4

You have two virtual networks named VNet-Hub and VNet-Spoke1 in the same Azure region. Resources in the two VNets must communicate privately over the Microsoft backbone without using a VPN gateway. What should you configure?

Accepted Answer

VNet peering. VNet peering enables direct, private connectivity between two virtual networks in the same Azure region using the Microsoft backbone infrastructure. It does not require a VPN gateway, public IP addresses, or any internet transit, making it the correct choice for private communication between VNet-Hub and VNet-Spoke1.

Answer

A site-to-site VPN

Answer

A public load balancer

Answer

An NSG outbound deny rule

Question 5

Traffic from Subnet-App to the internet is being routed through a virtual appliance unexpectedly. You need to identify which route is being applied to the network interface of VM-App01. Which Azure feature should you use?

Accepted Answer

Effective routes for the network interface. Effective routes for the network interface (NIC) shows the actual routes applied to a specific VM's NIC after evaluating all route tables, virtual network gateway routes, and BGP routes. Since traffic from Subnet-App to the internet is unexpectedly going through a virtual appliance, you need to see which route (e.g., a user-defined route with next hop type VirtualAppliance or VirtualNetworkGateway) is being selected based on the longest prefix match. This tool directly displays the effective next hop for each destination prefix, allowing you to identify the misconfigured route causing the traffic to be redirected.

Answer

NSG flow logs

Answer

Azure Policy compliance

Answer

The subscription activity log

Question 6

You have two virtual networks in the same Azure region named VNet-App and VNet-DB. Resources in the two networks must communicate privately over the Azure backbone without using VPN gateways. What should you configure?

Accepted Answer

Virtual network peering. Virtual network peering connects two Azure virtual networks in the same region via the Microsoft backbone infrastructure, enabling private IP communication without a VPN gateway or public internet. This is the correct solution because it meets the requirement for private, low-latency connectivity between VNet-App and VNet-DB using Azure's high-speed backbone.

Answer

A site-to-site VPN

Answer

A network security group

Answer

An Azure Firewall policy only

Question 7

You need to allow RDP access from the internet to a Windows VM named VM-Admin01 in Azure. The VM already has a public IP address. Which additional configuration is required?

Accepted Answer

An NSG rule allowing inbound TCP 3389. An NSG (Network Security Group) rule allowing inbound TCP port 3389 is required to permit Remote Desktop Protocol (RDP) traffic from the internet to reach the Windows VM. Even though the VM has a public IP address, Azure NSGs act as a stateful firewall at the subnet or NIC level, and by default all inbound traffic is denied unless explicitly allowed. Without this rule, RDP connection attempts will be blocked.

Answer

A private DNS zone

Answer

A user-defined route to Azure Monitor

Answer

A blob lifecycle management rule

Question 8

You have an Azure load balancer in front of two virtual machines. The load balancer reports both instances as unavailable even though the VMs are running. What is the most likely cause?

Accepted Answer

The health probe is failing.. The health probe is the mechanism by which the Azure Load Balancer determines the availability of backend instances. If the probe is misconfigured (e.g., wrong port, protocol, path, or interval) or the backend VMs are not responding to the probe requests (e.g., firewall blocking the probe traffic or the application not listening on the specified port), the load balancer marks both instances as 'Unavailable' even though the VMs are running. This is the most common cause of backend pool unavailability.

Answer

The VMs are in an availability set.

Answer

The storage account uses the Cool tier.

Answer

The subscription has a budget alert.

Question 9

A subnet contains two NSGs: one associated with the subnet and one associated with the NIC of VM-App03. You need to determine whether inbound TCP 3389 from the internet is allowed. What is the correct interpretation?

Accepted Answer

The effective rules are determined by evaluating both NSGs together, and a deny in either applicable path can block access.. When a subnet NSG and a NIC NSG are both applied, Azure evaluates the effective rules by combining both NSGs. Inbound traffic must be allowed by both NSGs along the traffic path; if either NSG has a deny rule that matches the traffic (e.g., a default deny rule for inbound internet traffic), the traffic is blocked. Option C correctly states that a deny in either applicable path can block access, which is the fundamental behavior of NSG evaluation in Azure.

Answer

The NIC NSG always overrides the subnet NSG.

Answer

Inbound traffic is allowed as long as one NSG has an allow rule.

Answer

Subnet NSGs apply only to outbound traffic.

Question 10

You create a private endpoint for an Azure Storage account and disable public network access on the account. A VM in a peered VNet cannot reach the storage account by name. The private endpoint resides in VNet-App. What is the most likely missing configuration?

Accepted Answer

A private DNS zone linked so the relevant VNet can resolve the storage account to the private endpoint IP. When you create a private endpoint for an Azure Storage account and disable public network access, the storage account's public DNS name must resolve to the private endpoint's private IP address within the VNet. This requires a private DNS zone (privatelink.blob.core.windows.net) linked to the VNet where the VM resides. Without that DNS zone link, the VM in the peered VNet will resolve the storage account name to the public IP, which is unreachable because public access is disabled, causing the connection failure.

Answer

An NSG rule allowing outbound DNS to 8.8.8.8

Answer

A Recovery Services vault in the peered VNet

Answer

A public IP address on the private endpoint NIC

Question 11

You need to expose a web application running on several VMs and distribute traffic across them based on HTTP request attributes such as URL path. Which service should you use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a Layer 7 load balancer that can route traffic based on HTTP request attributes such as URL path, host headers, or query strings. This allows you to distribute incoming web traffic across multiple VMs based on the specific URL path (e.g., /images to one backend pool, /api to another), which is exactly what the question requires.

Answer

Azure Load Balancer

Answer

Traffic Manager

Answer

Network Watcher

Question 12

VNet-Hub and VNet-Spoke1 are in the same region and subscription. Resources in the two VNets must communicate over the Microsoft backbone without using a VPN gateway. What should you configure?

Accepted Answer

VNet peering. VNet peering enables direct connectivity between two virtual networks in the same region and subscription over the Microsoft backbone, without requiring a VPN gateway or public internet. This is the correct solution because it provides low-latency, private communication using the Azure infrastructure, and it supports resources in both VNets to communicate as if they were on the same network.

Answer

A site-to-site VPN gateway in each VNet

Answer

A private endpoint

Answer

A service endpoint

Question 13

You need to connect VNet-Hub and VNet-Spoke so that resources in both virtual networks can communicate privately over the Microsoft backbone. Both virtual networks are in the same region. What should you configure?

Accepted Answer

Virtual network peering. Virtual network peering (A) is the correct solution because it enables direct, private connectivity between two virtual networks over the Microsoft backbone infrastructure. Since both VNets are in the same region, you can use standard VNet peering, which routes traffic between the peered networks using only private IP addresses, with no internet transit or gateway required. This meets the requirement for private communication without any additional VPN or gateway overhead.

Answer

A site-to-site VPN

Answer

A network security group

Answer

An Azure Policy assignment

Question 14

Traffic from VM-App01 is unexpectedly reaching the internet through a network virtual appliance. You need to determine which route is currently applied to the virtual machine network interface. Which Azure tool should you use?

Accepted Answer

Effective routes for the network interface. Effective routes for the network interface show the actual routes applied to a VM's NIC, including system routes, BGP routes, and user-defined routes (UDRs). Since traffic is unexpectedly reaching the internet through an NVA, you need to verify which route (e.g., a UDR with next hop type VirtualAppliance) is currently active. This tool directly displays the effective route table for the specific NIC, allowing you to identify the misconfigured route.

Answer

NSG flow logs

Answer

Azure Advisor recommendations

Answer

Diagnostic settings for the activity log

Question 15

A Windows VM in Azure has a public IP address, but administrators on the internet cannot connect by using Remote Desktop. You confirm that the VM is running and the guest firewall allows RDP. What is the most likely Azure-side cause?

Accepted Answer

The NSG does not allow inbound TCP 3389. The most likely Azure-side cause is that a Network Security Group (NSG) associated with the VM's subnet or network interface is blocking inbound traffic on TCP port 3389 (RDP). Even if the VM is running and the guest OS firewall allows RDP, an NSG rule must explicitly permit inbound TCP 3389 from the internet (or a specific source) for Remote Desktop connections to succeed. Without such a rule, the NSG silently drops the packets before they reach the VM.

Answer

The storage account uses LRS

Answer

Azure Advisor is not enabled

Answer

The VM is in an availability set