AZ-104 Implement and Manage Virtual Networking Practice Test 2 — 15 Questions

Question 1

A subnet must send traffic to on-premises networks through a VPN gateway, but internet-bound traffic should use the Azure platform's normal outbound path and not be forced through a virtual appliance. The administrator wants to avoid creating a 0.0.0.0/0 user-defined route. Which design meets the requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Associate a route table that contains only the specific on-premises prefixes and disable gateway route propagation.. To send traffic to on-premises prefixes via the VPN gateway while keeping internet traffic on the normal Azure path, create a route table with specific user-defined routes (UDRs) for the on-premises prefixes pointing to the VPN gateway. Disable virtual network gateway route propagation on the route table so that the subnet does not inherit any default route from the VPN gateway. With propagation disabled, the subnet's effective routes combine the specific UDRs with Azure's system default route (0.0.0.0/0 to the internet), naturally directing internet traffic outbound without a forced tunnel.

Answer

Add a 0.0.0.0/0 route to the VPN gateway and disable gateway route propagation.

Answer

Create a service endpoint for the subnet and use it as the default next hop.

Answer

Attach an NSG rule that allows on-premises traffic and blocks all internet traffic.

Question 2

Based on the exhibit, which subnet prefix should be used for Subnet A so it can support about 30 VM NICs?

Accepted Answer

/26. (/26) is correct because a /26 subnet provides 64 IP addresses (2^(32-26) = 64), but Azure reserves 5 IP addresses per subnet (first four and last one), leaving 59 usable addresses. This comfortably supports about 30 VM NICs while leaving room for growth. Options /27 and /28 do not provide enough usable addresses after Azure's reservation (27 provides 27 usable, 28 provides 11 usable), and /25 provides more than needed but is not the most efficient.

Answer

/28

Answer

/27

Answer

/25

Question 3

An application in AppSubnet must access an Azure Storage account over the public endpoint, but only traffic from that subnet should be allowed, and the traffic should stay on the Microsoft backbone. The administrator does not want to create a private IP for the service. Which two actions should be taken? Select two.

Accepted Answer

Enable a service endpoint for Microsoft.Storage on AppSubnet.. Enabling a service endpoint for Microsoft.Storage on AppSubnet (Option A) allows traffic from that subnet to route to the Azure Storage account over the Microsoft backbone while still using the public endpoint. In addition, the storage account firewall must be configured to allow traffic from AppSubnet (Option B); without this rule, the service endpoint traffic will be rejected. Together these actions fulfill the requirements without creating a private IP.

Answer

Create a private endpoint in AppSubnet.

Answer

Disable public network access on the storage account.

Answer

Assign a public IP address to the storage account.

Question 4

A storage account must be reachable only from resources in one Azure subnet, and traffic must use a private IP rather than the public endpoint. Which configuration should the administrator implement?

Accepted Answer

A private endpoint in the subnet. A private endpoint assigns a private IP address from the subnet to the storage account, making it accessible only via that private IP within the virtual network. This ensures traffic never traverses the public endpoint, meeting both the reachability and private IP requirements.

Answer

A service endpoint on the subnet

Answer

A shared access signature scoped to the subnet

Answer

Allow trusted Microsoft services on the storage firewall

Question 5

Based on the exhibit, what should the administrator change so outbound internet traffic uses the NAT gateway?

Accepted Answer

Remove the 0.0.0.0/0 user-defined route to the virtual appliance.. The user-defined route (UDR) with destination 0.0.0.0/0 pointing to the virtual appliance overrides the system route that enables the NAT gateway for outbound internet. To use the NAT gateway, remove the conflicting 0.0.0.0/0 UDR so the system route takes effect and the NAT gateway handles outbound traffic.

Answer

Detach the subnet from the NAT gateway.

Answer

Change the route table source address to 10.1.0.4.

Answer

Enable a service endpoint on the subnet.

Question 6

A web tier and a backend tier are deployed in separate subnets. Backend VMs are rebuilt regularly, so their private IP addresses change. The web tier must reach only the backend VMs on TCP 8443, and administrators do not want to update NSG rules whenever a backend VM is replaced. The backend subnet also contains management VMs that the web tier must not access. What should be used in the NSG rule?

Accepted Answer

Application security groups for both tiers, because they track the VMs even when IP addresses change.. Application Security Groups (ASGs) allow you to group VMs logically and reference them in NSG rules. When backend VMs are rebuilt and their private IPs change, the ASG membership (based on the VM's NIC configuration) remains intact, so the NSG rule continues to apply without manual updates. Using the backend subnet CIDR would allow traffic to all resources in the backend subnet, including management VMs, so it is too broad for this requirement.

Answer

The backend subnet CIDR, because subnet ranges never change during VM rebuilds.

Answer

The AzureLoadBalancer service tag, because it identifies internal traffic between tiers.

Answer

A user-defined route to the backend subnet, because route tables follow the VM even if the IP changes.

Question 7

Based on the exhibit, which subnet prefix is the smallest that can support the planned resources in Azure?

Accepted Answer

/26. The subnet prefix /26 provides 64 IP addresses per subnet (2^(32-26) = 64), of which 59 are usable after Azure reserves 5 addresses (first 4 and last 1). The planned resources require 30 IP addresses, so /26 is the smallest prefix that meets this requirement. A /27 would only provide 32 total addresses (27 usable), which is insufficient.

Answer

/27

Answer

/25

Answer

/24

Question 8

You are planning a subnet for an application tier in a new spoke virtual network. The subnet must support 34 VM NICs, 5 private endpoints, and 6 extra IP addresses for short-term scale-out during maintenance windows. Azure reserves 5 IP addresses in every subnet. What is the smallest subnet prefix that meets the requirement?

Accepted Answer

/26. The subnet must support 34 VM NICs, 5 private endpoints, and 6 extra IPs for scale-out, totaling 45 required IPs. Azure reserves 5 IP addresses in every subnet (first 4 and last 1). Therefore, the subnet needs at least 50 usable IP addresses. A /26 subnet provides 64 total IPs, of which 59 are usable (64 - 5), meeting the requirement. /27 provides only 32 total IPs (27 usable), which is insufficient.

Answer

/27

Answer

/25

Answer

/28

Question 9

A subnet has a user-defined route for 0.0.0.0/0 that sends traffic to a network virtual appliance at 10.1.0.4. The same virtual network is peered to a hub VNet that has a system route for 10.50.16.0/20. A VM in the subnet sends traffic to 10.50.18.25. Which next hop will Azure use?

Accepted Answer

Virtual network peering, because the /20 peering route is more specific than 0.0.0.0/0.. Azure uses the most specific route (longest prefix match) to determine next hop. The destination 10.50.18.25 falls within the 10.50.16.0/20 range of the peering route, which is more specific than the 0.0.0.0/0 UDR. Therefore, the traffic is routed via the virtual network peering, not the NVA.

Answer

Internet, because the default route overrides more specific routes.

Answer

Network virtual appliance at 10.1.0.4, because user-defined routes always win over system routes.

Answer

None, because Azure disables routing when a subnet has both peering and a UDR.

Question 10

A new spoke virtual network will peer with an existing hub that uses 10.10.0.0/16 and an on-premises network that uses 10.20.0.0/16. Which two address spaces could you assign to the new spoke without overlapping those ranges? Select two.

Accepted Answer

10.11.0.0/16. Options A (10.11.0.0/16) and C (192.168.50.0/24) are both correct because they do not overlap with the hub's 10.10.0.0/16 or the on-premises 10.20.0.0/16. The other options are subsets of those ranges and would cause conflicts in Azure virtual network peering.

Answer

10.10.128.0/17

Answer

10.20.1.0/24

Answer

10.10.1.0/24

Question 11

Which two Network Watcher tools can help you diagnose whether a VM can reach another address and whether a specific flow is allowed or denied? Select two.

Accepted Answer

Connection troubleshoot. Connection Troubleshoot (A) is correct because it performs end-to-end connectivity checks between a source VM and a target (IP/FQDN/URL), testing latency, packet loss, and hop-by-hop routing. It also identifies whether the connection is blocked by NSG or firewall rules, making it ideal for diagnosing reachability and flow permission issues. IP flow verify (B) is also correct because it checks whether a specific packet flow is allowed or denied by security rules, returning the rule that allowed or denied the traffic for a given source/destination, port, and protocol.

Answer

Packet capture

Answer

Effective routes

Answer

Network topology

Question 12

A spoke subnet has a user-defined route for 10.60.0.0/16 that sends traffic to a virtual appliance at 10.1.0.4. The same subnet also learns a propagated route for 10.60.0.0/16 from a VPN gateway. A VM in the subnet sends traffic to 10.60.7.25. Which next hop will Azure use?

Accepted Answer

The virtual appliance at 10.1.0.4. Azure uses the most specific route match first. Both the user-defined route (UDR) and the propagated BGP route are for 10.60.0.0/16, so their prefix lengths are equal. When multiple routes have the same prefix, Azure prioritizes route origin in this order: user-defined routes (UDRs), then BGP routes, then system routes. Therefore, the UDR with next hop 10.1.0.4 is used for traffic to 10.60.7.25.

Answer

The VPN gateway

Answer

The Internet

Answer

No next hop is available

Question 13

A team is creating a subnet for 48 small Linux VMs, two internal load balancer frontend IPs, and one Azure Bastion host. Azure reserves five IP addresses in every subnet. Which subnet prefix is the smallest that will still meet the requirement?

Accepted Answer

/26. /26 because it provides 64 total IP addresses, of which Azure reserves 5, leaving 59 usable IPs. This is the smallest prefix that accommodates the 48 VMs, 2 load balancer frontend IPs, and 1 Bastion host (total 51 required IPs). A /27 would only yield 32 total IPs (27 usable), which is insufficient.

Answer

/27

Answer

/25

Answer

/28

Question 14

A subnet has these inbound NSG rules: Rule 100 denies TCP 3389 from Internet, Rule 200 allows TCP 3389 from 10.0.0.0/8, and Rule 300 allows TCP 3389 from AzureLoadBalancer. An administrator in 10.20.5.4 cannot RDP to a VM in the subnet. Why is the connection denied?

Accepted Answer

The deny rule at priority 100 matches before the allow rule at priority 200.. Network Security Group (NSG) rules are evaluated in priority order, from lowest number to highest. Rule 100 at priority 100 denies TCP port 3389 from the Internet source. The administrator's IP address 10.20.5.4 is not part of the VNet's address space (the VNet does not include 10.20.0.0/16), so it is considered Internet traffic. Therefore, Rule 100 matches and denies the traffic before Rule 200 (which allows from 10.0.0.0/8) can be evaluated.

Answer

The AzureLoadBalancer service tag blocks all other inbound traffic on that port.

Answer

The VM needs a public IP address for RDP to work from a private source.

Answer

NSG rules are processed by longest prefix match, so the /8 source loses to the /32 VM address.

Question 15

Based on the exhibit, which subnet prefix should you create for the workload subnet so it has enough usable IP addresses for all listed resources?

Accepted Answer

/26. The workload subnet must support 30 VMs, 5 internal load balancer frontend IPs, and 5 backend pool instances, totaling 40 IP addresses. A /26 subnet provides 64 total IPs, with 59 usable after Azure reserves 5 IPs (first, last, and 3 Azure internal), which is sufficient. Smaller prefixes like /27 (27 usable) or /28 (11 usable) lack capacity, while /25 (123 usable) is excessive and wastes IP space.

Answer

/27

Answer

/25

Answer

/28