AZ-104 Implement and Manage Virtual Networking Practice Test 3 — 15 Questions

Question 1

Your hub virtual network uses 10.40.0.0/16 and the corporate on-premises network uses 10.41.0.0/16. A new spoke VNet must be peered to the hub now and connected to on-premises later. It needs a workload subnet for about 180 hosts and a management subnet for about 50 hosts. Which address space is the best choice for the new spoke?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

10.42.0.0/23. (10.42.0.0/23) is correct because it provides 512 total IP addresses. When split into two /24 subnets, each /24 provides 251 usable IP addresses after Azure's 5 IP reservation, yielding 502 usable addresses total—sufficient for the 180-host workload subnet and 50-host management subnet—while avoiding overlap with both the hub VNet (10.40.0.0/16) and the on-premises network (10.41.0.0/16). The /23 prefix allows splitting into two /24 subnets (e.g., 10.42.0.0/24 for workload and 10.42.1.0/24 for management), meeting the host requirements without wasting address space.

Answer

10.40.128.0/17

Answer

10.41.64.0/18

Answer

10.42.0.0/24

Question 2

A VNet peering attempt between VNet-A and VNet-B fails because both VNets include 10.40.0.0/16. VNet-B hosts active workloads, so the team wants to readdress it without downtime. Which two actions should the administrator take? Select two.

Accepted Answer

Add a new non-overlapping address space to VNet-B.. To readdress VNet-B without downtime, first add a new non-overlapping address space to VNet-B. Then migrate all workloads and subnets to the new address space. Finally, remove the old overlapping address space. Azure VNet peering requires non-overlapping address spaces; the overlap is only resolved when the old 10.40.0.0/16 range is removed from VNet-B. Adding the new range alone does not enable peering while the overlapping range remains.

Answer

Enable gateway transit on both VNets to bypass the overlap check.

Answer

Create a private endpoint in VNet-A so the peering can use private connectivity.

Answer

Associate a route table with VNet-B to force Azure to accept the peering.

Question 3

A subnet already has a 0.0.0.0/0 route that sends traffic to a virtual appliance at 10.1.1.4. One server in that subnet must reach 172.16.1.0/24 directly through the Internet, while all other traffic should still use the appliance. Which two actions are required? Select two.

Accepted Answer

Add a more specific user-defined route for 172.16.1.0/24 with next hop type Internet.. A is correct. Add a user-defined route for 172.16.1.0/24 with next hop type Internet. Since the existing 0.0.0.0/0 route to the virtual appliance is already in a route table associated with the subnet, no association step is needed. Azure uses longest-prefix matching, so the /24 route takes precedence only for traffic to 172.16.1.0/24. No NSG rule is required because outbound Internet traffic is allowed by default.

Answer

Associate the route table with the subnet that contains the server.

Answer

Create an NSG rule that allows outbound Internet traffic.

Answer

Enable a service endpoint for the Internet destination.

Answer

Change the subnet address space to a smaller CIDR.

Question 4

A VM-based application must connect to Azure SQL Database over a private IP inside the VNet. The SQL server name must resolve to that private IP, and public network access must remain disabled. What should the administrator deploy?

Accepted Answer

A private endpoint for the SQL server and a private DNS zone linked to the VNet.. A private endpoint assigns the Azure SQL Database a private IP from the VNet, ensuring traffic stays within the Microsoft backbone. A private DNS zone linked to the VNet allows the SQL server name (e.g., server.database.windows.net) to resolve to that private IP, meeting the requirement for name resolution. To meet the scenario's requirement, public network access is disabled via the SQL server's firewall settings, but this is independent of private endpoint connectivity; private endpoints work whether or not public access is enabled.

Answer

A service endpoint for Microsoft.Sql on the subnet.

Answer

A user-defined route that points SQL traffic to the Internet.

Answer

An NSG rule that allows TCP 1433 from the subnet to Azure SQL.

Question 5

A Linux VM in a subnet must accept SSH only from the corporate admin subnet 10.8.4.0/24. The subnet NSG currently has an Allow-SSH rule for Any at priority 300 and a Deny-SSH rule for Any at priority 200. Administrators from 10.8.4.0/24 still cannot connect. What change should the administrator make?

Accepted Answer

Add an Allow-SSH rule for 10.8.4.0/24 with a priority lower than 200.. The subnet NSG has a Deny-SSH rule for Any at priority 200, which blocks all SSH traffic regardless of source. To allow SSH only from 10.8.4.0/24, an Allow-SSH rule for that specific subnet must be added with a priority lower (numerically smaller) than 200, such as 150, so it is evaluated before the deny rule. Since NSG rules are processed in ascending priority order (lowest number first), the allow rule at a lower number will match traffic from 10.8.4.0/24 and permit it, preventing the deny rule from being evaluated for that source. Option B correctly describes adding an allow rule with priority lower than 200.

Answer

Change the deny rule protocol from TCP to Any so the allow rule is evaluated first.

Answer

Move the existing Allow-SSH rule to priority 400 so it applies later.

Answer

Add a route table to the subnet so the SSH packets follow a different path.

Question 6

An administrator is deploying a site-to-site VPN gateway in an existing VNet. The GatewaySubnet already exists, but deployment validation fails because the gateway has no public-facing IP resource. Which configuration is required?

Accepted Answer

Attach a Standard SKU public IP address with static allocation to the VPN gateway.. A site-to-site VPN gateway in Azure requires a public IP address to establish connectivity with the on-premises VPN device. For VPN gateway SKUs except Basic, a Standard SKU public IP is required, and Standard SKU public IPs always use static allocation. Without a public IP resource, the gateway cannot be provisioned as it has no public endpoint for the VPN tunnel.

Answer

Attach a private IP address from the GatewaySubnet to the VPN gateway.

Answer

Place the gateway behind an internal load balancer in the GatewaySubnet.

Answer

Create a NAT gateway and associate it with the GatewaySubnet.

Question 7

An app must resolve a storage account name to the private IP address created by a private endpoint. Which two actions are required? Select two.

Accepted Answer

Create the private endpoint in the same virtual network as the app. A private endpoint must be created in the same virtual network as the app so that the app can reach the private IP address directly. In addition, the virtual network must be linked to the private DNS zone for the storage service (e.g., privatelink.blob.core.windows.net) so that the DNS name of the storage account resolves to the private IP address of the private endpoint. Without both actions, the app cannot resolve and connect to the storage account using its private IP.

Answer

Enable a service endpoint on the subnet

Answer

Add a public DNS record pointing to the storage account

Answer

Turn on blob versioning

Question 8

An administrator is preparing an Azure site-to-site VPN gateway deployment for an existing VNet. Which two prerequisites must be in place for the gateway to deploy successfully? Select two.

Accepted Answer

A dedicated GatewaySubnet must exist in the VNet.. A dedicated GatewaySubnet is a mandatory requirement for deploying any Azure VPN gateway. This subnet must be named 'GatewaySubnet' and must have a minimum address prefix of /29 (though /27 is recommended) to accommodate the gateway VMs and future scaling. Without this subnet, the gateway creation will fail as Azure uses it to host the gateway VMs and route traffic. Additionally, the VPN gateway requires a public IP address resource to be assigned to it. This public IP provides the internet-facing IP address used for the IPsec tunnel, and without it the gateway cannot be deployed. Both are mandatory prerequisites.

Answer

The VNet must already contain a private endpoint for on-premises connectivity.

Answer

A network security group must be attached to the GatewaySubnet.

Answer

The VNet must use a service endpoint for Microsoft.Network.

Question 9

Match each network design requirement or limitation on the left with the best Azure behavior or corrective action on the right.

Accepted Answer

High availability across regions: Use multiple regions with Traffic Manager. Ly matches high availability across regions with deploying to multiple Azure regions and using Traffic Manager, which provides geo-redundancy and failover. Option B correctly matches latency-sensitive applications with performance routing, which directs traffic to the closest endpoint to minimize latency. Option C correctly matches data residency requirements with Azure Policy, which can enforce region restrictions. Option D is incorrect because autoscale handles scaling based on demand, not high availability across regions. Option E is incorrect because deploying to multiple regions with Traffic Manager is for high availability, not for reducing latency.

Answer

High availability across regions: Use autoscale

Answer

Latency-sensitive apps: Use multiple regions with Traffic Manager

Question 10

A subnet has a route table with these user-defined routes: 172.16.0.0/16 -> Virtual appliance 10.1.1.4 and 172.16.1.0/24 -> Internet. A VM in the subnet sends traffic to 172.16.1.20. Which next hop is used?

Accepted Answer

Internet, because the most specific route prefix always wins.. Azure route selection uses the longest prefix match (most specific route) to determine the next hop. The route 172.16.1.0/24 is more specific than 172.16.0.0/16, so traffic to 172.16.1.20 uses the Internet next hop, not the virtual appliance. This is consistent with how Azure evaluates user-defined routes (UDRs) and system routes.

Answer

Virtual appliance 10.1.1.4, because the broader route was added first.

Answer

Virtual network gateway, because all traffic to private IP addresses uses the gateway by default.

Answer

No next hop, because conflicting user-defined routes disable routing for that destination.

Question 11

Match each routing situation to the next-hop or route-selection behavior Azure will use.

Accepted Answer

Traffic to a peered VNet: Next hop type: Virtual network peering. Azure's valid next hop types include: Virtual network, Internet, Virtual appliance, Virtual network gateway, Virtual network peering, and None. Traffic to on-premises via a VPN gateway uses the next hop type 'Virtual network gateway', not 'VPN gateway'. Therefore, option B is incorrect. Route selection follows longest prefix match.

Answer

Traffic to a peered VNet: Next hop type: VPN gateway

Answer

Traffic to the internet: Next hop type: Virtual appliance

Question 12

Your company has two Azure virtual networks in the same region: VNetA (10.0.0.0/16) and VNetB (10.1.0.0/16). You need to enable communication between resources in VNetA and VNetB while ensuring that traffic is encrypted and passes over the Microsoft backbone network. Which three of the following must be configured? (Choose three.)

Accepted Answer

Configure virtual network peering between VNetA and VNetB.. Virtual network peering (B) enables direct connectivity over the Microsoft backbone, while a site-to-site VPN connection (A) provides encryption for the traffic. Verifying non-overlapping address spaces (D) is a prerequisite for both peering and VPN to avoid routing conflicts. The VNets are already in the same region, so that condition does not need to be configured. Gateway transit (C) and private endpoints (E) are not required for this scenario.

Answer

Enable 'Allow gateway transit' on both virtual networks.

Answer

Create a private endpoint for each resource that needs to communicate.

Answer

Establish a site-to-site VPN connection between the two virtual networks.

Question 13

You are designing a virtual networking solution for a critical application deployed across multiple Azure regions. You need to ensure secure, high-performance, and resilient connectivity between the virtual networks. Which four of the following options should you consider? (Choose four.)

Accepted Answer

Implement Azure Private Link to expose the application's backend service securely over the Microsoft backbone network.. For connecting virtual networks across regions, VNet peering with Gateway Transit allows transit routing through a shared VPN gateway, leveraging the Azure backbone for low-latency connectivity. Azure Virtual Network Manager enables dynamic management of connectivity and routing policies across multiple VNets. Azure VPN Gateway active-active mode is designed for high-availability site-to-site connections to on-premises, not VNet-to-VNet. Azure Private Link provides private access to PaaS services, not general VNet-to-VNet connectivity. ExpressRoute is for hybrid connectivity between on-premises and Azure; while Global Reach can connect VNets, it is not a standard method described in the option. A single VNet cannot span multiple regions due to regional boundaries.

Answer

Create a single VNet spanning multiple regions using a large contiguous address space to simplify routing.

Answer

Use Azure ExpressRoute with FastPath enabled to reduce latency and improve data throughput between the virtual networks.

Question 14

Order the steps to recover an Azure VM using Azure Backup.

Question 15

Which statement best explains why centralized logging is valuable in security operations?

Accepted Answer

It improves visibility by collecting events from multiple devices in one place for review and investigation.. Centralized logging aggregates security events (e.g., Windows Event Log, syslog, Azure Activity Log) from multiple sources into a single repository like Azure Log Analytics or a SIEM. This consolidation enables security analysts to correlate events across devices, detect patterns indicative of attacks, and perform efficient forensic investigations without needing to access each device individually.

Answer

It guarantees that no unauthorized action can occur.

Answer

It replaces the need for NTP and authentication.

Answer

It automatically assigns IP addresses to monitoring systems.