AZ-104 Implement and Manage Virtual Networking Practice Test 3 — 15 Questions

Question 1

Based on the exhibit, which subnet prefix should you create for the workload subnet so it has enough usable IP addresses for all listed resources?

Accepted Answer

/26. The workload subnet must support 30 VMs, 5 internal load balancer frontend IPs, and 5 backend pool instances, totaling 40 IP addresses. A /26 subnet provides 64 total IPs, with 59 usable after Azure reserves 5 IPs (first, last, and 3 Azure internal), which is sufficient. Smaller prefixes like /27 (27 usable) or /28 (11 usable) lack capacity, while /25 (123 usable) is excessive and wastes IP space.

Answer

/27

Answer

/25

Answer

/28

Question 2

Your hub virtual network uses 10.40.0.0/16 and the corporate on-premises network uses 10.41.0.0/16. A new spoke VNet must be peered to the hub now and connected to on-premises later. It needs a workload subnet for about 180 hosts and a management subnet for about 50 hosts. Which address space is the best choice for the new spoke?

Accepted Answer

10.42.0.0/23. (10.42.0.0/23) is correct because it provides 512 total IP addresses. When split into two /24 subnets, each /24 provides 251 usable IP addresses after Azure's 5 IP reservation, yielding 502 usable addresses total—sufficient for the 180-host workload subnet and 50-host management subnet—while avoiding overlap with both the hub VNet (10.40.0.0/16) and the on-premises network (10.41.0.0/16). The /23 prefix allows splitting into two /24 subnets (e.g., 10.42.0.0/24 for workload and 10.42.1.0/24 for management), meeting the host requirements without wasting address space.

Answer

10.40.128.0/17

Answer

10.41.64.0/18

Answer

10.42.0.0/24

Question 3

A VNet peering attempt between VNet-A and VNet-B fails because both VNets include 10.40.0.0/16. VNet-B hosts active workloads, so the team wants to readdress it without downtime. Which two actions should the administrator take? Select two.

Accepted Answer

Add a new non-overlapping address space to VNet-B.. To readdress VNet-B without downtime, first add a new non-overlapping address space to VNet-B. Then migrate all workloads and subnets to the new address space. Finally, remove the old overlapping address space. Azure VNet peering requires non-overlapping address spaces; the overlap is only resolved when the old 10.40.0.0/16 range is removed from VNet-B. Adding the new range alone does not enable peering while the overlapping range remains.

Answer

Enable gateway transit on both VNets to bypass the overlap check.

Answer

Create a private endpoint in VNet-A so the peering can use private connectivity.

Answer

Associate a route table with VNet-B to force Azure to accept the peering.

Question 4

A subnet already has a 0.0.0.0/0 route that sends traffic to a virtual appliance at 10.1.1.4. One server in that subnet must reach 172.16.1.0/24 directly through the Internet, while all other traffic should still use the appliance. Which two actions are required? Select two.

Accepted Answer

Add a more specific user-defined route for 172.16.1.0/24 with next hop type Internet.. A is correct. Add a user-defined route for 172.16.1.0/24 with next hop type Internet. Since the existing 0.0.0.0/0 route to the virtual appliance is already in a route table associated with the subnet, no association step is needed. Azure uses longest-prefix matching, so the /24 route takes precedence only for traffic to 172.16.1.0/24. No NSG rule is required because outbound Internet traffic is allowed by default.

Answer

Associate the route table with the subnet that contains the server.

Answer

Create an NSG rule that allows outbound Internet traffic.

Answer

Enable a service endpoint for the Internet destination.

Answer

Change the subnet address space to a smaller CIDR.

Question 5

A VM-based application must connect to Azure SQL Database over a private IP inside the VNet. The SQL server name must resolve to that private IP, and public network access must remain disabled. What should the administrator deploy?

Accepted Answer

A private endpoint for the SQL server and a private DNS zone linked to the VNet.. A private endpoint assigns the Azure SQL Database a private IP from the VNet, ensuring traffic stays within the Microsoft backbone. A private DNS zone linked to the VNet allows the SQL server name (e.g., server.database.windows.net) to resolve to that private IP, meeting the requirement for name resolution. To meet the scenario's requirement, public network access is disabled via the SQL server's firewall settings, but this is independent of private endpoint connectivity; private endpoints work whether or not public access is enabled.

Answer

A service endpoint for Microsoft.Sql on the subnet.

Answer

A user-defined route that points SQL traffic to the Internet.

Answer

An NSG rule that allows TCP 1433 from the subnet to Azure SQL.

Question 6

An administrator is deploying a site-to-site VPN gateway in an existing VNet. The GatewaySubnet already exists, but deployment validation fails because the gateway has no public-facing IP resource. Which configuration is required?

Accepted Answer

Attach a Standard SKU public IP address with static allocation to the VPN gateway.. A site-to-site VPN gateway in Azure requires a public IP address to establish connectivity with the on-premises VPN device. For VPN gateway SKUs except Basic, a Standard SKU public IP is required, and Standard SKU public IPs always use static allocation. Without a public IP resource, the gateway cannot be provisioned as it has no public endpoint for the VPN tunnel.

Answer

Attach a private IP address from the GatewaySubnet to the VPN gateway.

Answer

Place the gateway behind an internal load balancer in the GatewaySubnet.

Answer

Create a NAT gateway and associate it with the GatewaySubnet.

Question 7

An app must resolve a storage account name to the private IP address created by a private endpoint. Which two actions are required? Select two.

Accepted Answer

Create the private endpoint in the same virtual network as the app. A private endpoint must be created in the same virtual network as the app so that the app can reach the private IP address directly. In addition, the virtual network must be linked to the private DNS zone for the storage service (e.g., privatelink.blob.core.windows.net) so that the DNS name of the storage account resolves to the private IP address of the private endpoint. Without both actions, the app cannot resolve and connect to the storage account using its private IP.

Answer

Enable a service endpoint on the subnet

Answer

Add a public DNS record pointing to the storage account

Answer

Turn on blob versioning

Question 8

An administrator is preparing an Azure site-to-site VPN gateway deployment for an existing VNet. Which two prerequisites must be in place for the gateway to deploy successfully? Select two.

Accepted Answer

A dedicated GatewaySubnet must exist in the VNet.. A dedicated GatewaySubnet is a mandatory requirement for deploying any Azure VPN gateway. This subnet must be named 'GatewaySubnet' and must have a minimum address prefix of /29 (though /27 is recommended) to accommodate the gateway VMs and future scaling. Without this subnet, the gateway creation will fail as Azure uses it to host the gateway VMs and route traffic. Additionally, the VPN gateway requires a public IP address resource to be assigned to it. This public IP provides the internet-facing IP address used for the IPsec tunnel, and without it the gateway cannot be deployed. Both are mandatory prerequisites.

Answer

The VNet must already contain a private endpoint for on-premises connectivity.

Answer

A network security group must be attached to the GatewaySubnet.

Answer

The VNet must use a service endpoint for Microsoft.Network.

Question 9

An app running on an Azure VM must access Azure SQL Database over a private IP inside the VNet. The team also wants the SQL server name to resolve to that private address without using custom host-file entries. What should be configured?

Accepted Answer

A private endpoint for Azure SQL Database and a linked private DNS zone.. A private endpoint assigns Azure SQL Database a private IP address from the VM's VNet, enabling traffic to stay within Microsoft's backbone. Linking a private DNS zone automatically resolves the SQL server's FQDN (e.g., server.database.windows.net) to that private IP, eliminating the need for custom host-file entries. This meets both requirements: private IP connectivity and DNS resolution without manual configuration.

Answer

A service endpoint on the VM subnet and a firewall rule on Azure SQL Database.

Answer

A public IP address on the VM and a SQL server firewall exception.

Answer

An NSG rule that allows outbound TCP 1433 to the SQL server.

Question 10

An application subnet has an NSG outbound rule Deny-HTTPS at priority 200 for TCP 443 to Any. A second outbound rule Allow-HTTPS-API at priority 300 permits TCP 443 from ASG-Web to ASG-Api. Web servers can reach other ports but not the API. What change should the administrator make?

Accepted Answer

Change the allow rule to a higher priority than 200, such as 100.. NSG rules are evaluated in priority order, with lower numbers having higher precedence. The Deny-HTTPS rule at priority 200 blocks all outbound TCP 443 traffic, including traffic from ASG-Web to ASG-Api. To allow the specific traffic, the Allow-HTTPS-API rule must have a lower priority number (e.g., 100) so it is evaluated before the deny rule, permitting the desired traffic while the deny rule still blocks other outbound HTTPS traffic.

Answer

Delete the deny rule so the allow rule can be evaluated.

Answer

Change the destination from ASG-Api to the entire subnet address range.

Answer

Change the protocol from TCP to Any so the rule matches more traffic.

Question 11

A subnet has a route table with these user-defined routes: 172.16.0.0/16 -> Virtual appliance 10.1.1.4 and 172.16.1.0/24 -> Internet. A VM in the subnet sends traffic to 172.16.1.20. Which next hop is used?

Accepted Answer

Internet, because the most specific route prefix always wins.. Azure route selection uses the longest prefix match (most specific route) to determine the next hop. The route 172.16.1.0/24 is more specific than 172.16.0.0/16, so traffic to 172.16.1.20 uses the Internet next hop, not the virtual appliance. This is consistent with how Azure evaluates user-defined routes (UDRs) and system routes.

Answer

Virtual appliance 10.1.1.4, because the broader route was added first.

Answer

Virtual network gateway, because all traffic to private IP addresses uses the gateway by default.

Answer

No next hop, because conflicting user-defined routes disable routing for that destination.

Question 12

Match each routing situation to the next-hop or route-selection behavior Azure will use.

Accepted Answer

Traffic to a peered VNet: Next hop type: Virtual network peering. Azure's valid next hop types include: Virtual network, Internet, Virtual appliance, Virtual network gateway, Virtual network peering, and None. Traffic to on-premises via a VPN gateway uses the next hop type 'Virtual network gateway', not 'VPN gateway'. Therefore, option B is incorrect. Route selection follows longest prefix match.

Answer

Traffic to a peered VNet: Next hop type: VPN gateway

Answer

Traffic to the internet: Next hop type: Virtual appliance

Question 13

Your company has two Azure virtual networks in the same region: VNetA (10.0.0.0/16) and VNetB (10.1.0.0/16). You need to enable communication between resources in VNetA and VNetB while ensuring that traffic is encrypted and passes over the Microsoft backbone network. Which three of the following must be configured? (Choose three.)

Accepted Answer

Ensure that the virtual networks are in the same Azure region.. Virtual network peering (B) enables direct connectivity over the Microsoft backbone, while a site-to-site VPN connection (A) provides encryption for the traffic. Verifying non-overlapping address spaces (D) is a prerequisite for both peering and VPN to avoid routing conflicts. The VNets are already in the same region, so that condition does not need to be configured. Gateway transit (C) and private endpoints (E) are not required for this scenario.

Answer

Create a private endpoint for each resource that needs to communicate.

Answer

Enable 'Allow gateway transit' on both virtual networks.

Answer

Establish a site-to-site VPN connection between the two virtual networks.

Question 14

You are designing a virtual networking solution for a critical application deployed across multiple Azure regions. You need to ensure secure, high-performance, and resilient connectivity between the virtual networks. Which four of the following options should you consider? (Choose four.)

Accepted Answer

Deploy Azure Virtual Network Manager to dynamically manage and enforce connectivity rules across multiple virtual networks.. For connecting virtual networks across regions, VNet peering with Gateway Transit allows transit routing through a shared VPN gateway, leveraging the Azure backbone for low-latency connectivity. Azure Virtual Network Manager enables dynamic management of connectivity and routing policies across multiple VNets. Azure VPN Gateway active-active mode is designed for high-availability site-to-site connections to on-premises, not VNet-to-VNet. Azure Private Link provides private access to PaaS services, not general VNet-to-VNet connectivity. ExpressRoute is for hybrid connectivity between on-premises and Azure; while Global Reach can connect VNets, it is not a standard method described in the option. A single VNet cannot span multiple regions due to regional boundaries.

Answer

Use Azure ExpressRoute with FastPath enabled to reduce latency and improve data throughput between the virtual networks.

Answer

Create a single VNet spanning multiple regions using a large contiguous address space to simplify routing.

Question 15

You manage an Azure virtual network named VNet1 with a subnet named WebSubnet that hosts 40 Linux VMs behind an internal Standard SKU Azure Load Balancer named LB1. The VMs must initiate outbound connections to the internet, but Microsoft requires that outbound connectivity use a predictable, dedicated public IP address that survives VM scale set reimaging. You must minimize administrative effort and cost. What should you configure?

Accepted Answer

Create a NAT gateway, associate it with WebSubnet, and attach a public IP prefix or public IP to the gateway.. A NAT gateway associated with the subnet provides outbound SNAT using dedicated public IP addresses, giving predictable egress for all VMs without per-VM public IPs. It is the recommended, lowest-effort outbound method for a subnet and the public address persists independently of VM lifecycle events such as reimaging.

Answer

Add an outbound rule to the internal Standard SKU load balancer with a frontend public IP address.

Answer

Assign a public IP address to each VM's network interface in WebSubnet.

Answer

Configure a user-defined route that sends 0.0.0.0/0 to an Azure Firewall in a peered hub virtual network.