AZ-104 Implement and Manage Virtual Networking Practice Test 4 — 15 Questions

Question 1

A Windows VM in VNet-App must access an Azure Files share over a private IP address. The storage account must not be reachable through its public endpoint, and the VM should resolve the file share name without custom host-file entries. Which three actions are required? Select three.

Accepted Answer

Create a private endpoint for the file service in VNet-App.. Option A is correct because a private endpoint assigns a private IP address from VNet-App to the Azure Files service, enabling the VM to access the file share over a private IP without traversing the public internet. This is required to meet the requirement that the storage account must not be reachable through its public endpoint.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet instead of a private endpoint.

Answer

Grant the VM's managed identity the Storage File Data SMB Share Reader role to create the private path.

Question 2

Two virtual networks were created in different subscriptions. VNet-A uses 10.4.0.0/16 and VNet-B uses 10.4.128.0/17. You try to create peering between them, but Azure rejects the request. What is the best fix?

Accepted Answer

Change one VNet to a non-overlapping address range, then create the peering again.. VNet peering requires that the address spaces of the two virtual networks do not overlap. VNet-A uses 10.4.0.0/16, which covers 10.4.0.0 to 10.4.255.255, and VNet-B uses 10.4.128.0/17, which falls entirely within that range (10.4.128.0 to 10.4.255.255). Azure rejects the peering because overlapping address spaces would cause routing conflicts. The only correct fix is to change one VNet's address space to a non-overlapping range, then recreate the peering.

Answer

Enable gateway transit on both VNets before creating the peering.

Answer

Add a route table to one VNet so the address spaces no longer overlap.

Answer

Create a private endpoint between the two VNets instead of peering.

Question 3

A route table contains these entries: 10.0.0.0/8 with next hop Virtual appliance, and 10.1.1.0/24 with next hop Virtual network gateway. Which next hop will Azure use for traffic to 10.1.1.5?

Accepted Answer

Virtual network gateway, because the /24 route is more specific than the /8 route.. Azure uses the most specific route prefix (longest prefix match) to determine the next hop for traffic. For destination 10.1.1.5, the route 10.1.1.0/24 (prefix length 24) is more specific than 10.0.0.0/8 (prefix length 8), so the next hop Virtual network gateway is selected, regardless of the order in which routes were created.

Answer

Virtual appliance, because the broader 10.0.0.0/8 route was created first.

Answer

Internet, because Azure always prefers the default system route for public addresses.

Answer

None, because Azure ignores overlapping route entries in the same table.

Question 4

A hub VNet already has a VPN gateway connected to on-premises. A spoke VNet in the same region must reach on-premises networks through that existing gateway, and you do not want to deploy a separate VPN gateway in the spoke. What peering settings should you use?

Accepted Answer

Enable Allow gateway transit on the hub peering and Use remote gateways on the spoke peering.. Option C is correct because to enable a spoke VNet to use a hub VNet's VPN gateway for on-premises connectivity without deploying a separate gateway, you must configure the hub peering with 'Allow gateway transit' and the spoke peering with 'Use remote gateways'. This allows the spoke to route traffic through the hub's VPN gateway, leveraging the existing site-to-site VPN connection to on-premises.

Answer

Create peering only; the spoke will automatically use the hub gateway without extra settings.

Answer

Enable Use remote gateways on the hub peering and Allow gateway transit on the spoke peering.

Answer

Create a service endpoint from the spoke VNet to the on-premises network.

Question 5

Two virtual networks are in different subscriptions. VNet-A uses 10.20.0.0/16 and VNet-B uses 10.20.128.0/17. A design review also states that traffic between two spoke VNets should flow through a hub VNet instead of directly between spokes. Which two statements are correct? Select two.

Accepted Answer

The two VNets cannot be peered until one address space is changed because the ranges overlap.. Option A is correct because VNet peering in Azure requires that the address spaces of the peered VNets do not overlap. VNet-A uses 10.20.0.0/16 and VNet-B uses 10.20.128.0/17, which are overlapping ranges (10.20.128.0/17 is a subset of 10.20.0.0/16). Azure will reject the peering request until one of the address spaces is changed to eliminate the overlap.

Answer

VNet peering is transitive, so spoke-to-spoke traffic will automatically use the hub peering.

Answer

Overlapping CIDR blocks are allowed if the VNets are placed in separate resource groups.

Answer

If the hub has a VPN gateway, spoke traffic to other spokes is routed automatically without additional configuration.

Question 6

A company wants encrypted connectivity between its on-premises network and an Azure VNet. The organization has one edge VPN device at headquarters, and the Azure design must support a classic site-to-site tunnel rather than individual user VPN connections. Which three prerequisites are required? Select three.

Accepted Answer

Deploy a virtual network gateway in a dedicated GatewaySubnet.. A virtual network gateway must be deployed in a dedicated subnet called GatewaySubnet to host the VPN gateway resources. This subnet is required for the gateway to function and must be named exactly 'GatewaySubnet' to be recognized by Azure when creating a site-to-site VPN connection.

Answer

Create a private endpoint for the headquarters network.

Answer

Enable Microsoft peering on the virtual network gateway.

Question 7

An internal line-of-business application runs on two VMs in Azure. Users connect only from a peered virtual network and from on-premises through VPN. The application must not be reachable from the internet, but traffic should be balanced across the two VMs. Which configuration should you choose?

Accepted Answer

A Standard Load Balancer with a private frontend IP.. A Standard Load Balancer with a private frontend IP is correct because it distributes traffic to the two VMs using a private IP address that is only reachable from within the peered virtual network and the on-premises network via VPN. This configuration ensures the application is not exposed to the internet while still providing load balancing across the VMs.

Answer

A public Standard Load Balancer with a public frontend IP.

Answer

A NAT gateway attached to the application subnet.

Answer

A network security group rule allowing TCP 443 from the internet.

Question 8

A VM in VNet-Prod must connect to Azure SQL Database over a private IP address. The SQL server must not be reachable through its public endpoint, and the VM should resolve the server name automatically without manual DNS entries. Which three actions are required? Select three.

Accepted Answer

Create a private endpoint for the Azure SQL server in VNet-Prod.. Option A is correct because a private endpoint assigns a private IP address from VNet-Prod to the Azure SQL server, enabling connectivity over a private IP while blocking the public endpoint. This ensures the SQL server is not reachable through its public endpoint, meeting the requirement for private connectivity.

Answer

Enable a service endpoint for Microsoft.Sql on the subnet instead of using a private endpoint.

Answer

Leave public network access enabled and add the VNet as an allowed firewall rule.

Question 9

An application VM in a subnet without a public IP must access Azure Blob Storage. The storage account must not be reachable from the public internet, and DNS resolution should stay inside the virtual network. What should you implement?

Accepted Answer

Create a private endpoint for the storage account and link the appropriate private DNS zone.. Option B is correct because a private endpoint assigns the storage account a private IP from the VM's virtual network, making it reachable without public internet exposure. Linking the private DNS zone ensures that DNS resolution for the storage account (e.g., `mystorageaccount.blob.core.windows.net`) resolves to the private IP within the VNet, meeting both requirements.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet and keep the public endpoint enabled.

Answer

Use a SAS token and allow access from any network for the storage account.

Answer

Assign a managed identity to the VM and remove all network restrictions from the storage account.

Question 10

You removed public IP addresses from a backend subnet containing 20 VMs. The VMs still need outbound internet access for updates, and the organization wants all outbound traffic to appear from one predictable public IP. No inbound publishing is required. Which Azure service should you use?

Accepted Answer

Azure NAT Gateway associated with the subnet.. Azure NAT Gateway is the correct choice because it provides outbound-only internet connectivity for a subnet, translating all VM traffic to a single public IP address without requiring inbound NAT rules or a load balancer. It supports SNAT (Source Network Address Translation) for up to 64,000 concurrent flows per IP, meeting the requirement for predictable outbound IP and no inbound publishing.

Answer

A public load balancer with inbound NAT rules for each VM.

Answer

A private load balancer with a backend pool of the VMs.

Answer

A VPN gateway connection to a remote network.

Question 11

A subnet contains 15 backend VMs that only need outbound internet access for patching and package downloads. Security wants all outbound connections to use one static public IP address, and no VM should have a public IP assigned directly. What should you configure?

Accepted Answer

A NAT gateway associated with the subnet.. A NAT gateway is the correct choice because it provides outbound internet connectivity for all VMs in a subnet using a single static public IP address, without assigning public IPs to the VMs themselves. It handles source network address translation (SNAT) for outbound traffic, ensuring that all connections appear to originate from the configured public IP. This meets the security requirement of a single static IP for patching and package downloads.

Answer

A public Standard Load Balancer with outbound rules for the backend pool.

Answer

A public IP address on each virtual machine so all outbound traffic is traceable.

Answer

An internal load balancer with a private frontend IP.

Question 12

Based on the exhibit, which change should you make so the VM reaches the blob service over a private IP address?

Accepted Answer

Create a private endpoint for the storage account and link the appropriate private DNS zone.. Option B is correct because a private endpoint assigns the storage account a private IP address from the VM's virtual network, enabling direct connectivity over a private IP. Linking the private endpoint to a private DNS zone ensures that the storage account's FQDN resolves to the private IP instead of the public endpoint, meeting the requirement without exposing traffic to the internet.

Answer

Enable a service endpoint on the subnet and keep the current DNS configuration.

Answer

Assign the VM a public IP address and allow it through the storage firewall.

Answer

Add the VM to a network security group that allows outbound TCP 443 to Azure Storage.

Question 13

A VM in Azure cannot accept RDP connections from your office public IP. The subnet NSG already has an inbound deny-all rule at priority 200, and you added an allow rule for TCP 3389 from 198.51.100.25/32 at priority 300. What should you do to allow the connection?

Accepted Answer

Create or move the allow rule to priority 100 so it is evaluated before the deny rule.. Network Security Group (NSG) rules are evaluated in priority order, with lower numbers having higher precedence. Since the deny-all rule at priority 200 is evaluated before the allow rule at priority 300, the deny rule blocks the RDP traffic. To allow the connection, the allow rule must be created or moved to a priority lower than 200 (e.g., 100) so it is evaluated first, permitting traffic from 198.51.100.25/32 on TCP 3389 before the deny rule is reached.

Answer

Change the source to Internet so the allow rule matches more traffic.

Answer

Change the protocol from TCP to Any to bypass the deny rule.

Answer

Assign a public IP directly to the VM to override the subnet NSG behavior.

Question 14

A VM in a subnet must access an Azure Storage account without creating a private endpoint. The organization is fine with the storage account remaining on its public endpoint, but traffic should stay on the Azure backbone rather than the public internet. Which feature should you use?

Accepted Answer

A service endpoint for Microsoft.Storage on the subnet.. A service endpoint for Microsoft.Storage on the subnet extends the virtual network identity to the storage account, allowing traffic from the subnet to the storage account's public endpoint to traverse the Azure backbone network instead of the public internet. This meets the requirement of keeping traffic on the Azure backbone without creating a private endpoint, as service endpoints use the public endpoint but route traffic through Microsoft's network.

Answer

A private endpoint and a private DNS zone.

Answer

A NAT gateway attached to the subnet.

Answer

A VPN gateway connection to the storage account resource group.

Question 15

A VM in a virtual network must access an Azure Storage account over a private IP address, and the storage account's public endpoint must be disabled. Name resolution from the VM should resolve the storage name to the private IP. Which configuration should you use?

Accepted Answer

Private endpoint with a private DNS zone linked to the virtual network.. Option B is correct because a private endpoint assigns a private IP from the virtual network to the storage account, effectively bringing the service into the VNet. By linking a private DNS zone to the virtual network, the VM's DNS resolution for the storage account name returns the private IP instead of the public endpoint, satisfying both the private connectivity and public endpoint disablement requirements.

Answer

Service endpoint on the subnet plus public DNS, because the storage account will expose a private IP automatically.

Answer

Network security group rules only, because they can force traffic to use private addressing.

Answer

Storage account firewall rules with Allow trusted Microsoft services, because that gives a private address path.