AZ-104 Implement and Manage Virtual Networking Practice Test 4 — 15 Questions

Question 1

A company has a hub virtual network named HubVNet with an Azure Firewall at 10.0.0.4 and a peered spoke virtual network named SpokeVNet. VMs in SpokeVNet must reach the internet through the firewall, and the firewall must inspect east-west traffic between spoke subnets. A route table named RT-Spoke is associated with all spoke subnets and contains a route for 0.0.0.0/0 with next hop type Virtual appliance and next hop 10.0.0.4. Users report that internet access from the spoke fails, and the firewall logs show no traffic. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a user-defined route in a route table associated with the Azure Firewall subnet that sends 0.0.0.0/0 and the spoke address space to next hop type Virtual appliance with next hop 10.0.0.4.. Azure Firewall requires a return route on its own subnet for traffic it inspects. Adding a user-defined route on the firewall subnet for 0.0.0.0/0 and the spoke address space with next hop Virtual appliance pointing to the firewall ensures return traffic reaches the firewall, resolving the dropped packets and restoring inspected connectivity.

Answer

Change the spoke route for 0.0.0.0/0 to use next hop type Internet instead of Virtual appliance.

Answer

Associate the route table RT-Spoke with the Azure Firewall subnet so the firewall inherits the spoke routes.

Answer

Enable Allow gateway transit on the hub-to-spoke peering and Use remote gateways on the spoke-to-hub peering.

Question 2

You administer an Azure virtual network named VNet1 with two subnets: AppSubnet and DataSubnet. A network security group named NSG1 is associated with AppSubnet and an NSG named NSG2 is associated with DataSubnet. You need to allow inbound TCP 1433 from AppSubnet to DataSubnet while denying all other inbound traffic to DataSubnet. Which two actions should you perform? (Choose two.)

Accepted Answer

Ensure NSG2 contains a deny rule for inbound traffic with a higher priority number than the allow rule for TCP 1433.. NSG security rules are evaluated at both source and destination, and the destination NSG must permit the flow. Creating an inbound allow rule for TCP 1433 from AppSubnet in NSG2 opens the destination, and ordering a broader deny rule at a higher priority number ensures only 1433 is permitted while all other inbound traffic is denied.

Answer

Create an outbound security rule in NSG1 that allows TCP 1433 to the DataSubnet address range.

Answer

Associate NSG1 with DataSubnet and NSG2 with AppSubnet so both subnets enforce both rule sets.

Answer

Create a service tag rule in NSG1 that allows inbound TCP 1433 from the VirtualNetwork service tag.

Question 3

Which statement best explains why centralized logging is valuable in security operations?

Accepted Answer

It improves visibility by collecting events from multiple devices in one place for review and investigation.. Centralized logging aggregates security events (e.g., Windows Event Log, syslog, Azure Activity Log) from multiple sources into a single repository like Azure Log Analytics or a SIEM. This consolidation enables security analysts to correlate events across devices, detect patterns indicative of attacks, and perform efficient forensic investigations without needing to access each device individually.

Answer

It guarantees that no unauthorized action can occur.

Answer

It replaces the need for NTP and authentication.

Answer

It automatically assigns IP addresses to monitoring systems.

Question 4

Why is centralized logging especially helpful during incident investigation?

Accepted Answer

It helps investigators analyze related events from multiple devices in one place.. Centralized logging aggregates logs from multiple sources (servers, firewalls, applications) into a single repository, enabling investigators to correlate events across devices during an incident. This eliminates the need to manually access each device's local logs, speeding up root cause analysis and providing a unified timeline of activities.

Answer

It guarantees that no attack can ever succeed.

Answer

It replaces the need for access control.

Answer

It forces all devices to use the same VLAN.

Question 5

Why is centralized logging especially useful during security investigations?

Accepted Answer

It makes related events from multiple devices easier to review and correlate.. Centralized logging aggregates logs from multiple sources (e.g., firewalls, servers, Azure Network Watcher) into a single repository, such as Azure Log Analytics. During security investigations, this enables security analysts to correlate events across devices (e.g., matching a suspicious IP address in firewall logs with authentication failures in domain controller logs) without manually connecting to each device. This correlation is critical for reconstructing attack timelines and identifying lateral movement, which is impossible with siloed logs.

Answer

It guarantees that attacks cannot succeed.

Answer

It replaces the need for authentication and authorization.

Answer

It forces all devices to use the same VLAN.

Question 6

Why is centralized logging valuable during security incident response?

Accepted Answer

It makes related events from many devices easier to collect and correlate.. Centralized logging aggregates logs from multiple sources (e.g., Azure VMs, network security groups, Azure Firewall) into a single repository like Azure Log Analytics or Azure Sentinel. This correlation enables security analysts to identify patterns across devices, such as a chain of events from an initial breach to lateral movement, which is critical for incident response. Without centralization, manually correlating timestamps and log formats from disparate systems would be impractical during an active attack.

Answer

It guarantees that attacks cannot succeed.

Answer

It replaces access control mechanisms.

Answer

It forces all systems to use one VLAN.

Question 7

An operations team wants device-generated log messages collected centrally so engineers can review interface changes, warnings, and errors from one place. Which technology is most directly associated with that goal?

Accepted Answer

Syslog. Syslog (A) is the standard protocol for collecting and centralizing log messages from network devices, servers, and other infrastructure. It allows engineers to forward interface changes, warnings, and errors to a central syslog server, enabling unified review and alerting. This directly matches the goal of centralized device-generated log collection.

Answer

NetFlow

Answer

DHCP relay

Answer

Port security

Question 8

Which two statements accurately describe the value of centralized DHCP in enterprise networks?

Accepted Answer

It can reduce the need to maintain separate DHCP servers in every subnet or site.. Option A is correct because a centralized DHCP deployment lets one or a few DHCP servers provide leases to many subnets or sites, so you no longer need to deploy and maintain a separate DHCP server in every subnet or site. Option B is correct because centralizing DHCP consolidates scopes, options, and reservations in one administrative location, making address-policy changes such as modifying lease durations, DNS servers, or exclusions easier to apply consistently. Options C, D, and E are incorrect: DHCP relay agents (or IP helpers) are still required for clients to reach a DHCP server across Layer 3 boundaries, clients still need default gateways for off-subnet traffic, and centralized DHCP is used on wired as well as wireless networks.

Answer

It removes the need for relay across Layer 3 boundaries.

Answer

It eliminates the need for default gateways.

Answer

It is useful only on wireless networks.

Question 9

A network team centralizes DHCP in a data center. Users in a remote branch stop receiving addresses after the branch router is replaced. Which missing configuration on the branch gateway is the strongest suspect?

Accepted Answer

DHCP relay or helper configuration on the client-facing gateway interface. When a DHCP server is centralized in a data center, remote clients rely on the branch gateway to forward their broadcast DHCP requests as unicast to the server. This is achieved by configuring a DHCP relay agent (ip helper-address) on the client-facing interface of the branch router. Without this configuration, DHCP broadcasts are dropped at the router, and clients never receive IP addresses.

Answer

A spanning-tree priority change on the branch switch

Answer

A CAPWAP tunnel from the branch PCs to the data center

Answer

A voice VLAN configuration on the WAN interface

Question 10

A network engineer wants device logs from routers and switches sent to a central server for long-term retention and analysis. Which service should be configured?

Accepted Answer

Syslog. Syslog is the standard protocol for sending device logs (e.g., from routers and switches) to a central server for long-term retention and analysis. It operates over UDP port 514 (or TCP 6514 for reliable delivery) and allows network devices to forward event messages to a syslog collector, which can store, filter, and analyze them. This directly meets the requirement for centralized logging and analysis.

Answer

NTP

Answer

DNS

Answer

NetFlow

Question 11

You deploy a private endpoint for an Azure Storage account. Virtual machines in VNet-App must resolve the storage account name to the private IP address of the endpoint instead of the public endpoint. What should you configure?

Accepted Answer

A private DNS zone linked to VNet-App.. A private endpoint requires DNS resolution to map the storage account's fully qualified domain name (FQDN) to its private IP address. By creating a private DNS zone (privatelink.blob.core.windows.net) and linking it to VNet-App, Azure automatically creates an A-record pointing to the private endpoint's IP, ensuring VMs resolve the storage account name privately instead of via the public endpoint.

Answer

A network security group on the subnet.

Answer

A public DNS zone for the storage account name.

Answer

A user-defined route table on the subnet.

Question 12

VM-Web01 is connected to Subnet-Web in VNet-Prod. Users on the internet cannot access the website hosted on TCP port 443. You confirm that VM-Web01 has a public IP address and the web service is running. You need to allow inbound HTTPS traffic with the least administrative effort. What should you do?

Accepted Answer

Add an inbound NSG rule allowing TCP 443.. The VM has a public IP and the web service is running, but internet users cannot access it. The most common reason is that the Network Security Group (NSG) associated with the subnet or NIC is blocking inbound traffic. Adding an inbound NSG rule to allow TCP 443 is the least administrative effort to permit HTTPS traffic from the internet.

Answer

Create a user-defined route to the internet.

Answer

Configure VNet peering with another virtual network.

Answer

Create a private endpoint for VM-Web01.

Question 13

A subnet contains several application servers. You need to allow inbound TCP 3389 only from a management subnet named Subnet-Mgmt and deny RDP from all other sources. What should you do?

Accepted Answer

Create an NSG rule allowing TCP 3389 from the Subnet-Mgmt address range and rely on the default deny afterward.. Network Security Groups (NSGs) in Azure filter traffic based on rules that are evaluated in priority order. By creating an inbound rule that allows TCP 3389 (RDP) from the Subnet-Mgmt address range, and relying on the default implicit deny rule that blocks all other inbound traffic, you effectively restrict RDP access to only the management subnet. No additional configuration is needed to deny traffic from other sources, as the default deny handles that automatically.

Answer

Create a route table that sends RDP traffic to the management subnet.

Answer

Deploy a private endpoint for each application server.

Answer

Enable service endpoints on the application subnet.

Question 14

Two virtual machines named VM-Web01 and VM-Web02 host the same public web application. Users on the internet must connect through a single public IP address, and incoming requests should be distributed across both VMs. What should you deploy?

Accepted Answer

A public load balancer. A public load balancer (Azure Load Balancer with a public frontend IP) is required because it provides a single public IP address for internet clients and distributes incoming traffic across the backend VMs (VM-Web01 and VM-Web02) using a configured load-balancing rule. This ensures high availability and scalability for the web application.

Answer

An internal load balancer

Answer

A private DNS zone

Answer

A Recovery Services vault

Question 15

Your company deploys a network virtual appliance (NVA) in a hub subnet. All outbound internet traffic from Subnet-App in a spoke VNet must pass through the NVA for inspection. What should you configure on Subnet-App?

Accepted Answer

A user-defined route with a next hop of Virtual Appliance. A user-defined route (UDR) with a next hop of Virtual Appliance forces all outbound traffic from Subnet-App to be forwarded to the NVA for inspection. This overrides Azure's default system route for 0.0.0.0/0, which normally sends internet-bound traffic directly to the internet. By specifying the NVA's private IP as the next hop, you ensure traffic is routed through the hub subnet for inspection before leaving the network.

Answer

A private DNS zone

Answer

A service endpoint for Microsoft.Storage

Answer

A NAT gateway on the NVA subnet only