AZ-104 Implement and Manage Virtual Networking Practice Test 5 — 15 Questions

Question 1

A backend subnet contains 18 Linux VMs that must install updates from the internet. Security requires all outbound traffic to use one static public IP, and none of the VMs may have their own public IP addresses. Which two changes meet the requirement? Select two.

Accepted Answer

Associate a NAT gateway with the backend subnet and provide it with a public IP address or prefix.. A NAT gateway provides outbound internet connectivity for VMs in a subnet while using a single static public IP address. By associating a NAT gateway with the backend subnet and assigning it a public IP, all outbound traffic from the 18 Linux VMs will source NAT to that static IP, meeting the security requirement without assigning public IPs to individual VMs.

Answer

Create a public load balancer and add the VMs to its backend pool.

Answer

Use a private endpoint for internet updates so outbound traffic remains private.

Answer

Attach a route table with 0.0.0.0/0 to Virtual network gateway.

Question 2

A contractor working from home needs temporary access to internal Azure resources. There is no on-premises network to connect, and you do not want to expose the resources publicly. Which connectivity option should you deploy?

Accepted Answer

Point-to-site VPN, because it connects an individual client to the virtual network.. A Point-to-Site (P2S) VPN is the correct choice because it allows an individual client computer to establish a secure, encrypted connection to an Azure virtual network over the public internet using SSTP, IKEv2, or OpenVPN protocols. This meets the requirement of temporary remote access without exposing resources publicly, as the connection is initiated from the client and authenticated via certificates or Azure AD.

Answer

Site-to-site VPN, because it is the standard option for any remote access.

Answer

VNet peering, because it can securely connect any remote device to Azure.

Answer

ExpressRoute, because it is the simplest option for temporary contractor access.

Question 3

You need to allow SSH access to only one Linux VM in a subnet that contains several application servers. The other VMs in the subnet must remain inaccessible from the internet. What is the best configuration?

Accepted Answer

Associate an NSG with the target VM's NIC and add an inbound allow rule for TCP 22 from your admin IP.. Option B is correct because Network Security Groups (NSGs) can be associated at the subnet or NIC level. By associating an NSG directly with the target VM's NIC and adding an inbound allow rule for TCP port 22 from your admin IP address, you restrict SSH access exclusively to that VM while leaving the other VMs in the subnet unaffected by the rule. This provides granular, host-level security without impacting the broader subnet traffic.

Answer

Add an inbound allow rule on the subnet NSG for TCP 22 from your admin IP address.

Answer

Create a public load balancer in front of the subnet and forward port 22 to the VM.

Answer

Enable a service endpoint on the subnet so SSH traffic is limited to that VM.

Question 4

Your company has an on-premises office network that needs encrypted connectivity to an Azure virtual network. In addition, traveling users need secure access from their laptops when they are away from the office. Which Azure design best meets both requirements?

Accepted Answer

Deploy a VPN gateway and configure both site-to-site and point-to-site connections.. A VPN gateway supports both site-to-site (S2S) connections for the on-premises office network and point-to-site (P2S) connections for individual traveling users. The S2S connection uses IPsec/IKE to establish encrypted tunnels between the on-premises VPN device and the Azure VPN gateway, while the P2S connection uses SSTP, OpenVPN, or IKEv2 to allow remote laptops to connect securely from anywhere. This single gateway resource can handle both connection types simultaneously, meeting both requirements efficiently.

Answer

Use VNet peering between the office network and Azure, then share the same connection with remote users.

Answer

Create a service endpoint to the virtual network and enable private access for laptops.

Answer

Deploy a NAT gateway and use it for secure office and laptop connectivity.

Question 5

A team is troubleshooting inbound access to Azure VMs. Match each NSG concept on the left with the most accurate behavior or troubleshooting implication on the right.

Question 6

A route table contains a user-defined route for 172.16.0.0/16 to a virtual appliance. The ExpressRoute circuit advertises 172.16.10.0/24. A VM in the subnet sends traffic to 172.16.10.20. Which route does Azure use?

Accepted Answer

The BGP route, because it has the more specific prefix length.. Azure uses the most specific prefix match to determine the next hop. The BGP route for 172.16.10.0/24 has a longer prefix length (24) than the user-defined route for 172.16.0.0/16 (16), so the BGP route is preferred regardless of route source priority. This follows the longest prefix match (LPM) algorithm, which overrides the default preference order of UDRs over BGP routes.

Answer

The user-defined route, because UDRs always beat BGP routes.

Answer

The system route to the virtual network, because system routes are preferred over learned routes.

Answer

No route is chosen because Azure does not support overlapping prefixes.

Question 7

A VM subnet has an NSG with these custom rules:
- Inbound priority 100: Allow TCP 443 from Internet
- Outbound priority 100: Deny Any to Internet
The VM hosts an app that must download updates from an HTTPS repository on the Internet. The downloads fail. What change should be made?

Accepted Answer

Add an outbound allow rule for TCP 443 to Internet or the repository service tag.. The VM's outbound traffic is blocked by the default outbound deny rule (priority 100). Since the app needs to download updates from an HTTPS repository (TCP 443), an outbound allow rule for TCP 443 to the Internet or the repository service tag is required. Inbound rules do not affect outbound traffic, so the existing inbound allow rule is irrelevant to the download failure.

Answer

Add another inbound allow rule for TCP 443 from the repository address.

Answer

Change the inbound allow rule to priority 50.

Answer

Remove the VM's public IP address.

Question 8

An NSG is associated with a subnet. It contains these inbound rules:
- Priority 100: Deny TCP 443 from Internet to Any
- Priority 200: Allow TCP 443 from 203.0.113.0/24 to Any
A tester at 203.0.113.10 browses to the VM's HTTPS endpoint in that subnet. What happens?

Accepted Answer

The request is denied because the priority 100 deny rule matches before the allow rule.. The correct answer is B. Network Security Group (NSG) rules are evaluated in priority order, from lowest to highest numeric value. The priority 100 rule explicitly denies TCP 443 from the Internet (which includes the 203.0.113.0/24 range), and it is evaluated before the priority 200 allow rule. Since the deny rule matches first, the traffic is blocked regardless of the more specific source IP in the allow rule.

Answer

The request is allowed because the more specific source range matches first.

Answer

The request is denied only if the VM has no public IP address.

Answer

The request is allowed because default NSG rules always override custom rules.

Question 9

A route table on a subnet contains this user-defined route:
- 0.0.0.0/0 -> Virtual appliance 10.0.0.4
The subnet is peered to another VNet with address space 10.2.0.0/16. A VM in the subnet sends traffic to 10.2.2.7, and Network Watcher shows the next hop as Virtual network peering instead of the appliance. What explains this result?

Accepted Answer

The peering route is more specific than the default route, so it is selected first.. Azure uses the longest prefix match to determine the next hop for traffic. The user-defined route (UDR) for 0.0.0.0/0 is a default route, while the peering route for 10.2.0.0/16 is more specific. Since 10.2.2.7 falls within the 10.2.0.0/16 range, the peering route is preferred over the default route, directing traffic through the VNet peering instead of the virtual appliance.

Answer

User-defined routes never apply to peered networks.

Answer

NSG rules always override any route table entry.

Answer

Peering only works when both VNets are in the same region.

Question 10

Two VNets are peered. AppVNet contains VMs that access a private endpoint in DataVNet successfully by IP, but name resolution fails for the storage FQDN. The private DNS zone is linked only to DataVNet. What should you do?

Accepted Answer

Add a virtual network link from the private DNS zone to AppVNet.. The private DNS zone is linked only to DataVNet, so VMs in AppVNet cannot resolve the storage FQDN even though IP connectivity works via the VNet peering. By adding a virtual network link from the private DNS zone to AppVNet, you enable DNS resolution for the private endpoint's FQDN across the peered VNet. This is required because private DNS zones are scoped to the VNets they are linked to, and peering alone does not propagate DNS resolution.

Answer

Create another peering connection from AppVNet to DataVNet.

Answer

Create a public DNS zone with the same name as the private zone.

Answer

Assign a public IP address to the private endpoint.

Question 11

A security team requires all outbound internet traffic from a workload subnet to pass through an NVA at 10.1.4.4. The subnet is already associated with an NSG that allows the traffic. Which UDR should the administrator add to the route table for that subnet?

Accepted Answer

Destination 0.0.0.0/0 with next hop type Virtual appliance and next hop IP 10.1.4.4.. Option B is correct because a User Defined Route (UDR) with destination 0.0.0.0/0 and next hop type 'Virtual appliance' forces all outbound internet traffic from the subnet to be forwarded to the NVA at 10.1.4.4 for inspection. The 0.0.0.0/0 prefix matches all internet-bound traffic, and the 'Virtual appliance' next hop type enables routing to a private IP address within the virtual network, overriding the default system route that would otherwise send traffic directly to the Internet.

Answer

Destination 10.1.4.4/32 with next hop type Internet.

Answer

Destination 0.0.0.0/0 with next hop type Virtual network gateway.

Answer

Destination 10.1.4.0/24 with next hop type None.

Question 12

An administrator plans to peer VNet-A with VNet-B so two application tiers can communicate over private IPs. VNet-A uses 10.20.0.0/16. VNet-B currently uses 10.20.1.0/24, and both VNets already contain subnets that must remain intact. The peering operation fails. What should the administrator do first?

Accepted Answer

Change VNet-B to a non-overlapping address space before creating the peering.. VNet peering in Azure requires that the address spaces of the peered VNets do not overlap. VNet-A uses 10.20.0.0/16 and VNet-B uses 10.20.1.0/24, which is a subset of VNet-A's range, creating a direct overlap. The peering operation fails because Azure cannot route traffic correctly when address spaces conflict. The first step must be to change VNet-B's address space to a non-overlapping range (e.g., 10.21.0.0/16) before attempting to create the peering.

Answer

Add a route table to VNet-B so traffic can bypass the overlap.

Answer

Create a network security group rule to allow all traffic between the VNets.

Answer

Enable gateway transit on VNet-A so the address conflict is ignored.

Question 13

A VM in subnet S1 must accept RDP only from the administrator workstation at 203.0.113.25. The subnet NSG has a custom inbound deny-all rule at priority 200 and a custom allow-RDP rule at priority 300 for source 203.0.113.25, destination Any, TCP 3389. RDP is still blocked from the workstation. What should the administrator change?

Accepted Answer

Move the allow-RDP rule to a lower priority number than 200.. Network Security Group (NSG) rules are evaluated in priority order, with lower numbers having higher precedence. The deny-all rule at priority 200 is evaluated before the allow-RDP rule at priority 300, so the deny rule blocks the RDP traffic before the allow rule can be applied. To allow RDP from the workstation, the allow-RDP rule must have a lower priority number (e.g., 100) than the deny-all rule, ensuring it is evaluated first.

Answer

Change the allow rule from inbound to outbound traffic.

Answer

Change the protocol from TCP to Any on the deny-all rule.

Answer

Attach a user-defined route so the workstation can reach the VM directly.

Question 14

A workload subnet must send all outbound internet traffic through a network virtual appliance at 10.4.2.4. What should the administrator configure?

Accepted Answer

A route table with a user-defined route sending 0.0.0.0/0 to 10.4.2.4.. Option B is correct because a user-defined route (UDR) with a destination of 0.0.0.0/0 and a next hop of Virtual Appliance (10.4.2.4) overrides the default system route for internet traffic, forcing all outbound traffic from the subnet to be forwarded to the network virtual appliance (NVA) for inspection or NAT. This is the standard method to implement forced tunneling or centralized internet egress in Azure.

Answer

An NSG rule that allows outbound traffic to 10.4.2.4.

Answer

A private DNS zone for the subnet.

Answer

A service endpoint for the virtual network.

Question 15

A branch office uses an on-premises firewall that supports IPsec/IKE and has a stable public IP. The office needs always-on private connectivity to an Azure VNet over the internet. Which Azure component should the administrator deploy?

Accepted Answer

A site-to-site connection using Azure VPN Gateway.. A site-to-site VPN connection using Azure VPN Gateway is the correct choice because it provides always-on, encrypted connectivity over the internet between an on-premises network with a stable public IP and an Azure VNet. Azure VPN Gateway supports IPsec/IKE protocols, which are compatible with the branch office's firewall, enabling a secure tunnel that meets the requirement for private connectivity.

Answer

VNet peering between the branch office and the Azure VNet.

Answer

Azure Bastion in the target VNet.

Answer

A private endpoint for the Azure VNet.