AZ-104 Implement and Manage Virtual Networking Practice Test 6 — 15 Questions

Question 1

Users on the internet cannot access an HTTPS website hosted on VM-Web01. The VM has a public IP address, the web service is running, and the guest OS firewall allows TCP 443. What is the most likely Azure-side issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The NSG does not allow inbound TCP 443. The most likely Azure-side issue is that the Network Security Group (NSG) associated with the VM's subnet or NIC does not have an inbound rule allowing TCP 443. Even if the guest OS firewall permits HTTPS and the web service is running, the NSG acts as a distributed firewall that filters traffic at the Azure network boundary. Without an explicit inbound security rule for TCP 443, all HTTPS traffic from the internet is dropped before reaching the VM.

Answer

The VM uses managed disks

Answer

Azure Backup is not enabled

Answer

The storage account uses the Cool tier

Question 2

Traffic from VM-App01 is taking an unexpected path to the internet through a network virtual appliance. You need to determine which routes are actually applied to the VM network interface. Which Azure feature should you use?

Accepted Answer

Effective routes for the network interface. Effective routes for a network interface show the actual routes applied to the VM's NIC after combining all route sources (system routes, BGP, and user-defined routes). This allows you to verify whether traffic is being forced through the NVA or taking an unexpected path, by inspecting the next hop type and IP address for the 0.0.0.0/0 route.

Answer

NSG flow logs

Answer

Azure Policy compliance

Answer

The subscription activity log

Question 3

You create a private endpoint for an Azure Storage account. Virtual machines in VNet-Prod must resolve the storage account name to the private IP address of that endpoint. Which Azure feature should you configure?

Accepted Answer

A private DNS zone linked to VNet-Prod. A private endpoint uses a private IP address from the VNet, but DNS resolution must be explicitly configured to map the storage account's FQDN to that private IP. By creating a private DNS zone (privatelink.blob.core.windows.net) linked to VNet-Prod, Azure automatically creates an A record for the private endpoint IP, enabling VMs to resolve the storage account name to the private IP instead of the public IP.

Answer

A user-defined route

Answer

An Azure Firewall policy

Answer

A Recovery Services vault

Question 4

Users on the internet cannot reach an HTTPS application hosted on VM-Web01. The VM has a public IP address, the application is listening on TCP port 443, and the guest OS firewall allows the traffic. What is the most likely Azure-side cause?

Accepted Answer

The NSG blocks inbound TCP 443. The most likely Azure-side cause is that a Network Security Group (NSG) associated with the VM's subnet or NIC is blocking inbound TCP port 443. Even if the VM has a public IP, the application is listening, and the guest OS firewall allows traffic, an NSG rule denying inbound HTTPS traffic will prevent external users from reaching the application. NSGs act as a distributed firewall filtering traffic at the Azure network layer before it reaches the VM.

Answer

The VM uses Premium SSD

Answer

Azure Backup is not enabled

Answer

The storage account uses GRS

Question 5

You need to allow or deny traffic to and from resources in an Azure subnet based on source IP address, destination port, and protocol. Which Azure feature should you use?

Accepted Answer

A network security group. A network security group (NSG) is the correct Azure feature because it acts as a stateful, distributed firewall that filters traffic to and from Azure resources in a virtual network. NSGs contain security rules that allow or deny inbound and outbound traffic based on source/destination IP address, port, and protocol (TCP, UDP, or ICMP). This directly matches the requirement to control traffic based on source IP, destination port, and protocol.

Answer

A route table

Answer

A private DNS zone

Answer

Azure Advisor

Question 6

Based on the exhibit, which network feature should you use so only the subnet can reach the storage account while still using the public endpoint?

Accepted Answer

Enable a service endpoint on app-subnet and allow that subnet on the storage firewall.. Enabling a service endpoint on the app-subnet allows traffic from that subnet to reach the storage account over the Azure backbone network while still using the public endpoint. By then adding the subnet to the storage account firewall, you restrict access to only that subnet, ensuring no other internet traffic can reach the storage account. This approach leverages the public endpoint but with subnet-level access control, meeting the requirement.

Answer

Create a private endpoint and disable the storage account public endpoint.

Answer

Add a NAT gateway to app-subnet and use the NAT public IP for firewall rules.

Answer

Peer app-subnet with a new VNet and access the storage account through peering.

Question 7

A subnet has a route table with these user-defined routes: 10.10.0.0/16 to Virtual appliance, 10.10.5.0/24 to Virtual network gateway, and 10.10.5.128/25 to Virtual network. The subnet is attached to a VM that sends traffic to several destinations. Which three next-hop decisions are correct? Select three.

Accepted Answer

Traffic to 10.10.5.9 uses Virtual network gateway.. The route table uses longest prefix match. The destination 10.10.5.9 falls within the 10.10.5.0/24 range, which has a more specific prefix (24 bits) than 10.10.0.0/16 (16 bits). The user-defined route for 10.10.5.0/24 specifies a next hop of Virtual network gateway, so traffic to 10.10.5.9 is forwarded to the gateway.

Answer

Traffic to 10.10.5.9 uses Virtual appliance.

Answer

Traffic to 8.8.8.8 uses Virtual appliance.

Question 8

A subnet has an NSG with these inbound rules: priority 200 DenyAllInbound and priority 300 AllowHTTPSFromInternet. A VM in the subnet is still unreachable on TCP 443 from the internet. What should you do to make HTTPS work while keeping the deny rule in place?

Accepted Answer

Move the allow HTTPS rule to a lower priority number such as 100 so it is evaluated before the deny rule.. NSG rules are evaluated in priority order, with lower numbers evaluated first. Moving the allow HTTPS rule to priority 100 ensures it is processed before the DenyAllInbound rule at priority 200, allowing TCP 443 traffic from the internet while the deny rule remains in place for all other inbound traffic.

Answer

Create the same allow rule on the NIC-level NSG at priority 300 and leave the subnet NSG unchanged.

Answer

Change the deny rule to protocol Any and keep the same priority so Azure evaluates the allow rule first.

Answer

Add a route table entry for TCP 443 traffic so Azure sends it directly to the VM.

Question 9

Two virtual networks were created in different subscriptions. VNet-A uses 10.4.0.0/16 and VNet-B uses 10.4.128.0/17. You try to create peering between them, but Azure rejects the request. What is the best fix?

Accepted Answer

Change one VNet to a non-overlapping address range, then create the peering again.. VNet peering requires that the address spaces of the two virtual networks do not overlap. VNet-A uses 10.4.0.0/16, which covers 10.4.0.0 to 10.4.255.255, and VNet-B uses 10.4.128.0/17, which falls entirely within that range (10.4.128.0 to 10.4.255.255). Azure rejects the peering because overlapping address spaces would cause routing conflicts. The only correct fix is to change one VNet's address space to a non-overlapping range, then recreate the peering.

Answer

Enable gateway transit on both VNets before creating the peering.

Answer

Add a route table to one VNet so the address spaces no longer overlap.

Answer

Create a private endpoint between the two VNets instead of peering.

Question 10

A route table contains these entries: 10.0.0.0/8 with next hop Virtual appliance, and 10.1.1.0/24 with next hop Virtual network gateway. Which next hop will Azure use for traffic to 10.1.1.5?

Accepted Answer

Virtual network gateway, because the /24 route is more specific than the /8 route.. Azure uses the most specific route prefix (longest prefix match) to determine the next hop for traffic. For destination 10.1.1.5, the route 10.1.1.0/24 (prefix length 24) is more specific than 10.0.0.0/8 (prefix length 8), so the next hop Virtual network gateway is selected, regardless of the order in which routes were created.

Answer

Virtual appliance, because the broader 10.0.0.0/8 route was created first.

Answer

Internet, because Azure always prefers the default system route for public addresses.

Answer

None, because Azure ignores overlapping route entries in the same table.

Question 11

A hub VNet already has a VPN gateway connected to on-premises. A spoke VNet in the same region must reach on-premises networks through that existing gateway, and you do not want to deploy a separate VPN gateway in the spoke. What peering settings should you use?

Accepted Answer

Enable Allow gateway transit on the hub peering and Use remote gateways on the spoke peering.. To enable a spoke VNet to use a hub VNet's VPN gateway for on-premises connectivity without deploying a separate gateway, you must configure the hub peering with 'Allow gateway transit' and the spoke peering with 'Use remote gateways'. This allows the spoke to route traffic through the hub's VPN gateway, leveraging the existing site-to-site VPN connection to on-premises.

Answer

Create peering only; the spoke will automatically use the hub gateway without extra settings.

Answer

Enable Use remote gateways on the hub peering and Allow gateway transit on the spoke peering.

Answer

Create a service endpoint from the spoke VNet to the on-premises network.

Question 12

A company wants encrypted connectivity between its on-premises network and an Azure VNet. The organization has one edge VPN device at headquarters, and the Azure design must support a classic site-to-site tunnel rather than individual user VPN connections. Which three prerequisites are required? Select three.

Accepted Answer

Deploy a virtual network gateway in a dedicated GatewaySubnet.. Option A is correct because a site-to-site VPN in Azure requires a virtual network gateway (VPN type) deployed into a subnet named exactly GatewaySubnet, which is the dedicated subnet Azure mandates for gateway resources. Option B is correct because the Azure VPN gateway must have a public IP address so the on-premises VPN device can reach it as the tunnel endpoint over the internet. Option C is correct because the on-premises edge device must have a routable public IP and be configured with compatible IKE/IPsec parameters (shared key, encryption, and hashing settings) to establish the IPsec tunnel with the Azure gateway. Option D is not applicable because a private endpoint provides private access to a specific Azure PaaS service, not a site-to-site VPN tunnel between networks. Option E is not applicable because Microsoft peering is an ExpressRoute BGP peering type, not a feature of a VPN virtual network gateway.

Answer

Create a private endpoint for the headquarters network.

Answer

Enable Microsoft peering on the virtual network gateway.

Question 13

An internal line-of-business application runs on two VMs in Azure. Users connect only from a peered virtual network and from on-premises through VPN. The application must not be reachable from the internet, but traffic should be balanced across the two VMs. Which configuration should you choose?

Accepted Answer

A Standard Load Balancer with a private frontend IP.. A Standard Load Balancer with a private frontend IP is correct because it distributes traffic to the two VMs using a private IP address that is only reachable from within the peered virtual network and the on-premises network via VPN. This configuration ensures the application is not exposed to the internet while still providing load balancing across the VMs.

Answer

A public Standard Load Balancer with a public frontend IP.

Answer

A NAT gateway attached to the application subnet.

Answer

A network security group rule allowing TCP 443 from the internet.

Question 14

An application VM in a subnet without a public IP must access Azure Blob Storage. The storage account must not be reachable from the public internet, and DNS resolution should stay inside the virtual network. What should you implement?

Accepted Answer

Create a private endpoint for the storage account and link the appropriate private DNS zone.. A private endpoint assigns the storage account a private IP from the VM's virtual network, making it reachable without public internet exposure. Linking the private DNS zone ensures that DNS resolution for the storage account (e.g., `mystorageaccount.blob.core.windows.net`) resolves to the private IP within the VNet, meeting both requirements.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet and keep the public endpoint enabled.

Answer

Use a SAS token and allow access from any network for the storage account.

Answer

Assign a managed identity to the VM and remove all network restrictions from the storage account.

Question 15

You removed public IP addresses from a backend subnet containing 20 VMs. The VMs still need outbound internet access for updates, and the organization wants all outbound traffic to appear from one predictable public IP. No inbound publishing is required. Which Azure service should you use?

Accepted Answer

Azure NAT Gateway associated with the subnet.. Azure NAT Gateway is the correct choice because it provides outbound-only internet connectivity for a subnet, translating all VM traffic to a single public IP address without requiring inbound NAT rules or a load balancer. It supports SNAT (Source Network Address Translation) for up to 64,000 concurrent flows per IP, meeting the requirement for predictable outbound IP and no inbound publishing.

Answer

A public load balancer with inbound NAT rules for each VM.

Answer

A private load balancer with a backend pool of the VMs.

Answer

A VPN gateway connection to a remote network.