AZ-104 Implement and Manage Virtual Networking Practice Test 7 — 15 Questions

Question 1

A security team requires all outbound traffic from a subnet to pass through an Azure Firewall at 10.1.0.4, including internet-bound traffic from the VMs. What should the administrator configure?

Accepted Answer

Create a route table with a 0.0.0.0/0 route to 10.1.0.4 and associate it with the subnet.. Option B is correct because creating a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP (10.1.0.4) and associating it with the subnet forces all outbound traffic, including internet-bound traffic, to be routed through the firewall. This ensures the firewall can inspect and control all egress traffic as required by the security team.

Answer

Assign a NAT gateway to the subnet and leave the default routing in place.

Answer

Enable service endpoints for the subnet so outbound traffic stays private.

Answer

Deploy a public IP on each VM and use NSG rules to inspect the traffic.

Question 2

A subnet is associated with a NAT gateway, but its route table also contains a 0.0.0.0/0 route to a virtual appliance at 10.2.0.4. The business wants all outbound internet traffic from the VMs to use one static public IP, and inspection by the appliance is no longer required. What should the administrator change?

Accepted Answer

Remove the 0.0.0.0/0 user-defined route from the subnet.. The correct answer is B because removing the 0.0.0.0/0 user-defined route (UDR) from the subnet's route table will allow the NAT gateway to handle all outbound internet traffic. The NAT gateway provides a single static public IP for outbound traffic, and since inspection by the virtual appliance is no longer required, the conflicting UDR that directs traffic to the appliance must be deleted. This ensures that the subnet's default route points to the NAT gateway, which uses Source Network Address Translation (SNAT) to translate private IPs to the static public IP.

Answer

Add a public IP address directly to each virtual machine NIC.

Answer

Enable service endpoints for the subnet.

Answer

Change the NAT gateway to a zone-redundant SKU.

Question 3

An application subnet has a network security group with these inbound rules: Allow-Web-From-Internet at priority 200, Allow-App-From-Web at priority 300, and Deny-All-Inbound at priority 250. The web tier must reach the app tier on TCP 8080, but traffic is being denied. The administrator confirms the source and destination IPs are correct. What is the best fix?

Accepted Answer

Change the Allow-App-From-Web rule to a lower priority number than 250.. The Deny-All-Inbound rule at priority 250 is evaluated before the Allow-App-From-Web rule at priority 300 because lower priority numbers are processed first. To allow web-to-app traffic on TCP 8080, the Allow-App-From-Web rule must have a lower priority number (e.g., 240) than the Deny-All-Inbound rule so it is evaluated and applied first, permitting the traffic before the deny rule blocks it.

Answer

Delete the Deny-All-Inbound rule because default NSG rules will allow the traffic.

Answer

Add a route table entry for TCP 8080 traffic to bypass the NSG.

Answer

Move the Allow-Web-From-Internet rule to priority 400.

Question 4

A web tier and an app tier run in separate subnets. Each VM NIC is placed in an application security group named WebASG or AppASG. The administrator must allow only the web tier to reach the app tier on TCP port 8443 and block all other inbound traffic to the app tier. Which NSG rule should be created on the app subnet?

Accepted Answer

Allow TCP 8443 from WebASG to AppASG with a priority lower number than the deny rule.. Option A is correct because NSG rules are evaluated in priority order, with lower numbers having higher priority. By placing an Allow rule for TCP 8443 from WebASG to AppASG with a lower priority number than a subsequent Deny-All rule, only traffic from the web tier is permitted, and all other inbound traffic to the app subnet is blocked. This leverages application security groups (ASGs) to define fine-grained, role-based network security policies without relying on IP addresses.

Answer

Allow TCP 8443 from the entire virtual network to the app subnet with a lower priority than the deny rule.

Answer

Allow UDP 8443 from WebASG to AppASG with any priority below 65000.

Answer

Allow TCP 8443 from WebASG to AppASG with a priority higher number than the deny rule.

Question 5

Based on the exhibit, HTTPS traffic from the admin workstation is still being blocked. What change should the administrator make?

Accepted Answer

Change Allow-HTTPS-Admin to priority 100.. The Deny-All-Inbound rule has a default priority of 65000, which is higher (lower priority) than the Allow-HTTPS-Admin rule at priority 200. Since Azure Network Security Group (NSG) rules are evaluated in priority order (lowest number = highest priority), the Deny-All-Inbound rule is evaluated first and blocks all traffic, including HTTPS from the admin workstation. By changing Allow-HTTPS-Admin to priority 100, it will be evaluated before the Deny-All-Inbound rule, allowing HTTPS traffic to pass.

Answer

Delete the Deny-All-Inbound rule.

Answer

Change Allow-HTTPS-Admin protocol from TCP to Any.

Answer

Move the allow rule to outbound traffic.

Question 6

An on-premises application connected through a site-to-site VPN must read data from an Azure Storage account. Public network access is disabled on the storage account, and the storage service must be reachable only by a private IP address inside Azure. Which solution should the administrator implement?

Accepted Answer

Create a private endpoint for the storage account in an Azure VNet.. A private endpoint assigns the storage account a private IP address from an Azure VNet, allowing the on-premises application to connect over the site-to-site VPN using that private IP. This ensures the storage service is reachable only within Azure's private network, even with public network access disabled. The private endpoint uses Azure Private Link to securely expose the storage account into the VNet, making it accessible via the VPN without traversing the public internet.

Answer

Enable a service endpoint on the on-premises network.

Answer

Peer the on-premises network directly to the storage account.

Answer

Use a shared access signature and leave public network access enabled.

Question 7

Based on the exhibit, which Azure connectivity option should the administrator use for the branch office?

Accepted Answer

A site-to-site VPN connection to an Azure VPN gateway.. A site-to-site VPN connection to an Azure VPN gateway (Option D) is the correct choice because it provides a persistent, encrypted tunnel between the branch office's on-premises network and Azure, enabling seamless connectivity for all users and devices at the branch without requiring per-user configuration. This aligns with the typical scenario where a branch office needs constant, secure access to Azure resources, and the VPN gateway supports IPsec/IKE protocols for site-to-site connections.

Answer

Point-to-site VPN for each user laptop.

Answer

VNet peering between the branch office and Azure.

Answer

A service endpoint on the Azure subnet.

Question 8

A three-tier application uses separate web and app VMs that are scaled in and out regularly. The administrator must allow only the web tier to connect to the app tier on TCP 8080 without continually updating IP addresses. What should be configured in the NSG rule?

Accepted Answer

Use application security groups for the web and app tiers and reference those groups in the NSG rule.. Application security groups (ASGs) allow you to group VMs logically by their application role (e.g., web tier, app tier) and reference those groups directly in NSG rules. This eliminates the need to maintain individual IP addresses or CIDR ranges when VMs scale in or out, because the NSG rule dynamically applies to all VMs in the ASG. By creating an inbound NSG rule that allows TCP 8080 from the web-tier ASG to the app-tier ASG, the administrator achieves the required connectivity without manual IP updates.

Answer

Add a subnet-to-subnet peering connection between the web and app subnets.

Answer

Create a load balancer backend pool rule for TCP 8080.

Answer

Use a user-defined route that sends TCP 8080 traffic to the app tier.

Question 9

Based on the exhibit, what should the administrator do so the hub and spoke can be peered successfully?

Accepted Answer

Change the spoke VNet to a non-overlapping address space.. VNet peering requires that the address spaces of the peered VNets do not overlap. Overlapping IP ranges cause routing conflicts and prevent successful peering. Changing the spoke VNet to a non-overlapping address space resolves this issue and allows the peering to be established.

Answer

Keep the current ranges and enable gateway transit on the peering.

Answer

Add another subnet inside the spoke VNet and reuse the current address space.

Answer

Create a network security group on the spoke subnet before peering.

Question 10

Two VM scale sets named Web and App run in separate subnets. The App subnet NSG already contains Deny-All-Inbound at priority 300. The business wants only the Web tier to connect to the App tier on TCP 8443, and any new scale-out instances must be included automatically. What should the administrator add?

Accepted Answer

An inbound allow rule using source WebASG, destination AppASG, TCP 8443, with a priority lower than 300.. Option B is correct because it uses an Application Security Group (ASG) as the source and destination, which automatically includes all current and future VM instances in the Web and App scale sets. The rule allows TCP 8443 from WebASG to AppASG with a priority lower than 300 (e.g., 250) so it is evaluated before the Deny-All-Inbound rule at priority 300. This ensures that only the Web tier can connect to the App tier on the specified port, and new scale-out instances are included automatically without manual NSG updates.

Answer

A rule that allows TCP 8443 from the current Web subnet address range to the App subnet.

Answer

A load balancer NAT rule that maps port 8443 from the Internet to the App tier.

Answer

A service endpoint for Microsoft.Web on both subnets.

Question 11

A subnet must send traffic to on-premises networks through a VPN gateway, but internet-bound traffic should use the Azure platform's normal outbound path and not be forced through a virtual appliance. The administrator wants to avoid creating a 0.0.0.0/0 user-defined route. Which design meets the requirement?

Accepted Answer

Associate a route table that contains only the specific on-premises prefixes and leave gateway route propagation enabled.. Option A is correct because it uses a route table with only the specific on-premises prefixes, which forces traffic destined for those prefixes through the VPN gateway, while leaving gateway route propagation enabled. With gateway propagation enabled, the VPN gateway's learned routes (including the 0.0.0.0/0 route from the on-premises network) are not automatically added to the subnet's route table unless explicitly propagated; instead, the subnet's effective routes combine the user-defined routes (UDRs) for on-premises prefixes with the Azure default system routes, which include a 0.0.0.0/0 route to the internet. This ensures internet-bound traffic uses the Azure platform's normal outbound path without a forced tunnel through the virtual appliance or VPN gateway.

Answer

Add a 0.0.0.0/0 route to the VPN gateway and disable gateway route propagation.

Answer

Create a service endpoint for the subnet and use it as the default next hop.

Answer

Attach an NSG rule that allows on-premises traffic and blocks all internet traffic.

Question 12

A web tier and an app tier run on separate Azure VMs in the same region. Each VM's NIC is added to an application security group named WebASG or AppASG. The administrator must allow only the web tier to connect to the app tier on TCP 8443, and future VM scale-outs must be included automatically. Which NSG rule should be created?

Accepted Answer

An inbound rule with source WebASG, destination AppASG, protocol TCP, and destination port 8443.. Option B is correct because application security groups (ASGs) allow you to configure network security as a natural extension of an application's structure, enabling you to group VMs by their roles (e.g., web tier, app tier) and define rules based on those groups. By creating an inbound NSG rule with source WebASG and destination AppASG on TCP port 8443, any VM added to WebASG can initiate traffic to any VM in AppASG, and future scale-outs are automatically included without manual IP updates. This approach is dynamic, scalable, and aligns with the requirement for automatic inclusion of new VMs.

Answer

An inbound rule that uses the current web VM's private IP as the source and the current app VM's private IP as the destination.

Answer

A route table that sends TCP 8443 traffic from the web subnet to the app subnet.

Answer

An Azure Firewall application rule collection that permits all traffic between the two subnets.

Question 13

An administrator is troubleshooting inbound HTTPS to a VM. The subnet NSG has these custom rules: Deny-Internet-Inbound at priority 150, Allow-HTTPS-Admin at priority 200, and the default deny rules remain in place. The administrator’s client is on the internet and should be able to reach the VM on TCP 443. What change will fix the problem?

Accepted Answer

Move the allow rule to a lower priority number than the deny rule.. The correct answer is A because Network Security Group (NSG) rules are evaluated in priority order, with lower numbers evaluated first. The Deny-Internet-Inbound rule at priority 150 is evaluated before the Allow-HTTPS-Admin rule at priority 200, so the deny rule blocks the inbound HTTPS traffic before the allow rule can be processed. Moving the allow rule to a lower priority number (e.g., 140) ensures it is evaluated first, permitting the traffic from the internet on TCP 443.

Answer

Change the allow rule source from Internet to Any and keep the same priority.

Answer

Create a route table to the VM subnet so traffic reaches the VM faster.

Answer

Associate an application security group with the VM and leave the rules unchanged.

Question 14

After a private endpoint for an Azure Blob Storage account is created, VMs in the same VNet still resolve the storage name to the public IP address. The administrator wants the name to resolve to the private endpoint address instead. What should be configured?

Accepted Answer

Link the private DNS zone for blob storage to the virtual network.. When a private endpoint is created for Azure Blob Storage, the private DNS zone (privatelink.blob.core.windows.net) must be linked to the virtual network to enable automatic resolution of the storage account's FQDN to the private endpoint's private IP address. Without this link, VMs in the VNet continue to use public DNS resolution, which returns the public IP. Linking the private DNS zone to the VNet ensures that DNS queries from VMs resolve to the private endpoint address via Azure's DNS infrastructure.

Answer

Create a route table that sends storage traffic to the private endpoint subnet.

Answer

Enable a service endpoint on the subnet that hosts the VMs.

Answer

Assign a public IP address to the private endpoint subnet.

Question 15

A company has a virtual machine in a subnet that must access an Azure Storage account. The storage account should remain reachable through its public endpoint, but access must be limited to that subnet, and the traffic should stay on the Azure backbone rather than the internet. Which feature should the administrator configure on the subnet?

Accepted Answer

A service endpoint for Microsoft.Storage.. A service endpoint for Microsoft.Storage extends the virtual network identity to the storage account, allowing traffic from the subnet to the storage account's public endpoint to be routed over the Azure backbone network rather than the internet. This satisfies the requirement to limit access to the subnet while keeping the public endpoint reachable and traffic within Azure's infrastructure.

Answer

A private endpoint for the storage account.

Answer

A site-to-site VPN connection to the storage account.

Answer

An application security group assigned to the storage account.