AZ-104 Implement and Manage Virtual Networking Practice Test 7 — 15 Questions

Question 1

Based on the exhibit, which change should you make so the VM reaches the blob service over a private IP address?

Accepted Answer

Create a private endpoint for the storage account and link the appropriate private DNS zone.. A private endpoint assigns the storage account a private IP address from the VM's virtual network, enabling direct connectivity over a private IP. Linking the private endpoint to a private DNS zone ensures that the storage account's FQDN resolves to the private IP instead of the public endpoint, meeting the requirement without exposing traffic to the internet.

Answer

Enable a service endpoint on the subnet and keep the current DNS configuration.

Answer

Assign the VM a public IP address and allow it through the storage firewall.

Answer

Add the VM to a network security group that allows outbound TCP 443 to Azure Storage.

Question 2

A VM in Azure cannot accept RDP connections from your office public IP. The subnet NSG already has an inbound deny-all rule at priority 200, and you added an allow rule for TCP 3389 from 198.51.100.25/32 at priority 300. What should you do to allow the connection?

Accepted Answer

Create or move the allow rule to priority 100 so it is evaluated before the deny rule.. Network Security Group (NSG) rules are evaluated in priority order, with lower numbers having higher precedence. Since the deny-all rule at priority 200 is evaluated before the allow rule at priority 300, the deny rule blocks the RDP traffic. To allow the connection, the allow rule must be created or moved to a priority lower than 200 (e.g., 100) so it is evaluated first, permitting traffic from 198.51.100.25/32 on TCP 3389 before the deny rule is reached.

Answer

Change the source to Internet so the allow rule matches more traffic.

Answer

Change the protocol from TCP to Any to bypass the deny rule.

Answer

Assign a public IP directly to the VM to override the subnet NSG behavior.

Question 3

A VM in a subnet must access an Azure Storage account without creating a private endpoint. The organization is fine with the storage account remaining on its public endpoint, but traffic should stay on the Azure backbone rather than the public internet. Which feature should you use?

Accepted Answer

A service endpoint for Microsoft.Storage on the subnet.. A service endpoint for Microsoft.Storage on the subnet extends the virtual network identity to the storage account, allowing traffic from the subnet to the storage account's public endpoint to traverse the Azure backbone network instead of the public internet. This meets the requirement of keeping traffic on the Azure backbone without creating a private endpoint, as service endpoints use the public endpoint but route traffic through Microsoft's network.

Answer

A private endpoint and a private DNS zone.

Answer

A NAT gateway attached to the subnet.

Answer

A VPN gateway connection to the storage account resource group.

Question 4

A VM in a virtual network must access an Azure Storage account over a private IP address, and the storage account's public endpoint must be disabled. Name resolution from the VM should resolve the storage name to the private IP. Which configuration should you use?

Accepted Answer

Private endpoint with a private DNS zone linked to the virtual network.. A private endpoint assigns a private IP from the virtual network to the storage account, effectively bringing the service into the VNet. By linking a private DNS zone to the virtual network, the VM's DNS resolution for the storage account name returns the private IP instead of the public endpoint, satisfying both the private connectivity and public endpoint disablement requirements.

Answer

Service endpoint on the subnet plus public DNS, because the storage account will expose a private IP automatically.

Answer

Network security group rules only, because they can force traffic to use private addressing.

Answer

Storage account firewall rules with Allow trusted Microsoft services, because that gives a private address path.

Question 5

A backend subnet contains 18 Linux VMs that must install updates from the internet. Security requires all outbound traffic to use one static public IP, and none of the VMs may have their own public IP addresses. Which two changes meet the requirement? Select two.

Accepted Answer

Associate a NAT gateway with the backend subnet and provide it with a public IP address or prefix.. A NAT gateway provides outbound internet connectivity for VMs in a subnet while using a single static public IP address. By associating a NAT gateway with the backend subnet and assigning it a public IP, all outbound traffic from the 18 Linux VMs will source NAT to that static IP, meeting the security requirement without assigning public IPs to individual VMs.

Answer

Create a public load balancer and add the VMs to its backend pool.

Answer

Use a private endpoint for internet updates so outbound traffic remains private.

Answer

Attach a route table with 0.0.0.0/0 to Virtual network gateway.

Question 6

A contractor working from home needs temporary access to internal Azure resources. There is no on-premises network to connect, and you do not want to expose the resources publicly. Which connectivity option should you deploy?

Accepted Answer

Point-to-site VPN, because it connects an individual client to the virtual network.. A Point-to-Site (P2S) VPN is the correct choice because it allows an individual client computer to establish a secure, encrypted connection to an Azure virtual network over the public internet using SSTP, IKEv2, or OpenVPN protocols. This meets the requirement of temporary remote access without exposing resources publicly, as the connection is initiated from the client and authenticated via certificates or Microsoft Entra ID.

Answer

Site-to-site VPN, because it is the standard option for any remote access.

Answer

VNet peering, because it can securely connect any remote device to Azure.

Answer

ExpressRoute, because it is the simplest option for temporary contractor access.

Question 7

You need to allow SSH access to only one Linux VM in a subnet that contains several application servers. The other VMs in the subnet must remain inaccessible from the internet. What is the best configuration?

Accepted Answer

Associate an NSG with the target VM's NIC and add an inbound allow rule for TCP 22 from your admin IP.. Network Security Groups (NSGs) can be associated at the subnet or NIC level. By associating an NSG directly with the target VM's NIC and adding an inbound allow rule for TCP port 22 from your admin IP address, you restrict SSH access exclusively to that VM while leaving the other VMs in the subnet unaffected by the rule. This provides granular, host-level security without impacting the broader subnet traffic.

Answer

Add an inbound allow rule on the subnet NSG for TCP 22 from your admin IP address.

Answer

Create a public load balancer in front of the subnet and forward port 22 to the VM.

Answer

Enable a service endpoint on the subnet so SSH traffic is limited to that VM.

Question 8

Your company has an on-premises office network that needs encrypted connectivity to an Azure virtual network. In addition, traveling users need secure access from their laptops when they are away from the office. Which Azure design best meets both requirements?

Accepted Answer

Deploy a VPN gateway and configure both site-to-site and point-to-site connections.. A VPN gateway supports both site-to-site (S2S) connections for the on-premises office network and point-to-site (P2S) connections for individual traveling users. The S2S connection uses IPsec/IKE to establish encrypted tunnels between the on-premises VPN device and the Azure VPN gateway, while the P2S connection uses SSTP, OpenVPN, or IKEv2 to allow remote laptops to connect securely from anywhere. This single gateway resource can handle both connection types simultaneously, meeting both requirements efficiently.

Answer

Use VNet peering between the office network and Azure, then share the same connection with remote users.

Answer

Create a service endpoint to the virtual network and enable private access for laptops.

Answer

Deploy a NAT gateway and use it for secure office and laptop connectivity.

Question 9

A team is troubleshooting inbound access to Azure VMs. Match each NSG concept on the left with the most accurate behavior or troubleshooting implication on the right.

Accepted Answer

NSG: A distributed firewall that filters traffic based on rules.. NSG is a distributed firewall; default inbound rule denies all; UDR overrides routes; ASG groups VMs; flow logs record traffic; service tags represent Azure IPs.

Answer

Default inbound rule: Allows all inbound traffic by default.

Answer

Service tags: Override default system routes.

Question 10

A route table contains a user-defined route for 172.16.0.0/16 to a virtual appliance. The ExpressRoute circuit advertises 172.16.10.0/24. A VM in the subnet sends traffic to 172.16.10.20. Which route does Azure use?

Accepted Answer

The BGP route, because it has the more specific prefix length.. Azure uses the most specific prefix match to determine the next hop. The BGP route for 172.16.10.0/24 has a longer prefix length (24) than the user-defined route for 172.16.0.0/16 (16), so the BGP route is preferred regardless of route source priority. This follows the longest prefix match (LPM) algorithm, which overrides the default preference order of UDRs over BGP routes.

Answer

The user-defined route, because UDRs always beat BGP routes.

Answer

The system route to the virtual network, because system routes are preferred over learned routes.

Answer

No route is chosen because Azure does not support overlapping prefixes.

Question 11

A VM subnet has an NSG with these custom rules:
- Inbound priority 100: Allow TCP 443 from Internet
- Outbound priority 100: Deny Any to Internet
The VM hosts an app that must download updates from an HTTPS repository on the Internet. The downloads fail. What change should be made?

Accepted Answer

Add an outbound allow rule for TCP 443 to Internet or the repository service tag.. The VM's outbound traffic is blocked by the default outbound deny rule (priority 100). Since the app needs to download updates from an HTTPS repository (TCP 443), an outbound allow rule for TCP 443 to the Internet or the repository service tag is required. Inbound rules do not affect outbound traffic, so the existing inbound allow rule is irrelevant to the download failure.

Answer

Add another inbound allow rule for TCP 443 from the repository address.

Answer

Change the inbound allow rule to priority 50.

Answer

Remove the VM's public IP address.

Question 12

An NSG is associated with a subnet. It contains these inbound rules:
- Priority 100: Deny TCP 443 from Internet to Any
- Priority 200: Allow TCP 443 from 203.0.113.0/24 to Any
A tester at 203.0.113.10 browses to the VM's HTTPS endpoint in that subnet. What happens?

Accepted Answer

The request is denied because the priority 100 deny rule matches before the allow rule.. Network Security Group (NSG) rules are evaluated in priority order, from lowest to highest numeric value. The priority 100 rule explicitly denies TCP 443 from the Internet (which includes the 203.0.113.0/24 range), and it is evaluated before the priority 200 allow rule. Since the deny rule matches first, the traffic is blocked regardless of the more specific source IP in the allow rule.

Answer

The request is allowed because the more specific source range matches first.

Answer

The request is denied only if the VM has no public IP address.

Answer

The request is allowed because default NSG rules always override custom rules.

Question 13

Two VNets are peered. AppVNet contains VMs that access a private endpoint in DataVNet successfully by IP, but name resolution fails for the storage FQDN. The private DNS zone is linked only to DataVNet. What should you do?

Accepted Answer

Add a virtual network link from the private DNS zone to AppVNet.. The private DNS zone is linked only to DataVNet, so VMs in AppVNet cannot resolve the storage FQDN even though IP connectivity works via the VNet peering. By adding a virtual network link from the private DNS zone to AppVNet, you enable DNS resolution for the private endpoint's FQDN across the peered VNet. This is required because private DNS zones are scoped to the VNets they are linked to, and peering alone does not propagate DNS resolution.

Answer

Create another peering connection from AppVNet to DataVNet.

Answer

Create a public DNS zone with the same name as the private zone.

Answer

Assign a public IP address to the private endpoint.

Question 14

A security team requires all outbound internet traffic from a workload subnet to pass through an NVA at 10.1.4.4. The subnet is already associated with an NSG that allows the traffic. Which UDR should the administrator add to the route table for that subnet?

Accepted Answer

Destination 0.0.0.0/0 with next hop type Virtual appliance and next hop IP 10.1.4.4.. A User Defined Route (UDR) with destination 0.0.0.0/0 and next hop type 'Virtual appliance' forces all outbound internet traffic from the subnet to be forwarded to the NVA at 10.1.4.4 for inspection. The 0.0.0.0/0 prefix matches all internet-bound traffic, and the 'Virtual appliance' next hop type enables routing to a private IP address within the virtual network, overriding the default system route that would otherwise send traffic directly to the Internet.

Answer

Destination 10.1.4.4/32 with next hop type Internet.

Answer

Destination 0.0.0.0/0 with next hop type Virtual network gateway.

Answer

Destination 10.1.4.0/24 with next hop type None.

Question 15

A VM in subnet S1 must accept RDP only from the administrator workstation at 203.0.113.25. The subnet NSG has a custom inbound deny-all rule at priority 200 and a custom allow-RDP rule at priority 300 for source 203.0.113.25, destination Any, TCP 3389. RDP is still blocked from the workstation. What should the administrator change?

Accepted Answer

Move the allow-RDP rule to a lower priority number than 200.. Network Security Group (NSG) rules are evaluated in priority order, with lower numbers having higher precedence. The deny-all rule at priority 200 is evaluated before the allow-RDP rule at priority 300, so the deny rule blocks the RDP traffic before the allow rule can be applied. To allow RDP from the workstation, the allow-RDP rule must have a lower priority number (e.g., 100) than the deny-all rule, ensuring it is evaluated first.

Answer

Change the allow rule from inbound to outbound traffic.

Answer

Change the protocol from TCP to Any on the deny-all rule.

Answer

Attach a user-defined route so the workstation can reach the VM directly.