AZ-104 Implement and Manage Virtual Networking Practice Test 8 — 15 Questions

Question 1

A spoke VM can connect to a hub VM by IP address after peering is configured, but it cannot resolve internal host names such as app01.corp.local. The hub has a DNS server at 10.50.1.4 that hosts those records. What should the administrator configure so the spoke VMs use that DNS server?

Accepted Answer

Set the spoke VNet's custom DNS server to 10.50.1.4.. Option B is correct because the spoke VNet must be configured to use a custom DNS server to override Azure's default internal name resolution. By setting the spoke VNet's DNS server to 10.50.1.4, all VMs in the spoke will query that server for hostname resolution, including app01.corp.local. This is a VNet-level setting that applies to all VMs in the spoke, and it does not require any changes to NSGs or peering configurations.

Answer

Add an NSG rule allowing UDP and TCP port 53 between the VNets.

Answer

Create a private endpoint for the hub DNS server.

Answer

Enable remote gateways on the spoke peering.

Question 2

An NSG attached to a subnet contains these inbound rules: Deny-All-Inbound at priority 200, Allow-HTTPS-Admin at priority 250 from 203.0.113.20/32, and Allow-HTTPS-Internet at priority 300. A VM in the subnet cannot receive HTTPS from the admin workstation even though the source IP is correct. What should the administrator change?

Accepted Answer

Move the Allow-HTTPS-Admin rule to a priority number lower than 200.. The Deny-All-Inbound rule at priority 200 blocks all traffic, including HTTPS from the admin workstation, because NSG rules are evaluated in priority order (lowest number first). The Allow-HTTPS-Admin rule at priority 250 is never reached since the deny rule with a higher priority (lower number) matches first. To allow the admin traffic, the allow rule must have a priority lower than 200 (e.g., 150) so it is evaluated before the deny rule.

Answer

Change the protocol from TCP to Any on the allow rule.

Answer

Associate a NAT gateway with the subnet.

Answer

Enable service endpoint policies on the subnet.

Question 3

Based on the exhibit, what inbound NSG rule should the administrator add to allow only the web tier to reach the app tier on TCP 8080?

Accepted Answer

Source: WebASG, Destination: AppASG, Protocol: TCP, Port: 8080, Priority: 250. Option A is correct because the inbound NSG rule must allow traffic from the web tier (source: WebASG) to the app tier (destination: AppASG) on TCP port 8080. A priority of 250 is lower than the default rules (65000+) and ensures this rule is evaluated before any higher-numbered deny rules, while being high enough to leave room for more specific rules if needed.

Answer

Source: Internet, Destination: VirtualNetwork, Protocol: TCP, Port: 8080, Priority: 250

Answer

Source: AppASG, Destination: WebASG, Protocol: TCP, Port: 8080, Priority: 250

Answer

Source: WebASG, Destination: AppASG, Protocol: TCP, Port: 8080, Priority: 350

Question 4

Two VNets are peered successfully, and a VM in the spoke can reach a private endpoint in the hub by IP address. However, the VM cannot resolve the storage account name to the private endpoint FQDN. The private DNS zone is linked only to the hub VNet. What should the administrator do?

Accepted Answer

Link the private DNS zone to the spoke VNet as well.. The VM can reach the private endpoint by IP, confirming that network connectivity (peering and routing) is working. However, name resolution fails because the private DNS zone, which contains the private endpoint FQDN mapping, is linked only to the hub VNet. By linking the private DNS zone to the spoke VNet (option B), the spoke VMs will use Azure-provided DNS to resolve the storage account name to the private IP, enabling seamless name resolution across the peered VNets.

Answer

Add a route table to the spoke subnet pointing to the private endpoint IP.

Answer

Enable gateway transit on the peering connection.

Answer

Create an NSG rule to allow DNS traffic to the storage account.

Question 5

Based on the exhibit, which subnet prefix should be used for Subnet A so it can support about 30 VM NICs?

Accepted Answer

/26. Option C (/26) is correct because a /26 subnet provides 64 IP addresses (2^(32-26) = 64), of which 62 are usable for VM NICs after reserving the network address and broadcast address. This comfortably supports about 30 VM NICs while leaving room for growth.

Answer

/28

Answer

/27

Answer

/25

Question 6

A team is creating a new spoke VNet that will later be peered to an existing hub VNet and connected to on-premises networks. The proposed address space for the spoke is 10.60.1.0/24. The hub already uses 10.60.0.0/16. What should the administrator do before deploying the spoke?

Accepted Answer

Choose a non-overlapping address space for the spoke, such as 10.61.1.0/24.. Option B is correct because VNet address spaces must not overlap when peered or connected via VPN/ExpressRoute. The proposed spoke address 10.60.1.0/24 falls within the hub's 10.60.0.0/16 range, creating an overlap that would prevent successful peering and routing. A non-overlapping address space like 10.61.1.0/24 ensures unique IP ranges, allowing proper route propagation and connectivity.

Answer

Use the proposed address space because the spoke subnet is smaller than the hub address space.

Answer

Create a private endpoint in the spoke to separate its routing table from the hub.

Answer

Enable gateway transit on the hub peering before creating the spoke.

Question 7

Based on the exhibit, the administrator cannot create VNet peering between the hub and spoke networks. What should be changed?

Accepted Answer

Change the spoke VNet address space so it does not overlap the hub.. VNet peering requires that the address spaces of the peered VNets do not overlap. Overlapping address spaces cause routing conflicts because Azure cannot distinguish between resources in the hub and spoke when IP addresses are identical or within the same CIDR range. Changing the spoke VNet address space to a non-overlapping range resolves this issue and allows peering to be established.

Answer

Change the hub VNet to use a smaller subnet mask.

Answer

Add a route table to the spoke VNet before creating peering.

Answer

Enable a service endpoint on both VNets.

Question 8

A company wants to peer a new spoke virtual network with an existing hub VNet. The hub uses 10.20.0.0/16. The spoke was created with 10.20.1.0/24 because that range was still available in the IPAM spreadsheet. VNet peering creation fails. What should the administrator do first?

Accepted Answer

Change the spoke VNet address space to a non-overlapping range, then recreate or update peering.. VNet peering in Azure requires that the address spaces of the peered virtual networks do not overlap. The hub uses 10.20.0.0/16, and the spoke uses 10.20.1.0/24, which is a subset of the hub's range. This overlap causes the peering creation to fail. The administrator must first change the spoke's address space to a non-overlapping range (e.g., 10.21.0.0/24) and then recreate or update the peering.

Answer

Enable gateway transit on the hub and retry the peering.

Answer

Add a route table to the spoke subnet so the networks can communicate.

Answer

Configure a custom DNS server in the spoke to translate the overlapping range.

Question 9

A subnet uses a route table with gateway route propagation disabled so internet-bound traffic can be forced through a network virtual appliance. After the change, VMs in the subnet can no longer reach servers in the on-premises network 172.16.0.0/16 over the VPN gateway. What should the administrator add to the route table?

Accepted Answer

A user-defined route for 172.16.0.0/16 with next hop type Virtual network gateway.. When gateway route propagation is disabled on a route table, the subnet no longer receives the default system routes that include the VPN gateway route for on-premises networks. To restore connectivity to 172.16.0.0/16, you must add a user-defined route (UDR) with next hop type 'Virtual network gateway', which explicitly directs traffic for that prefix through the VPN gateway. This overrides the missing propagated route and forces the traffic to the on-premises network correctly.

Answer

A user-defined route for 172.16.0.0/16 with next hop type Internet.

Answer

An NSG allow rule for TCP 172.16.0.0/16.

Answer

A service endpoint for the on-premises network range.

Question 10

A subnet has a NAT gateway attached, but outbound internet traffic from the VMs is still leaving through a network virtual appliance. The subnet's route table includes a user-defined route for 0.0.0.0/0 with the next hop set to Virtual appliance. The business wants internet traffic to use the NAT gateway while keeping any required specific routes to on-premises networks. What should the administrator do?

Accepted Answer

Remove the 0.0.0.0/0 user-defined route and keep only specific routes for private prefixes.. Option B is correct because the user-defined route (UDR) for 0.0.0.0/0 with next hop Virtual appliance is overriding the NAT gateway's default route. NAT gateways require a default route (0.0.0.0/0) with next hop 'Internet' to direct outbound traffic through them. By removing the conflicting UDR and keeping only specific routes for on-premises prefixes, the subnet will use the NAT gateway for internet traffic while maintaining connectivity to on-premises networks via the remaining UDRs.

Answer

Keep the default route and add a second NAT gateway to the subnet.

Answer

Disable network security groups on the subnet so the NAT gateway becomes active.

Answer

Set gateway route propagation to Disabled so the NAT gateway is preferred.

Question 11

A subnet has a route table with a 0.0.0.0/0 user-defined route to an on-premises virtual appliance. The business now wants Azure VM outbound internet traffic to use a NAT gateway so the public source IP stays consistent, and the firewall appliance is no longer required for internet egress. What should the administrator do?

Accepted Answer

Remove the 0.0.0.0/0 UDR and associate the NAT gateway with the subnet.. Option B is correct because removing the 0.0.0.0/0 user-defined route (UDR) that points to the on-premises virtual appliance and associating a NAT gateway with the subnet ensures that all outbound internet traffic from Azure VMs uses the NAT gateway's public IP address. The NAT gateway automatically creates a default route (0.0.0.0/0) with a next hop type of 'Internet' for the subnet, overriding any conflicting UDRs. This provides a consistent source IP for internet egress without requiring the firewall appliance.

Answer

Keep the default route to the virtual appliance and add the NAT gateway to the subnet.

Answer

Change the route next hop to Virtual network gateway.

Answer

Create an NSG outbound rule that allows internet traffic from the subnet.

Question 12

Based on the exhibit, what should the administrator configure so the VM in the spoke VNet can resolve internal hostnames that are hosted on the DNS server in the hub VNet?

The team has already verified that IP connectivity between the spoke VM and the hub VM works.

Accepted Answer

Set the SpokeVNet DNS server list to use 10.40.0.4 so the spoke queries the hub resolver directly.. Option A is correct because setting the SpokeVNet DNS server list to 10.40.0.4 (the IP of the DNS server in the hub VNet) configures the spoke VNet to forward all DNS queries to that custom DNS server. Since IP connectivity between the VNets is already verified, the spoke VM can resolve internal hostnames hosted on the hub DNS server. This is the standard method for cross-VNet DNS resolution when using a custom DNS server in a hub-and-spoke topology.

Answer

Create a private endpoint for web01.corp.contoso.local in the spoke VNet so DNS resolves automatically.

Answer

Enable gateway transit on the peering so the spoke inherits the hub VNet DNS configuration.

Answer

Add inbound and outbound NSG rules allowing UDP and TCP port 53 between the two VNets.

Question 13

Based on the exhibit, why is the administrator's HTTPS test still being denied, and what should be changed?

Accepted Answer

Move Allow-HTTPS-Admin to a priority lower than 200.. The administrator's HTTPS test is denied because Azure Network Security Groups (NSGs) process rules in priority order, from lowest to highest numeric value. The deny rule at priority 200 is evaluated before the allow rule at priority 300, so the HTTPS traffic is blocked. To allow HTTPS traffic, the allow rule must have a lower priority number (e.g., 100) than the deny rule, ensuring it is evaluated first. Option B correctly identifies that moving Allow-HTTPS-Admin to a priority lower than 200 (i.e., a smaller number) will allow the traffic before the deny rule is applied.

Answer

Increase the deny rule priority number from 200 to 300.

Answer

Change Allow-HTTPS-Admin to use protocol Any.

Answer

Assign a public IP address to the VM.

Question 14

Based on the exhibit, what should the administrator create so the storage account is reachable only by private IP from AppSubnet?

Accepted Answer

A private endpoint in AppSubnet for the storage account.. A private endpoint assigns a private IP address from the AppSubnet to the storage account, making it reachable only via private IP within that subnet. This ensures all traffic to the storage account stays within the Microsoft Azure backbone network, eliminating public internet exposure. The private endpoint uses Azure Private Link to map the storage account's PaaS resource to a network interface in the virtual network.

Answer

A service endpoint on AppSubnet for Microsoft.Storage.

Answer

A user-defined route to the storage account public IP.

Answer

An application security group that contains the storage account.

Question 15

A subnet is associated with a NAT gateway, but outbound traffic from the VMs still leaves through a network virtual appliance because the subnet has a user-defined route for 0.0.0.0/0 with next hop type Virtual appliance. The workload must use the NAT gateway for internet-bound traffic while keeping more specific routes intact. What should the administrator change?

Accepted Answer

Remove the 0.0.0.0/0 user-defined route from the subnet route table.. The NAT gateway is designed to provide outbound connectivity for VMs in the subnet, but a user-defined route (UDR) for 0.0.0.0/0 with next hop type Virtual appliance overrides the default route to the NAT gateway. By removing that UDR, the subnet's default route reverts to the system route, which directs internet-bound traffic to the NAT gateway's public IP. More specific routes (e.g., to on-premises networks) remain intact because they are not affected by the removal of the 0.0.0.0/0 route.

Answer

Disable the subnet's network security group so the NAT gateway can take effect.

Answer

Enable gateway route propagation on the route table.

Answer

Attach a public IP address to each virtual machine NIC.