AZ-104 Implement and Manage Virtual Networking Practice Test 8 — 15 Questions

Question 1

A workload subnet must send all outbound internet traffic through a network virtual appliance at 10.4.2.4. What should the administrator configure?

Accepted Answer

A route table with a user-defined route sending 0.0.0.0/0 to 10.4.2.4.. A user-defined route (UDR) with a destination of 0.0.0.0/0 and a next hop of Virtual Appliance (10.4.2.4) overrides the default system route for internet traffic, forcing all outbound traffic from the subnet to be forwarded to the network virtual appliance (NVA) for inspection or NAT. This is the standard method to implement forced tunneling or centralized internet egress in Azure.

Answer

An NSG rule that allows outbound traffic to 10.4.2.4.

Answer

A private DNS zone for the subnet.

Answer

A service endpoint for the virtual network.

Question 2

A branch office uses an on-premises firewall that supports IPsec/IKE and has a stable public IP. The office needs always-on private connectivity to an Azure VNet over the internet. Which Azure component should the administrator deploy?

Accepted Answer

A site-to-site connection using Azure VPN Gateway.. A site-to-site VPN connection using Azure VPN Gateway is the correct choice because it provides always-on, encrypted connectivity over the internet between an on-premises network with a stable public IP and an Azure VNet. Azure VPN Gateway supports IPsec/IKE protocols, which are compatible with the branch office's firewall, enabling a secure tunnel that meets the requirement for private connectivity.

Answer

VNet peering between the branch office and the Azure VNet.

Answer

Azure Bastion in the target VNet.

Answer

A private endpoint for the Azure VNet.

Question 3

A subnet has an NSG with a custom inbound deny-all rule at priority 200. You need to allow HTTPS traffic to a VM in that subnet from any source. Which action should you take?

Accepted Answer

Create an inbound allow rule for TCP 443 with priority 100.. NSG rules are evaluated in priority order, with lower numbers evaluated first. The existing deny-all rule at priority 200 blocks all inbound traffic. To allow HTTPS (TCP 443) before the deny rule is evaluated, you must create an allow rule with a priority lower than 200, such as priority 100. This ensures the allow rule is processed first, permitting the traffic.

Answer

Create an inbound allow rule for TCP 443 with priority 300.

Answer

Change the deny-all rule to outbound instead of inbound.

Answer

Add a route table entry for port 443 traffic to the VM subnet.

Question 4

A payroll application in a VNet must access an Azure Storage account containing confidential blobs. The security team requires the storage account to be reachable only over a private IP, and public network access must be disabled. Which feature should the administrator implement?

Accepted Answer

A private endpoint for the storage account in the VNet.. A private endpoint assigns the storage account a private IP address from the VNet, enabling secure access over a private connection while completely disabling public network access. This meets the security team's requirement because traffic never traverses the public internet, and the storage account's firewall can be configured to deny all public traffic.

Answer

A service endpoint for Microsoft.Storage on the application subnet.

Answer

A shared access signature embedded in the application configuration.

Answer

A VPN gateway connection between the subnet and the storage account.

Question 5

A team deployed a private endpoint for an Azure Storage account in VNet-A. The private endpoint is healthy, but VMs in VNet-A still resolve the storage account name to the public IP address. What should the administrator configure next?

Accepted Answer

Link the appropriate private DNS zone to VNet-A.. When a private endpoint is deployed, the storage account's FQDN must resolve to the private IP address within the virtual network. By default, Azure Private DNS zones (privatelink.blob.core.windows.net) are not automatically linked to the virtual network. Linking the private DNS zone to VNet-A enables DNS resolution of the storage account name to the private endpoint's IP address instead of the public IP.

Answer

Add a route table that sends storage traffic to the private endpoint.

Answer

Create a network security group rule that allows outbound HTTPS.

Answer

Enable service endpoints for Microsoft.Storage on the subnet.

Question 6

A company wants to peer two Azure virtual networks so that workloads can communicate privately. VNet-A uses 10.10.0.0/16. VNet-B is being designed now. Which address space should be chosen for VNet-B?

Accepted Answer

10.11.0.0/16, because it does not overlap and is still within a private IPv4 range.. VNet peering requires non-overlapping address spaces to enable direct private IP connectivity between resources. 10.11.0.0/16 is a unique private IPv4 range (RFC 1918) that does not overlap with VNet-A's 10.10.0.0/16, ensuring successful peering without routing conflicts.

Answer

10.10.5.0/24, because it is a smaller subnet inside the same private range.

Answer

10.10.0.0/24, because peering automatically separates overlapping subnets.

Answer

192.168.1.0/24, because peered networks must always use the 192.168.x.x range.

Question 7

Two application VNets are deployed in different Azure regions. Each VNet uses a unique, non-overlapping address space. The application teams want private IP connectivity over the Microsoft backbone with the lowest possible latency between the regions. Which design should the administrator choose?

Accepted Answer

Global VNet peering.. Global VNet peering provides direct, private IP connectivity between two VNets in different Azure regions over the Microsoft backbone, ensuring the lowest possible latency by bypassing the public internet and any intermediate gateways. It uses the Azure infrastructure to route traffic efficiently between the peered VNets, meeting the requirement for private, low-latency communication.

Answer

A site-to-site VPN between the two VNets.

Answer

Azure Traffic Manager with two public endpoints.

Answer

A service endpoint for each application subnet.

Question 8

A public web application runs on two Windows Server VMs in Azure. Users connect through a single public IP on TCP 443, and the solution must distribute traffic only to healthy VMs without requiring Layer 7 features such as URL-based routing. Which Azure service should the administrator deploy?

Accepted Answer

Azure Load Balancer Standard.. Azure Load Balancer Standard is the correct choice because it operates at Layer 4 (TCP/UDP) and distributes incoming traffic across healthy VM instances based on a single public IP address and port (TCP 443). It performs health probes to ensure traffic is only sent to healthy backend VMs, and it does not require any Layer 7 features like URL-based routing, making it ideal for this scenario.

Answer

Azure Application Gateway.

Answer

Azure Traffic Manager.

Answer

Azure Front Door.

Question 9

A company has a hub virtual network that contains a custom DNS server at 10.20.0.4. A new spoke virtual network is peered to the hub. VMs in the spoke can reach other resources in Azure, but they cannot resolve internal names such as app01.corp.local. What should the administrator configure to fix name resolution for the spoke VMs?

Accepted Answer

Set the spoke virtual network's custom DNS server to 10.20.0.4.. The spoke virtual network must be configured to use the hub's custom DNS server (10.20.0.4) as its own DNS server. Azure virtual networks do not automatically inherit DNS settings from a peered hub; each virtual network must explicitly specify its DNS server. By setting the spoke's custom DNS server to 10.20.0.4, VMs in the spoke will send DNS queries to that server, enabling resolution of internal names like app01.corp.local.

Answer

Add a user-defined route that sends DNS traffic to the hub virtual network.

Answer

Create an NSG rule that allows UDP port 53 from the spoke subnet to the hub subnet.

Answer

Enable gateway transit on the hub peering so name resolution flows through the VPN gateway.

Question 10

An on-premises application connects to Azure through an existing site-to-site VPN. The application must access an Azure Storage account, public network access on the storage account is disabled, and the company does not want the storage account exposed through a public endpoint. Which solution should the administrator implement?

Accepted Answer

Create a private endpoint for the storage account in a VNet reachable over the VPN and configure private DNS.. A private endpoint assigns the storage account a private IP from a VNet that is reachable over the site-to-site VPN, effectively bringing the storage account into the on-premises network without exposing a public endpoint. Private DNS zones ensure that the storage account's FQDN resolves to the private IP, enabling seamless connectivity from on-premises while public network access remains disabled.

Answer

Enable a service endpoint on the on-premises network and allow the storage account firewall to trust it.

Answer

Generate a shared access signature and use it from the on-premises application.

Answer

Associate a NAT gateway with the on-premises VPN connection.

Question 11

A hub VNet has a VPN gateway connected to on-premises networks. A new spoke VNet must reach on-premises resources through the existing hub gateway without deploying another gateway. What peering configuration should the administrator use?

Accepted Answer

Enable gateway transit on the hub peering and use remote gateways on the spoke peering.. It enables the hub VNet's VPN gateway to be shared with the spoke VNet without deploying a separate gateway. 'Gateway transit' on the hub peering allows the hub to advertise routes from its VPN gateway to the spoke, while 'Use remote gateways' on the spoke peering allows the spoke to use the hub's gateway for outbound traffic to on-premises. This configuration ensures the spoke can reach on-premises resources through the hub's VPN tunnel.

Answer

Enable forwarded traffic on both peerings and create a route table in the spoke.

Answer

Deploy a private endpoint in the spoke for each on-premises subnet.

Answer

Create a service endpoint on the spoke subnet for Microsoft.Network.

Question 12

An application in a subnet must access an Azure Storage account over a private IP. The storage account must not be reachable through its public endpoint, and access should be limited to that subnet only. Which configuration should the administrator implement?

Accepted Answer

Create a private endpoint in the subnet and disable public network access on the storage account.. A private endpoint assigns a private IP from the subnet to the storage account, effectively bringing the service into the virtual network. Disabling public network access ensures the storage account is only reachable via that private endpoint, meeting the requirement to block public endpoint access and limit access to the specific subnet.

Answer

Create a service endpoint for Microsoft.Storage on the subnet and keep the public endpoint enabled.

Answer

Use a shared access signature token and leave network settings unchanged.

Answer

Associate the storage account with a NAT gateway to control inbound access.

Question 13

A web workload in a subnet must use a NAT gateway for outbound internet traffic so the source IP is stable. The subnet currently has a route table with a 0.0.0.0/0 user-defined route to a virtual appliance. What should the administrator change?

Accepted Answer

Remove or replace the 0.0.0.0/0 UDR to the virtual appliance and associate the NAT gateway with the subnet.. The current route table has a 0.0.0.0/0 user-defined route (UDR) pointing to a virtual appliance, which forces all outbound traffic through that appliance. To use a NAT gateway for outbound internet traffic with a stable source IP, the administrator must remove or replace that UDR (so the default route no longer points to the appliance) and associate the NAT gateway with the subnet. The NAT gateway automatically creates a default route (0.0.0.0/0) with a next hop of 'Internet', overriding the appliance route, ensuring traffic egresses via the NAT gateway's public IP.

Answer

Add an NSG outbound allow rule for TCP 80 and TCP 443.

Answer

Create a private endpoint for the web workload.

Answer

Enable VNet peering to a hub network with a firewall.

Question 14

An organization has an Azure Storage account that must be reachable from Azure VMs and from an on-premises application. Internet access to the storage account must be disabled, and the service should be accessible only over private IP paths. Which solution best meets the requirement?

Accepted Answer

Use a private endpoint for the storage account and connect on-premises through a site-to-site VPN or ExpressRoute path.. A private endpoint assigns the storage account a private IP address from the Azure VNet, making it accessible over a private IP path. On-premises connectivity is achieved via a site-to-site VPN or ExpressRoute, which extends the private network. This configuration disables internet access by blocking the public endpoint, meeting the requirement to disable internet access.

Answer

Enable a service endpoint on the Azure VNet and keep the storage account public endpoint enabled.

Answer

Use VNet peering only and leave the storage account firewall open to selected public IPs.

Answer

Assign a public IP address to the storage account and restrict access with an NSG.

Question 15

A company created a new spoke virtual network with the address space 10.40.1.0/24. The existing hub virtual network already uses 10.40.0.0/16. The administrator must peer the two VNets so resources can communicate normally. What must be changed before peering can succeed?

Accepted Answer

Change the spoke VNet address space to a range that does not overlap the hub.. Azure Virtual Network peering requires that the address spaces of the peered VNets do not overlap. The hub VNet uses 10.40.0.0/16, which includes the spoke's 10.40.1.0/24 range. Overlapping address spaces prevent successful peering because Azure cannot route traffic correctly between overlapping IP ranges. Therefore, the spoke VNet address space must be changed to a non-overlapping range before peering can succeed.

Answer

Create a route table on the spoke subnet before adding the peering.

Answer

Enable gateway transit on the hub peering to permit overlapping spaces.

Answer

Add an NSG rule that allows traffic between the hub and spoke address spaces.