AZ-104 Implement and Manage Virtual Networking Practice Test 9 — 15 Questions

Question 1

A hub-and-spoke environment uses a DNS server VM in the hub VNet at 10.8.0.4 to resolve internal names such as app01.corp.local. The spoke VNet can reach hub VMs by IP after peering, but name resolution still fails from the spoke. What should the administrator configure so VMs in the spoke use the hub DNS server?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the spoke VNet to use 10.8.0.4 as a custom DNS server.. In Azure, a spoke VNet must explicitly be configured with a custom DNS server address to use a non-default DNS resolver. By setting the spoke VNet's DNS server to 10.8.0.4, all VMs in the spoke will send their DNS queries to that hub VM, resolving internal names like app01.corp.local. Without this configuration, the spoke VNet uses Azure-provided DNS, which cannot resolve custom private DNS zones hosted on the hub VM.

Answer

Add an inbound NSG rule on the spoke subnet to allow UDP and TCP 53 to 10.8.0.4.

Answer

Create a service endpoint for Microsoft.Storage on the spoke subnet.

Answer

Add a user-defined route for 10.8.0.4/32 pointing to the virtual network gateway.

Question 2

A security team requires all outbound traffic from a subnet to pass through an Azure Firewall at 10.1.0.4, including internet-bound traffic from the VMs. What should the administrator configure?

Accepted Answer

Create a route table with a 0.0.0.0/0 route to 10.1.0.4 and associate it with the subnet.. Creating a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP (10.1.0.4) and associating it with the subnet forces all outbound traffic, including internet-bound traffic, to be routed through the firewall. This ensures the firewall can inspect and control all egress traffic as required by the security team.

Answer

Assign a NAT gateway to the subnet and leave the default routing in place.

Answer

Enable service endpoints for the subnet so outbound traffic stays private.

Answer

Deploy a public IP on each VM and use NSG rules to inspect the traffic.

Question 3

A subnet is associated with a NAT gateway, but its route table also contains a 0.0.0.0/0 route to a virtual appliance at 10.2.0.4. The business wants all outbound internet traffic from the VMs to use one static public IP, and inspection by the appliance is no longer required. What should the administrator change?

Accepted Answer

Remove the 0.0.0.0/0 user-defined route from the subnet.. Removing the 0.0.0.0/0 user-defined route (UDR) from the subnet's route table will allow the NAT gateway to handle all outbound internet traffic. The NAT gateway provides a single static public IP for outbound traffic, and since inspection by the virtual appliance is no longer required, the conflicting UDR that directs traffic to the appliance must be deleted. This ensures that the subnet's default route points to the NAT gateway, which uses Source Network Address Translation (SNAT) to translate private IPs to the static public IP.

Answer

Add a public IP address directly to each virtual machine NIC.

Answer

Enable service endpoints for the subnet.

Answer

Change the NAT gateway to a zone-redundant SKU.

Question 4

An application subnet has a network security group with these inbound rules: Allow-Web-From-Internet at priority 200, Allow-App-From-Web at priority 300, and Deny-All-Inbound at priority 250. The web tier must reach the app tier on TCP 8080, but traffic is being denied. The administrator confirms the source and destination IPs are correct. What is the best fix?

Accepted Answer

Change the Allow-App-From-Web rule to a lower priority number than 250.. The Deny-All-Inbound rule at priority 250 is evaluated before the Allow-App-From-Web rule at priority 300 because lower priority numbers are processed first. To allow web-to-app traffic on TCP 8080, the Allow-App-From-Web rule must have a lower priority number (e.g., 240) than the Deny-All-Inbound rule so it is evaluated and applied first, permitting the traffic before the deny rule blocks it.

Answer

Delete the Deny-All-Inbound rule because default NSG rules will allow the traffic.

Answer

Add a route table entry for TCP 8080 traffic to bypass the NSG.

Answer

Move the Allow-Web-From-Internet rule to priority 400.

Question 5

A web tier and an app tier run in separate subnets. Each VM NIC is placed in an application security group named WebASG or AppASG. The administrator must allow only the web tier to reach the app tier on TCP port 8443 and block all other inbound traffic to the app tier. Which NSG rule should be created on the app subnet?

Accepted Answer

Allow TCP 8443 from WebASG to AppASG with a priority lower number than the deny rule.. NSG rules are evaluated in priority order, with lower numbers having higher priority. By placing an Allow rule for TCP 8443 from WebASG to AppASG with a lower priority number than a subsequent Deny-All rule, only traffic from the web tier is permitted, and all other inbound traffic to the app subnet is blocked. This leverages application security groups (ASGs) to define fine-grained, role-based network security policies without relying on IP addresses.

Answer

Allow TCP 8443 from the entire virtual network to the app subnet with a lower priority than the deny rule.

Answer

Allow UDP 8443 from WebASG to AppASG with any priority below 65000.

Answer

Allow TCP 8443 from WebASG to AppASG with a priority higher number than the deny rule.

Question 6

An on-premises application connected through a site-to-site VPN must read data from an Azure Storage account. Public network access is disabled on the storage account, and the storage service must be reachable only by a private IP address inside Azure. Which solution should the administrator implement?

Accepted Answer

Create a private endpoint for the storage account in an Azure VNet.. A private endpoint assigns the storage account a private IP address from an Azure VNet, allowing the on-premises application to connect over the site-to-site VPN using that private IP. This ensures the storage service is reachable only within Azure's private network, even with public network access disabled. The private endpoint uses Azure Private Link to securely expose the storage account into the VNet, making it accessible via the VPN without traversing the public internet.

Answer

Enable a service endpoint on the on-premises network.

Answer

Peer the on-premises network directly to the storage account.

Answer

Use a shared access signature and leave public network access enabled.

Question 7

Based on the exhibit, which Azure connectivity option should the administrator use for the branch office?

Accepted Answer

A site-to-site VPN connection to an Azure VPN gateway.. A site-to-site VPN connection to an Azure VPN gateway (Option D) is the correct choice because it provides a persistent, encrypted tunnel between the branch office's on-premises network and Azure, enabling seamless connectivity for all users and devices at the branch without requiring per-user configuration. This aligns with the typical scenario where a branch office needs constant, secure access to Azure resources, and the VPN gateway supports IPsec/IKE protocols for site-to-site connections.

Answer

Point-to-site VPN for each user laptop.

Answer

VNet peering between the branch office and Azure.

Answer

A service endpoint on the Azure subnet.

Question 8

A three-tier application uses separate web and app VMs that are scaled in and out regularly. The administrator must allow only the web tier to connect to the app tier on TCP 8080 without continually updating IP addresses. What should be configured in the NSG rule?

Accepted Answer

Use application security groups for the web and app tiers and reference those groups in the NSG rule.. Application security groups (ASGs) allow you to group VMs logically by their application role (e.g., web tier, app tier) and reference those groups directly in NSG rules. This eliminates the need to maintain individual IP addresses or CIDR ranges when VMs scale in or out, because the NSG rule dynamically applies to all VMs in the ASG. By creating an inbound NSG rule that allows TCP 8080 from the web-tier ASG to the app-tier ASG, the administrator achieves the required connectivity without manual IP updates.

Answer

Add a subnet-to-subnet peering connection between the web and app subnets.

Answer

Create a load balancer backend pool rule for TCP 8080.

Answer

Use a user-defined route that sends TCP 8080 traffic to the app tier.

Question 9

Based on the exhibit, what should the administrator do so the hub and spoke can be peered successfully?

Accepted Answer

Change the spoke VNet to a non-overlapping address space.. VNet peering requires that the address spaces of the peered VNets do not overlap. Overlapping IP ranges cause routing conflicts and prevent successful peering. Changing the spoke VNet to a non-overlapping address space resolves this issue and allows the peering to be established.

Answer

Keep the current ranges and enable gateway transit on the peering.

Answer

Add another subnet inside the spoke VNet and reuse the current address space.

Answer

Create a network security group on the spoke subnet before peering.

Question 10

A web tier and an app tier run on separate Azure VMs in the same region. Each VM's NIC is added to an application security group named WebASG or AppASG. The administrator must allow only the web tier to connect to the app tier on TCP 8443, and future VM scale-outs must be included automatically. Which NSG rule should be created?

Accepted Answer

An inbound rule with source WebASG, destination AppASG, protocol TCP, and destination port 8443.. Application security groups (ASGs) allow you to configure network security as a natural extension of an application's structure, enabling you to group VMs by their roles (e.g., web tier, app tier) and define rules based on those groups. By creating an inbound NSG rule with source WebASG and destination AppASG on TCP port 8443, any VM added to WebASG can initiate traffic to any VM in AppASG, and future scale-outs are automatically included without manual IP updates. This approach is dynamic, scalable, and aligns with the requirement for automatic inclusion of new VMs.

Answer

An inbound rule that uses the current web VM's private IP as the source and the current app VM's private IP as the destination.

Answer

A route table that sends TCP 8443 traffic from the web subnet to the app subnet.

Answer

An Azure Firewall application rule collection that permits all traffic between the two subnets.

Question 11

An administrator is troubleshooting inbound HTTPS to a VM. The subnet NSG has these custom rules: Deny-Internet-Inbound at priority 150, Allow-HTTPS-Admin at priority 200, and the default deny rules remain in place. The administrator’s client is on the internet and should be able to reach the VM on TCP 443. What change will fix the problem?

Accepted Answer

Move the allow rule to a lower priority number than the deny rule.. Network Security Group (NSG) rules are evaluated in priority order, with lower numbers evaluated first. The Deny-Internet-Inbound rule at priority 150 is evaluated before the Allow-HTTPS-Admin rule at priority 200, so the deny rule blocks the inbound HTTPS traffic before the allow rule can be processed. Moving the allow rule to a lower priority number (e.g., 140) ensures it is evaluated first, permitting the traffic from the internet on TCP 443.

Answer

Change the allow rule source from Internet to Any and keep the same priority.

Answer

Create a route table to the VM subnet so traffic reaches the VM faster.

Answer

Associate an application security group with the VM and leave the rules unchanged.

Question 12

After a private endpoint for an Azure Blob Storage account is created, VMs in the same VNet still resolve the storage name to the public IP address. The administrator wants the name to resolve to the private endpoint address instead. What should be configured?

Accepted Answer

Link the private DNS zone for blob storage to the virtual network.. When a private endpoint is created for Azure Blob Storage, the private DNS zone (privatelink.blob.core.windows.net) must be linked to the virtual network to enable automatic resolution of the storage account's FQDN to the private endpoint's private IP address. Without this link, VMs in the VNet continue to use public DNS resolution, which returns the public IP. Linking the private DNS zone to the VNet ensures that DNS queries from VMs resolve to the private endpoint address via Azure's DNS infrastructure.

Answer

Create a route table that sends storage traffic to the private endpoint subnet.

Answer

Enable a service endpoint on the subnet that hosts the VMs.

Answer

Assign a public IP address to the private endpoint subnet.

Question 13

A company has a virtual machine in a subnet that must access an Azure Storage account. The storage account should remain reachable through its public endpoint, but access must be limited to that subnet, and the traffic should stay on the Azure backbone rather than the internet. Which feature should the administrator configure on the subnet?

Accepted Answer

A service endpoint for Microsoft.Storage.. A service endpoint for Microsoft.Storage extends the virtual network identity to the storage account, allowing traffic from the subnet to the storage account's public endpoint to be routed over the Azure backbone network rather than the internet. This satisfies the requirement to limit access to the subnet while keeping the public endpoint reachable and traffic within Azure's infrastructure.

Answer

A private endpoint for the storage account.

Answer

A site-to-site VPN connection to the storage account.

Answer

An application security group assigned to the storage account.

Question 14

A spoke VM can connect to a hub VM by IP address after peering is configured, but it cannot resolve internal host names such as app01.corp.local. The hub has a DNS server at 10.50.1.4 that hosts those records. What should the administrator configure so the spoke VMs use that DNS server?

Accepted Answer

Set the spoke VNet's custom DNS server to 10.50.1.4.. The spoke VNet must be configured to use a custom DNS server to override Azure's default internal name resolution. By setting the spoke VNet's DNS server to 10.50.1.4, all VMs in the spoke will query that server for hostname resolution, including app01.corp.local. This is a VNet-level setting that applies to all VMs in the spoke, and it does not require any changes to NSGs or peering configurations.

Answer

Add an NSG rule allowing UDP and TCP port 53 between the VNets.

Answer

Create a private endpoint for the hub DNS server.

Answer

Enable remote gateways on the spoke peering.

Question 15

An NSG attached to a subnet contains these inbound rules: Deny-All-Inbound at priority 200, Allow-HTTPS-Admin at priority 250 from 203.0.113.20/32, and Allow-HTTPS-Internet at priority 300. A VM in the subnet cannot receive HTTPS from the admin workstation even though the source IP is correct. What should the administrator change?

Accepted Answer

Move the Allow-HTTPS-Admin rule to a priority number lower than 200.. The Deny-All-Inbound rule at priority 200 blocks all traffic, including HTTPS from the admin workstation, because NSG rules are evaluated in priority order (lowest number first). The Allow-HTTPS-Admin rule at priority 250 is never reached since the deny rule with a higher priority (lower number) matches first. To allow the admin traffic, the allow rule must have a priority lower than 200 (e.g., 150) so it is evaluated before the deny rule.

Answer

Change the protocol from TCP to Any on the allow rule.

Answer

Associate a NAT gateway with the subnet.

Answer

Enable service endpoint policies on the subnet.