AZ-104 Implement and Manage Virtual Networking Practice Test 9 — 15 Questions

Question 1

A subnet NSG contains these inbound rules: Deny-All-Inbound at priority 300, Allow-HTTPS-From-Bastion at priority 200, and Allow-HTTPS-From-AdminIP at priority 350. An administrator expects a management workstation on the internet to connect to a VM over TCP 443, but the connection is blocked. What is the most likely reason?

Accepted Answer

The deny rule at priority 300 is matched before the allow rule at priority 350.. NSG rules are evaluated in priority order, from the lowest priority number (highest priority) to the highest priority number (lowest priority). The Allow-HTTPS-From-AdminIP rule at priority 350 is evaluated after the Deny-All-Inbound rule at priority 300. Since the deny rule at priority 300 matches all inbound traffic before the allow rule at priority 350 is evaluated, the traffic is blocked. The administrator's connection from the internet is denied because the deny rule with a lower priority number (300) takes precedence over the allow rule with a higher priority number (350).

Answer

NSG rules are evaluated from the highest priority number to the lowest priority number.

Answer

Azure NSGs cannot allow inbound traffic from public IP addresses.

Answer

TCP 443 requires an application security group to be used as the source.

Question 2

Based on the exhibit, VM name resolution works for IP addresses but fails for internal hostnames. What should the administrator configure on the spoke VNet?

Accepted Answer

Configure the spoke VNet to use 10.20.0.4 as a custom DNS server.. The hub VNet uses a custom DNS server at 10.20.0.4 (likely a Windows Server with DNS role) that can resolve internal hostnames like app01.corp.local. The spoke VNet is currently using Azure-provided DNS, which cannot resolve custom private DNS zones. By configuring the spoke VNet to use 10.20.0.4 as a custom DNS server, the spoke VMs will forward DNS queries to the hub DNS server, enabling hostname resolution for internal resources.

Answer

Keep Azure-provided DNS because the spoke can already reach the hub by IP.

Answer

Create a private endpoint for app01.corp.local in the spoke VNet.

Answer

Enable a NAT gateway on the spoke subnet.

Question 3

A company has a hub virtual network with a DNS server VM at 10.50.0.4 that hosts internal names such as app01.corp.local. A spoke virtual network is already peered to the hub. VMs in the spoke can reach resources in the hub by IP address, but they cannot resolve the internal host names. The company wants to keep DNS centralized and avoid deploying another DNS server in the spoke. What should the administrator configure?

Accepted Answer

Set the spoke virtual network to use 10.50.0.4 as a custom DNS server.. Option B is correct because the spoke virtual network must be configured to use the hub DNS server (10.50.0.4) as a custom DNS server. This ensures that all VMs in the spoke send DNS queries to the hub server, which hosts the internal zone for corp.local. Since the hub and spoke are already peered, DNS traffic can flow over the peering connection without additional routing, keeping DNS centralized.

Answer

Create a private DNS zone for corp.local and link it only to the spoke subnet.

Answer

Add a user-defined route in the spoke to send DNS traffic to the hub VNet.

Answer

Enable gateway transit on the peering and set use remote gateways on the spoke.

Question 4

A branch office with a fixed public IP needs encrypted access to private Azure virtual machines and internal services in a VNet. Traffic must travel across the public internet in an encrypted tunnel, and the connection should use a route-based design. What should the administrator deploy in Azure?

Accepted Answer

A VPN gateway with a site-to-site connection.. A VPN gateway with a site-to-site connection is the correct choice because it establishes an encrypted IPSec tunnel over the public internet between the branch office's fixed public IP and Azure, using a route-based (IKEv2) configuration. This allows the branch office to securely access private Azure VMs and internal services in the VNet, meeting the requirement for encrypted traffic across the internet.

Answer

An Azure Virtual Network peering connection to the branch office network.

Answer

A service endpoint on the target subnet.

Answer

An Azure private endpoint for the virtual machines.

Question 5

Based on the exhibit, what is the best change so the VNet peering can be created successfully?

Accepted Answer

Change VNet-B to a non-overlapping address space, such as 10.1.0.0/24.. VNet peering requires that the address spaces of the two virtual networks do not overlap. If VNet-A uses 10.0.0.0/16 and VNet-B also uses 10.0.0.0/16, they conflict, preventing peering. Changing VNet-B to a non-overlapping address space like 10.1.0.0/24 resolves this conflict, allowing the peering to be established.

Answer

Add a route table to VNet-B before creating the peering.

Answer

Enable gateway transit on VNet-A.

Answer

Resize VNet-A to 10.0.0.0/15 so both VNets fit.

Question 6

An application in AppSubnet must access an Azure Storage account over the public endpoint, but only traffic from that subnet should be allowed, and the traffic should stay on the Microsoft backbone. The administrator does not want to create a private IP for the service. Which two actions should be taken? Select two.

Accepted Answer

Enable a service endpoint for Microsoft.Storage on AppSubnet.. Enabling a service endpoint for Microsoft.Storage on AppSubnet (Option A) allows traffic from that subnet to reach the Azure Storage account over the Microsoft backbone, bypassing the public internet. This satisfies the requirement that traffic stays on the Microsoft backbone without needing a private IP for the service.

Answer

Create a private endpoint in AppSubnet.

Answer

Disable public network access on the storage account.

Answer

Assign a public IP address to the storage account.

Question 7

A team manages 20 web VMs and 15 app VMs that scale independently. The administrator needs an NSG rule that allows only the web tier to reach the app tier on TCP 8443, and future VM additions must be included automatically without editing IP addresses. What should the administrator use in the NSG rule?

Accepted Answer

A source application security group for the web tier and a destination application security group for the app tier.. Application security groups (ASGs) allow you to define network security rules based on logical groupings of VMs, regardless of their IP addresses. By assigning the web tier VMs to a source ASG and the app tier VMs to a destination ASG, the NSG rule automatically includes any new VMs added to those groups, meeting the requirement for dynamic inclusion without manual IP edits.

Answer

A service endpoint on the subnet where the app VMs are deployed.

Answer

A user-defined route between the web subnet and app subnet.

Answer

A load balancer backend pool for both tiers.

Question 8

An administrator creates a new spoke virtual network with address space 10.100.1.0/24 and tries to peer it to an existing hub virtual network that already uses 10.100.0.0/16. The peering fails. The business wants private connectivity between the hub and spoke. What action should the administrator take first?

Accepted Answer

Change the spoke VNet to a non-overlapping address range before attempting peering again.. VNet peering requires that the address spaces of the peered virtual networks do not overlap. The hub already uses 10.100.0.0/16, which includes the spoke's 10.100.1.0/24 range, causing a conflict. Changing the spoke to a non-overlapping address range, such as 10.200.1.0/24, resolves this and allows the peering to succeed.

Answer

Add a route table to the spoke and point the default route to the hub.

Answer

Enable gateway transit on the hub and use the remote gateway from the spoke.

Answer

Deploy a private DNS zone and link it to both VNets.

Question 9

Based on the exhibit, what should the administrator create so VMs in AppSubnet can access the storage account over a private IP address?

Accepted Answer

A private endpoint for the storage account in AppSubnet.. A private endpoint assigns a private IP address from AppSubnet to the storage account, enabling VMs in that subnet to access the storage account over a private IP within the VNet. This eliminates exposure to the public internet and uses Azure Private Link for secure, direct connectivity.

Answer

A service endpoint for Microsoft.Storage on AppSubnet.

Answer

A site-to-site VPN gateway between AppVNet and the storage account.

Answer

An application security group for the storage account and subnet.

Question 10

A subnet has a user-defined route for 0.0.0.0/0 that sends all outbound traffic to a network virtual appliance for inspection. The business now attaches a NAT gateway to the subnet and wants internet-bound traffic to use the NAT gateway's public IP, while traffic to private corporate prefixes should still go to the appliance. What should the administrator change?

Accepted Answer

Remove the 0.0.0.0/0 UDR and add only the specific private-prefix routes that must go to the appliance.. The 0.0.0.0/0 user-defined route (UDR) sends all outbound traffic to the network virtual appliance (NVA). A NAT gateway provides outbound connectivity with a public IP, but it only takes effect when there is no explicit 0.0.0.0/0 route overriding it. By removing the 0.0.0.0/0 UDR and adding only specific private-prefix routes (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) pointing to the NVA, internet-bound traffic will use the NAT gateway (via its default route), while corporate traffic is still forced through the appliance.

Answer

Leave the route table unchanged because the NAT gateway always overrides a default UDR.

Answer

Disable source NAT on the network virtual appliance.

Answer

Create a private endpoint for internet traffic so outbound packets stay in Azure.

Question 11

A development team runs Windows and Linux VMs in a single Azure subnet. The VMs must access an Azure Storage account, and the security team wants to restrict the storage account so only that subnet can reach it. The team does not want to create a private IP for the storage account or change DNS records. What should the administrator configure?

Accepted Answer

A service endpoint on the subnet and a storage account network rule allowing that subnet.. Option B is correct because a service endpoint extends the subnet's identity to the storage account, allowing the storage firewall to accept traffic from that subnet without assigning a private IP. This meets the security requirement of restricting access to only that subnet while avoiding private IPs or DNS changes.

Answer

A private endpoint for the storage account and a private DNS zone.

Answer

A site-to-site VPN between the subnet and the storage account.

Answer

A user-defined route that sends storage traffic to the default internet next hop.

Question 12

A company has a hub VNet and two peered spoke VNets, AppSpoke and DataSpoke. Both spokes can reach on-premises networks through the hub gateway. The app VM in AppSpoke must connect privately to the data VM in DataSpoke without using the internet or sending traffic on-premises first. What should the administrator do?

Accepted Answer

Create a direct VNet peering between AppSpoke and DataSpoke.. Option C is correct because a direct VNet peering between AppSpoke and DataSpoke establishes a private, low-latency connection between the two VNets without routing traffic through the hub gateway or on-premises networks. This satisfies the requirement for a private connection that does not use the internet or traverse on-premises, as VNet peering uses the Microsoft backbone infrastructure.

Answer

Add an NSG rule that allows traffic from AppSpoke to DataSpoke.

Answer

Enable gateway transit on both spoke peerings.

Answer

Add a user-defined route in AppSpoke pointing DataSpoke traffic to the hub gateway.

Question 13

A storage account must be reachable only from resources in one Azure subnet, and traffic must use a private IP rather than the public endpoint. Which configuration should the administrator implement?

Accepted Answer

A private endpoint in the subnet. A private endpoint assigns a private IP address from the subnet to the storage account, making it accessible only via that private IP within the virtual network. This ensures traffic never traverses the public endpoint, meeting both the reachability and private IP requirements.

Answer

A service endpoint on the subnet

Answer

A shared access signature scoped to the subnet

Answer

Allow trusted Microsoft services on the storage firewall

Question 14

Remote administrators work from home laptops and need secure access to Azure VMs in a virtual network. There is no branch office device to configure, and each administrator should connect individually using Azure-side VPN authentication. Which option should be implemented?

Accepted Answer

A point-to-site VPN connection to an Azure VPN gateway.. A point-to-site (P2S) VPN connection allows individual remote clients to connect securely to an Azure virtual network using an Azure VPN gateway. This solution requires no on-premises device, supports per-user authentication (e.g., Azure AD, certificate, or RADIUS), and is ideal for ad-hoc remote access from home laptops.

Answer

VNet peering between the administrators' home networks and Azure.

Answer

An ExpressRoute circuit from each administrator's home internet connection.

Answer

A service endpoint enabled on the VM subnet.

Question 15

Based on the exhibit, what configuration should the administrator change so VMs in the spoke can resolve internal names from the hub?

Accepted Answer

Set the spoke VNet custom DNS server to 10.50.0.4.. The hub VNet has a DNS server at 10.50.0.4 that is configured to resolve internal names. By setting the spoke VNet's custom DNS server to 10.50.0.4, VMs in the spoke will forward DNS queries to that server, enabling resolution of internal names from the hub. This overrides the default Azure-provided DNS and directs name resolution to the hub's DNS infrastructure.

Answer

Add a route table entry that points to the hub DNS server.

Answer

Enable a service endpoint for Microsoft.Storage on the spoke subnet.

Answer

Create a private endpoint for the spoke VM subnet.