AZ-104 Implement and Manage Virtual Networking Practice Question
Exhibit
Hub VNet: - DNS server VM: 10.50.0.4 Spoke VNet: - Default DNS setting: Azure-provided Observed behavior: - VM in spoke can ping hub VM by IP address - nslookup app01.corp.local returns NXDOMAIN
Based on the exhibit, what configuration should the administrator change so VMs in the spoke can resolve internal names from the hub?
⚠ Common exam trap
Watch out — candidates often confuse network routing (route tables) with DNS resolution; candidates often think adding a route to the hub DNS server's IP will fix name resolution, but DNS queries are sent to the configured DNS server address, not routed based on destination IP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the spoke VNet custom DNS server to 10.50.0.4.
The hub VNet has a DNS server at 10.50.0.4 that is configured to resolve internal names. By setting the spoke VNet's custom DNS server to 10.50.0.4, VMs in the spoke will forward DNS queries to that server, enabling resolution of internal names from the hub. This overrides the default Azure-provided DNS and directs name resolution to the hub's DNS infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a route table entry that points to the hub DNS server.
Why it's wrong here
Route tables control the next hop for packets based on destination IP addresses, but they do not override the DNS server configured on a VM. DNS queries are generated by the VM's resolver and sent to the DNS server specified in the VNet DHCP options; a route table entry cannot change that setting. Adding a route to 10.50.0.4 would only be relevant if traffic to that IP needed a specific next hop, which is not the problem here.
When this WOULD be correct
If the question were about enabling network traffic to reach a custom DNS server located in the hub, and the spoke VMs already had the correct DNS server configured, then adding a route table entry to direct DNS query traffic to that server would be correct.
- ✓
Set the spoke VNet custom DNS server to 10.50.0.4.
Why this is correct
The spoke is still using Azure-provided DNS, which cannot resolve the hub's internal records. Pointing the spoke VNet to the hub DNS server lets its VMs query the same internal namespace and resolve names correctly.
- ✗
Enable a service endpoint for Microsoft.Storage on the spoke subnet.
Why it's wrong here
A service endpoint for Microsoft.Storage secures and optimizes traffic from the spoke subnet directly to Azure Storage, but it does not alter the VNet's DNS configuration or the resolution of internal host names. The core issue is that spoke VMs are using Azure-provided DNS and cannot resolve the hub's internal namespace. Enabling this endpoint only affects how storage traffic is routed, not which DNS server VMs query.
When this WOULD be correct
This option would be correct if the question asked how to securely access Azure Storage accounts from the spoke VNet without using public IP addresses, by routing traffic through the Azure backbone.
- ✗
Create a private endpoint for the spoke VM subnet.
Why it's wrong here
A private endpoint assigns a private IP to a managed PaaS service (such as Storage or SQL) and integrates with DNS zones for that specific service; it does not act as a general-purpose DNS resolver for VM host names. The spoke VMs are failing to resolve names of hub VMs, which is a general DNS issue, not a connectivity issue to a PaaS instance. Creating a private endpoint on the spoke subnet would not modify the DNS server that the VMs use for name resolution.
When this WOULD be correct
This option would be correct in a scenario where the question asks how to securely connect a spoke VM to an Azure Storage account using a private IP address, ensuring traffic does not traverse the public internet.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Set the spoke VNet custom DNS server to 10.50.0.4.Correct answer▾
Why this is correct
The spoke is still using Azure-provided DNS, which cannot resolve the hub's internal records. Pointing the spoke VNet to the hub DNS server lets its VMs query the same internal namespace and resolve names correctly.
✗Add a route table entry that points to the hub DNS server.Wrong answer — click to see why▾
Why this is wrong here
Adding a route table entry directs traffic but does not configure the DNS server address that VMs use for name resolution. The spoke VMs need their DNS server setting changed to the hub's DNS IP (10.50.0.4) to resolve internal names.
★ When this WOULD be the correct answer
If the question were about enabling network traffic to reach a custom DNS server located in the hub, and the spoke VMs already had the correct DNS server configured, then adding a route table entry to direct DNS query traffic to that server would be correct.
Why candidates choose this
Candidates often confuse routing with DNS configuration, thinking that directing traffic to the DNS server via a route is sufficient, without realizing that VMs must also be configured to use that server for name resolution.
✗Enable a service endpoint for Microsoft.Storage on the spoke subnet.Wrong answer — click to see why▾
Why this is wrong here
Enabling a service endpoint for Microsoft.Storage on the spoke subnet does not affect DNS resolution for internal names; it only allows private access to Azure Storage from the spoke subnet over the Microsoft backbone network.
★ When this WOULD be the correct answer
This option would be correct if the question asked how to securely access Azure Storage accounts from the spoke VNet without using public IP addresses, by routing traffic through the Azure backbone.
Why candidates choose this
Candidates may confuse service endpoints with DNS resolution, thinking that enabling a service endpoint somehow enables name resolution for internal resources, or they may mistakenly believe that service endpoints provide DNS functionality.
✗Create a private endpoint for the spoke VM subnet.Wrong answer — click to see why▾
Why this is wrong here
Creating a private endpoint for the spoke VM subnet does not enable DNS resolution of hub internal names; private endpoints are used for secure access to Azure PaaS services, not for DNS forwarding or resolution.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the question asks how to securely connect a spoke VM to an Azure Storage account using a private IP address, ensuring traffic does not traverse the public internet.
Why candidates choose this
Candidates may confuse private endpoints with DNS resolution capabilities, thinking that creating a private endpoint somehow enables name resolution across VNets, or they may overestimate the role of private endpoints in network connectivity.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
VNet
A virtual private network inside a cloud provider that lets you securely connect and isolate your cloud resources.
Key term
DNS
DNS is the system that translates human-friendly domain names like example.com into machine-readable IP addresses so computers can find each other on a network.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.