AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Add an inbound NSG rule allowing TCP 443.

  Why this is correct

  The VM can accept HTTPS traffic only if an inbound security rule explicitly permits TCP 443. Azure network security groups (NSGs) are stateful and default to deny all inbound internet traffic, so even if the VM has a public IP address and a web server running, connections on port 443 will be dropped until a rule with a higher priority (e.g., 100) is added. This rule should specify Source as 'Internet', Destination port range as '443', Protocol as 'TCP', and Action as 'Allow'. Because NSGs are stateful, the corresponding outbound return traffic on the ephemeral port will be automatically allowed, making this the only action listed that directly resolves the problem.

• ✗

  Create a user-defined route to the internet.

  Why it's wrong here

  A user-defined route (UDR) overrides Azure's system routes for outbound traffic within a subnet. The default system route for the 0.0.0.0/0 address prefix already directs outbound internet traffic directly to the Internet, so creating a UDR to the internet is unnecessary and could even break existing connectivity if misconfigured (e.g., pointing to a virtual appliance or invalid next hop). The real issue described is inbound traffic from users on the internet trying to reach VM-Web01 on TCP 443, which is controlled by the NSG's inbound rules, not by outbound routing. Routing decisions apply to traffic leaving the subnet, not to how the VM responds to inbound sessions; the VM can respond because the NSG is stateful, so the outbound return traffic is permitted automatically. Hence, a UDR does not address the inbound deny caused by the missing NSG rule.

  When this WOULD be correct

  You need to force all internet-bound traffic from a subnet to go through a network virtual appliance (NVA) for inspection. Creating a UDR with 0.0.0.0/0 next hop set to the NVA's IP address would be correct.

• ✗

  Configure VNet peering with another virtual network.

  Why it's wrong here

  Virtual network peering establishes a low-latency, private connection between two Azure VNets, allowing resources in both networks to communicate using private IP addresses as if they were in the same network. It has no effect on how internet traffic reaches a VM; inbound internet traffic arrives at the VM's public IP and is filtered by the NSG and the VM's own operating system firewall. Peering also does not add any public IP address or change the VM's network security configuration, and it cannot be used to 'forward' internet connections through another VNet unless that VNet has a public IP and appropriate reverse-proxy/NAT services—which the option does not specify. Therefore, peering is not a solution to exposing the web server to the internet; it only solves private-to-private connectivity.

  When this WOULD be correct

  You need to enable communication between VMs in two different virtual networks (e.g., VNet-A and VNet-B) without using a gateway or public internet. VNet peering provides low-latency, private connectivity.

• ✗

  Create a private endpoint for VM-Web01.

  Why it's wrong here

  A private endpoint assigns a private IP address from a virtual network to an Azure PaaS service (such as Storage, SQL Database, or Key Vault) to enable private, secure access from within the VNet. It cannot be attached to an IaaS virtual machine like VM-Web01, and it does not create any inbound internet-facing listener on the VM, nor does it affect NSG rules controlling internet traffic. Publishing a VM's website to the internet requires a public IP and an NSG rule that permits the incoming port—not a private endpoint, which is designed to keep traffic off the public internet, not to expose it. Thus, creating a private endpoint is both incompatible with the VM resource type and counterproductive to the stated goal of internet access.

  When this WOULD be correct

  When you need to access an Azure PaaS service (e.g., Azure SQL Database) from a virtual network without exposing it to the public internet, you would create a private endpoint to enable private connectivity.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question