VPC practice questions

A company has multiple Azure virtual networks (VNets) in different regions and an on-premises data center connected via ExpressRoute. They need to implement a hub-and-spoke topology where a hub VNet hosts shared network virtual appliances (NVAs) for traffic inspection. All traffic between spokes and between spokes and on-premises must be routed through the hub. The company wants to minimize the administrative overhead of configuring and maintaining routing. Which Azure solution should they implement?

Trap 1: Use VNet peering with user-defined routes (UDRs) in each spoke and…

While this is possible, it requires manual configuration and maintenance of UDRs in each spoke and managing BGP with Route Server, increasing administrative overhead.

Trap 2: Create a single large VNet and use network security groups (NSGs)…

A single VNet does not scale well for cross-region connectivity and does not provide the necessary routing through NVAs without complex configuration.

Trap 3: Use Azure Firewall in the hub VNet and configure forced tunneling…

Forced tunneling requires manual route configuration and does not automatically handle transitive routing between spoke VNets; it also requires careful management of routes.

A
Use Azure Virtual WAN with a secured virtual hub.
Azure Virtual WAN provides a managed hub-and-spoke architecture with automatic routing. A secured virtual hub can integrate NVAs or Azure Firewall, and it handles transitive routing between spokes and on-premises without manual route tables or UDRs.
B
Use VNet peering with user-defined routes (UDRs) in each spoke and Azure Route Server.
Why wrong: While this is possible, it requires manual configuration and maintenance of UDRs in each spoke and managing BGP with Route Server, increasing administrative overhead.
C
Create a single large VNet and use network security groups (NSGs) to isolate traffic.
Why wrong: A single VNet does not scale well for cross-region connectivity and does not provide the necessary routing through NVAs without complex configuration.
D
Use Azure Firewall in the hub VNet and configure forced tunneling via custom routes.
Why wrong: Forced tunneling requires manual route configuration and does not automatically handle transitive routing between spoke VNets; it also requires careful management of routes.

Question 2hardmulti select

A company is designing hub-and-spoke networking. Spoke VNets must use a central Azure Firewall for outbound internet traffic. Which two configurations are required?

Trap 1: Enable public IP addresses on all workload VMs

Public IPs increase exposure and are not needed for forced-tunnel outbound inspection.

Trap 2: Deploy a NAT gateway in every spoke subnet

NAT gateways would bypass the central firewall design for outbound traffic.

A
Enable public IP addresses on all workload VMs
Why wrong: Public IPs increase exposure and are not needed for forced-tunnel outbound inspection.
B
Peer each spoke VNet with the hub VNet
VNet peering provides private connectivity between hub and spokes.
C
Associate a route table to spoke subnets with a default route to the firewall private IP
A UDR forces outbound traffic from spokes through the firewall.
D
Deploy a NAT gateway in every spoke subnet
Why wrong: NAT gateways would bypass the central firewall design for outbound traffic.

Read the full NAT/PAT explanation →

Question 3easymultiple choice

A company is deploying a multi-tier web application on Azure VMs. The web tier must be accessible from the internet, while the application and database tiers must be isolated within the virtual network. The solution must provide SSL termination, web application firewall (WAF) capabilities, and URL-based routing. Which Azure service should they use to expose the web tier?

Trap 1: Use an Azure Load Balancer and configure NSGs on each subnet.

Azure Load Balancer is a layer 4 service and does not provide SSL termination, WAF, or URL-based routing. NSGs alone cannot provide those capabilities.

Trap 2: Use Azure Firewall to inspect all traffic and allow internet…

Azure Firewall is a stateful firewall that operates at layers 3-4 with some layer 7 capabilities, but it is not optimized for inbound web traffic with SSL offloading and URL routing like a WAF-enabled service.

Trap 3: Use Azure Front Door to expose the web tier and NSGs for internal…

Azure Front Door is a global load balancer, suitable for multi-region scenarios. For a single-region deployment, Application Gateway is more appropriate and cost-effective, and Front Door does not inherently provide isolation between tiers.

A
Use an Azure Load Balancer and configure NSGs on each subnet.
Why wrong: Azure Load Balancer is a layer 4 service and does not provide SSL termination, WAF, or URL-based routing. NSGs alone cannot provide those capabilities.
B
Use Azure Firewall to inspect all traffic and allow internet traffic to the web tier.
Why wrong: Azure Firewall is a stateful firewall that operates at layers 3-4 with some layer 7 capabilities, but it is not optimized for inbound web traffic with SSL offloading and URL routing like a WAF-enabled service.
C
Use Azure Application Gateway with WAF, and configure NSGs to restrict traffic between tiers.
Application Gateway provides SSL termination, WAF, and URL routing. NSGs on subnets can enforce isolation by allowing only necessary traffic (e.g., only web tier to app tier on specific ports).
D
Use Azure Front Door to expose the web tier and NSGs for internal isolation.
Why wrong: Azure Front Door is a global load balancer, suitable for multi-region scenarios. For a single-region deployment, Application Gateway is more appropriate and cost-effective, and Front Door does not inherently provide isolation between tiers.

Question 4hardmultiple choice

You are designing a networking solution for a multi-tier application in Azure. The front-end web tier must be accessible from the internet, while the back-end database tier must only be accessible from the web tier. You need to minimize management overhead and ensure that the back-end tier is not directly reachable from the internet. What should you use?

Trap 1: Azure Bastion for database access and Azure Front Door for web…

Bastion is for management, not for application traffic.

Trap 2: Azure Front Door with private link for the web tier and service…

Front Door is for global load balancing; service endpoints do not provide subnet-level isolation.

Trap 3: Azure Firewall in a hub VNet with forced tunneling for all traffic

Overly complex for this requirement; NSGs are sufficient.

A
Azure Application Gateway on the web subnet and network security groups on the database subnet
Application Gateway provides internet-facing access to the web tier; NSGs restrict database traffic to the web subnet only.
B
Azure Bastion for database access and Azure Front Door for web access
Why wrong: Bastion is for management, not for application traffic.
C
Azure Front Door with private link for the web tier and service endpoints for the database tier
Why wrong: Front Door is for global load balancing; service endpoints do not provide subnet-level isolation.
D
Azure Firewall in a hub VNet with forced tunneling for all traffic
Why wrong: Overly complex for this requirement; NSGs are sufficient.

Read the full NAT/PAT explanation →

Question 5easymultiple choice

You need to design a virtual network architecture for a three-tier application in Azure. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which combination of Azure services should you use?

Trap 1: Use Azure Front Door, service endpoints, and Azure SQL Database…

Front Door is for global ingress; service endpoints are not as secure as Private Endpoints.

Trap 2: Use Azure Load Balancer, Azure Firewall, and Azure SQL Database…

Load Balancer doesn't provide WAF; public database endpoint is not recommended.

Trap 3: Use a single virtual network with three subnets, no NSGs, and Azure…

No NSGs means no traffic enforcement between tiers.

A
Use Azure Front Door, service endpoints, and Azure SQL Database with firewall rules.
Why wrong: Front Door is for global ingress; service endpoints are not as secure as Private Endpoints.
B
Use Azure Application Gateway with WAF, network security groups (NSGs) on subnets, and Azure Private Endpoints for the database.
Application Gateway provides internet-facing WAF and path-based routing; NSGs restrict traffic between tiers; Private Endpoints keep database traffic private.
C
Use Azure Load Balancer, Azure Firewall, and Azure SQL Database with public endpoint.
Why wrong: Load Balancer doesn't provide WAF; public database endpoint is not recommended.
D
Use a single virtual network with three subnets, no NSGs, and Azure SQL Database with VNet injection.
Why wrong: No NSGs means no traffic enforcement between tiers.

Review the full subnetting walkthrough →

Question 6hardmultiple choice

You are reviewing a network security group (NSG) rule for a subnet that hosts web servers. The subnet's address space is 10.0.1.0/24. What is the effect of this rule?

Exhibit

Refer to the exhibit.

```json
{
  "Name": "Allow specific traffic",
  "Priority": 100,
  "Direction": "Inbound",
  "Access": "Allow",
  "SourceAddressPrefixes": ["10.0.1.0/24"],
  "DestinationAddressPrefixes": ["*"],
  "DestinationPortRanges": ["80", "443"],
  "Protocol": "TCP"
}
```

Trap 1: The rule allows inbound TCP traffic on ports 80 and 443 from any…

Source is restricted to 10.0.1.0/24.

Trap 2: The rule denies inbound TCP traffic on ports 80 and 443 from any…

Access is Allow.

Trap 3: The rule allows inbound TCP traffic on ports 80 and 443 from the…

Source is internal subnet, not internet.

A
The rule allows inbound TCP traffic on ports 80 and 443 from any source.
Why wrong: Source is restricted to 10.0.1.0/24.
B
The rule allows inbound TCP traffic on ports 80 and 443 from the same subnet.
Source is 10.0.1.0/24, which is the same subnet.
C
The rule denies inbound TCP traffic on ports 80 and 443 from any source.
Why wrong: Access is Allow.
D
The rule allows inbound TCP traffic on ports 80 and 443 from the internet.
Why wrong: Source is internal subnet, not internet.

Read the full NAT/PAT explanation →

Question 7hardmultiple choice

You are designing a network architecture for a three-tier application hosted in Azure. The front-end tier must be accessible from the internet, the business tier must only communicate with the front-end tier, and the data tier must only communicate with the business tier. You need to minimize exposure and use Azure-native services. Which combination of services should you use?

Trap 1: Azure Load Balancer for front-end, NSGs on subnets, and VNet peering

Azure Load Balancer does not provide application-layer protection like WAF.

Trap 2: VPN Gateway for front-end, NSGs on subnets, and private endpoints

VPN Gateway is for site-to-site connectivity, not public internet access.

Trap 3: Azure Firewall for all inbound traffic, NSGs on subnets, and VNet…

Azure Firewall is a stateful firewall but not optimized for web traffic; also more costly.

A
Azure Load Balancer for front-end, NSGs on subnets, and VNet peering
Why wrong: Azure Load Balancer does not provide application-layer protection like WAF.
B
VPN Gateway for front-end, NSGs on subnets, and private endpoints
Why wrong: VPN Gateway is for site-to-site connectivity, not public internet access.
C
Azure Application Gateway with WAF for front-end, NSGs on subnets, and service endpoints
Application Gateway provides HTTP/HTTPS load balancing and WAF. NSGs control traffic between tiers.
D
Azure Firewall for all inbound traffic, NSGs on subnets, and VNet peering
Why wrong: Azure Firewall is a stateful firewall but not optimized for web traffic; also more costly.

Question 8hardmultiple choice

You executed the above Azure CLI commands. The remote VNet (yourVNet) has address space 10.1.0.0/16. What is the result?

Network Topology

Trap 1: The peering command fails because the remote VNet does not exist.

The command assumes the remote VNet exists.

Trap 2: A VNet with one subnet is created, and no peering is established.

Two subnets are created.

Trap 3: Only the first subnet is created, and the peering is established.

Second subnet creation succeeds.

A
The peering command fails because the remote VNet does not exist.
Why wrong: The command assumes the remote VNet exists.
B
A VNet with one subnet is created, and no peering is established.
Why wrong: Two subnets are created.
C
A VNet with two subnets is created, and a VNet peering is established.
Commands create VNet, second subnet, and peering.
D
Only the first subnet is created, and the peering is established.
Why wrong: Second subnet creation succeeds.

Question 9easymultiple choice

You need to design a networking solution for a multi-tier application that includes a web front-end, an API layer, and a database. The web and API tiers must be accessible from the internet, while the database tier must be isolated. What is the most secure and efficient design?

Trap 1: Place all VMs in the same subnet and use a single Azure Load…

This exposes the database tier to internet traffic and reduces security.

Trap 2: Use separate VNets for each tier and connect them with VNet peering.

Unnecessarily complex; separate subnets within a VNet provide isolation.

Trap 3: Deploy all VMs in a single subnet and use Azure Firewall to inspect…

Azure Firewall adds cost and complexity without proper tier isolation.

A
Place all VMs in the same subnet and use a single Azure Load Balancer to distribute traffic.
Why wrong: This exposes the database tier to internet traffic and reduces security.
B
Use separate VNets for each tier and connect them with VNet peering.
Why wrong: Unnecessarily complex; separate subnets within a VNet provide isolation.
C
Deploy all VMs in a single subnet and use Azure Firewall to inspect all inbound and outbound traffic.
Why wrong: Azure Firewall adds cost and complexity without proper tier isolation.
D
Deploy all tiers in the same VNet with separate subnets, and use NSGs to restrict traffic. Place an Azure Application Gateway with WAF in front of the web tier.
Secure and efficient: subnets isolate tiers, NSGs control traffic, Application Gateway provides internet-facing entry and WAF protection.

Review the full subnetting walkthrough →

Question 10mediummultiple choice

Refer to the exhibit. You are reviewing an ARM template that deploys a virtual network with two subnets. Subnet-b includes a delegation to Microsoft.Web/serverFarms. What is the purpose of this delegation?

Exhibit

{
  "properties": {
    "template": {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "1.0.0.0",
      "resources": [
        {
          "type": "Microsoft.Network/virtualNetworks",
          "apiVersion": "2021-02-01",
          "name": "vnet-01",
          "location": "[resourceGroup().location]",
          "properties": {
            "addressSpace": {
              "addressPrefixes": [
                "10.0.0.0/16"
              ]
            },
            "subnets": [
              {
                "name": "subnet-a",
                "properties": {
                  "addressPrefix": "10.0.0.0/24"
                }
              },
              {
                "name": "subnet-b",
                "properties": {
                  "addressPrefix": "10.0.1.0/24",
                  "delegations": [
                    {
                      "name": "delegation",
                      "properties": {
                        "serviceName": "Microsoft.Web/serverFarms"
                      }
                    }
                  ]
                }
              }
            ]
          }
        }
      ]
    },
    "parameters": {}
  }
}

Trap 1: It allows subnet-b to use a different address space

Address space is defined in the parent resource, not by delegation.

Trap 2: It configures a firewall policy for subnet-b

Firewall policies are separate; delegation does not configure firewalls.

Trap 3: It creates a peering connection to another virtual network

Peering is defined separately, not via delegation.

A
It allows subnet-b to use a different address space
Why wrong: Address space is defined in the parent resource, not by delegation.
B
It configures a firewall policy for subnet-b
Why wrong: Firewall policies are separate; delegation does not configure firewalls.
C
It creates a peering connection to another virtual network
Why wrong: Peering is defined separately, not via delegation.
D
It enables Azure App Service instances to be deployed into subnet-b
Delegation gives control of the subnet to the specified service, here App Service.

Question 11hardmultiple choice

You are designing a network architecture for a multi-tier application. The front-end tier is an Azure Application Gateway that routes traffic to a web app on Azure App Service. The back-end tier is an Azure SQL Database. You need to ensure that all traffic between the Application Gateway and the web app remains within the Azure backbone network, and that the web app can only be accessed through the Application Gateway. What should you configure?

Trap 1: Use Azure Private Link for the web app and disable public access.

Private Link is an option but more complex; Service Endpoints are simpler and sufficient.

Trap 2: Deploy Azure Firewall in front of the Application Gateway.

Azure Firewall adds cost and complexity; not needed for this scenario.

Trap 3: Use a site-to-site VPN between the App Service and Application…

VPN is for on-premises connectivity, not between Azure services.

A
Use Azure Private Link for the web app and disable public access.
Why wrong: Private Link is an option but more complex; Service Endpoints are simpler and sufficient.
B
Enable Service Endpoints for the web app and configure the Application Gateway with a private IP.
Service Endpoints ensure traffic stays on Azure backbone; private IP restricts access to the gateway.
C
Deploy Azure Firewall in front of the Application Gateway.
Why wrong: Azure Firewall adds cost and complexity; not needed for this scenario.
D
Use a site-to-site VPN between the App Service and Application Gateway.
Why wrong: VPN is for on-premises connectivity, not between Azure services.

Question 12mediummulti select

Which TWO of the following are valid considerations when designing a SQL Server Always On availability group in Azure VMs? (Choose two.)

Trap 1: The availability group listener can use DHCP to automatically…

Listener requires a static IP address; DHCP is not supported for listener.

Trap 2: A file share witness is required for the quorum configuration.

Cloud witness is recommended for Azure VMs, not file share witness.

Trap 3: All replicas must be in the same subnet to use a single internal…

Replicas can be in different subnets; a load balancer can handle different subnets.

A
The availability group listener should use a static IP address in the same subnet as the primary replica.
The listener IP should be in the same subnet as the primary replica for proper routing.
B
The availability group listener can use DHCP to automatically assign an IP address.
Why wrong: Listener requires a static IP address; DHCP is not supported for listener.
C
The number of replicas should be an odd number to avoid split-brain scenarios.
Odd number of replicas ensures quorum can be achieved in case of network partition.
D
A file share witness is required for the quorum configuration.
Why wrong: Cloud witness is recommended for Azure VMs, not file share witness.
E
All replicas must be in the same subnet to use a single internal load balancer.
Why wrong: Replicas can be in different subnets; a load balancer can handle different subnets.

Review the full subnetting walkthrough →

Question 13mediummultiple choice

Refer to the exhibit. You have an Azure Storage account with the settings shown. A developer reports that they cannot access the storage account from their Azure VM that is connected to subnet-a. The VM's subnet ID matches the one in the rule. What is the most likely cause of the issue?

Exhibit

{
  "properties": {
    "sku": {
      "name": "Standard_GRS"
    },
    "kind": "StorageV2",
    "accessTier": "Hot",
    "supportsHttpsTrafficOnly": true,
    "networkRuleSet": {
      "defaultAction": "Deny",
      "virtualNetworkRules": [
        {
          "id": "/subscriptions/.../subnets/subnet-a",
          "action": "Allow"
        }
      ]
    }
  }
}

Trap 1: The storage account requires HTTPS and the VM is using HTTP

supportsHttpsTrafficOnly is true, but the error is likely network, not protocol.

Trap 2: The storage account does not have a firewall rule for the VM's…

The rule is configured for the virtual network, not public IP.

Trap 3: The storage account uses GRS replication which is not supported…

GRS works with network rules.

A
The storage account requires HTTPS and the VM is using HTTP
Why wrong: supportsHttpsTrafficOnly is true, but the error is likely network, not protocol.
B
The storage account does not have a firewall rule for the VM's public IP
Why wrong: The rule is configured for the virtual network, not public IP.
C
The subnet does not have a service endpoint for Microsoft.Storage enabled
Virtual network rules require a service endpoint on the subnet to be effective.
D
The storage account uses GRS replication which is not supported with network rules
Why wrong: GRS works with network rules.

Question 14mediummultiple choice

Your company has a multi-region Azure deployment with virtual networks in East US and West Europe connected via a hub-and-spoke topology. You need to ensure that all traffic between the spokes is routed through a centralized firewall in the hub. The hub uses Azure Firewall. Currently, spoke-to-spoke traffic is not being inspected. What should you configure?

Trap 1: Apply NSG rules to block direct spoke-to-spoke traffic.

NSGs do not provide routing; they only filter traffic at the subnet/NIC level.

Trap 2: Configure VNet peering between all spokes.

VNet peering enables connectivity but does not force traffic through the firewall.

Trap 3: Deploy VPN gateways in each spoke and configure site-to-site VPNs.

VPN gateways are not needed; they add complexity and cost.

A
Use Azure Firewall Manager to enforce routing by adding route tables to the spoke subnets with a default route to the firewall.
This forces all inter-spoke traffic through the firewall for inspection.
B
Apply NSG rules to block direct spoke-to-spoke traffic.
Why wrong: NSGs do not provide routing; they only filter traffic at the subnet/NIC level.
C
Configure VNet peering between all spokes.
Why wrong: VNet peering enables connectivity but does not force traffic through the firewall.
D
Deploy VPN gateways in each spoke and configure site-to-site VPNs.
Why wrong: VPN gateways are not needed; they add complexity and cost.

Question 15hardmultiple choice

Refer to the exhibit. You are reviewing an Azure Policy definition that your team plans to assign. The policy is intended to deny the deployment of virtual networks and virtual machines if they do not have an NSG attached with a rule named containing 'Allow'. However, the policy is not working as expected. What is the most likely reason?

Exhibit

{
  "properties": {
    "policyRule": {
      "if": {
        "anyOf": [
          {
            "field": "type",
            "equals": "Microsoft.Network/virtualNetworks"
          },
          {
            "field": "type",
            "equals": "Microsoft.Compute/virtualMachines"
          }
        ]
      },
      "then": {
        "effect": "deny",
        "details": {
          "existenceCondition": {
            "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].name",
            "like": "*Allow*"
          }
        }
      }
    }
  }
}

Trap 1: The field 'Microsoft.Network/networkSecurityGroups/securityRules[*].…

The alias is correct for rule names.

Trap 2: The policy rule syntax is invalid.

The syntax appears valid; it uses proper JSON structure.

Trap 3: The effect 'deny' cannot be used with existenceCondition.

'deny' can be used with existenceCondition.

A
The field 'Microsoft.Network/networkSecurityGroups/securityRules[*].name' is an incorrect alias.
Why wrong: The alias is correct for rule names.
B
The policy does not check whether the NSG is actually associated with the resource.
The policy checks for the existence of an NSG with a rule name but does not verify association.
C
The policy rule syntax is invalid.
Why wrong: The syntax appears valid; it uses proper JSON structure.
D
The effect 'deny' cannot be used with existenceCondition.
Why wrong: 'deny' can be used with existenceCondition.

Question 16mediummultiple choice

Your company has an Azure subscription that contains a hub virtual network and multiple spoke virtual networks connected via VNet peering. You need to ensure that all traffic between spokes is routed through a network virtual appliance (NVA) in the hub. The NVA is configured with IP forwarding enabled. What should you configure in the spoke virtual networks?

Trap 1: Deploy a VPN gateway in each spoke and configure site-to-site VPNs.

Not required and adds complexity.

Trap 2: Configure NSG rules to block direct spoke-to-spoke traffic.

NSGs do not route traffic; they filter.

Trap 3: Enable BGP on the VNet peerings.

BGP does not apply to VNet peering; it is for VPN gateways.

A
Deploy a VPN gateway in each spoke and configure site-to-site VPNs.
Why wrong: Not required and adds complexity.
B
Configure NSG rules to block direct spoke-to-spoke traffic.
Why wrong: NSGs do not route traffic; they filter.
C
Add route tables to the spoke subnets with a default route (0.0.0.0/0) pointing to the NVA's private IP.
This forces all outbound traffic from spokes to go through the NVA.
D
Enable BGP on the VNet peerings.
Why wrong: BGP does not apply to VNet peering; it is for VPN gateways.