Microsoft AZ-104 - Microsoft Azure Administrator -Virtual Networking - Review Questions

Configure and manage virtual networks in Azure — 12 questions

1. You create a VNet with address space 10.0.0.0/16. Which pair of subnet ranges is valid and non-overlapping?

A. 10.0.1.0/24 and 10.0.1.128/25

B. 10.0.1.0/24 and 10.0.2.0/24

C. 10.0.1.0/24 and 10.1.2.0/24

D. 10.0.0.0/16 and 10.0.2.0/24

2. How many IPv4 addresses are assignable to resources in a typical Azure /24 subnet after Azure’s reserved addresses are excluded?

A. 254

B. 256

C. 250

D. 251

3. A VM requires two NICs connected to different subnets. Which configuration is supported?

A. Both NICs connect to subnets in the same VNet, using a VM size that supports two NICs.

B. Each NIC connects to a different VNet in the same region.

C. Each NIC connects to a different region within the subscription.

D. Any VM size supports two NICs when Accelerated Networking is enabled.

4. Several VMs have private IP addresses and need outbound internet access through predictable public IP addresses. Internet hosts must not initiate connections through this outbound service. What should you configure?

A. An internal Load Balancer

B. A private endpoint

C. A NAT Gateway associated with the workload subnet

D. A Private DNS zone linked to the workload VNet

5. You peer VNet1 with VNet2 and VNet2 with VNet3. No transit appliance or additional connectivity is configured. What must you add for direct VNet1-to-VNet3 communication?

A. Auto-registration on the VNet2 DNS link

B. An explicit peering between VNet1 and VNet3

C. A public IP address on VNet2

D. A NAT Gateway on VNet2

6. What is the correct description of Global VNet Peering?

A. It connects Azure VNets to on-premises networks using encrypted tunnels.

B. It requires a premium-routing option to use Microsoft’s backbone.

C. It automatically enables transit through every connected VNet.

D. It connects VNets in different Azure regions over Microsoft’s backbone.

7. A subnet has these routes:

• System route: 0.0.0.0/0 → Internet

• UDR: 0.0.0.0/0 → Virtual appliance

• Peering route: 10.2.0.0/16 → Virtual network peering

Which route handles traffic destined for 10.2.1.10?

A. The 10.2.0.0/16 peering route

B. The user-defined default route

C. The system Internet route

D. The route created most recently

8. You need a workload subnet to send default-route IPv4 traffic through Azure Firewall at 10.0.1.4. Which UDR should you create?

A. 10.0.1.4/32 → Internet

B. 0.0.0.0/0 → Virtual network gateway

C. 0.0.0.0/0 → Virtual appliance, next-hop IP 10.0.1.4

D. 0.0.0.0/0 → None

9. Two VNets are deployed in East US and two in West Europe, within one subscription. Assuming default automatic enablement, how many Network Watcher instances are required?

A. 1

B. 2

C. 4

D. One for every subnet

10. You need to connect an on-premises network to an Azure VNet using an encrypted site-to-site connection over the internet. What should you configure?

A. ExpressRoute private peering alone

B. A Storage service endpoint

C. A public Load Balancer

D. A VPN virtual network gateway in GatewaySubnet

11. A database application needs low VM-to-VM latency and reduced network jitter. Which combination most directly addresses these requirements?

A. A proximity placement group and Accelerated Networking on supported VMs

B. Global VNet Peering and additional public IP addresses

C. A Private DNS zone and longer DNS TTLs

D. Azure Site Recovery and an outbound Load Balancer rule

12. An organization requires branch VPN connectivity, remote-user VPN,

ExpressRoute, and transit between regional hubs. Which Virtual WAN tier should it choose?

A. Basic, with service endpoints

B. Basic, with Private DNS

C. Standard

D. Either tier provides all these capabilities

Configure secure access to virtual networks — 10 questions

13. An NSG contains two inbound rules that match the same new connection: priority 100 allows it, and priority 200 denies it. What happens?

A. The connection is denied because deny always overrides allow.

B. The connection is evaluated using the default rules.

C. The connection is allowed only if both rules allow it.

D. The connection is allowed because priority 100 is evaluated first.

14. A subnet NSG allows inbound TCP 443, but the VM’s NIC NSG denies it. What is the result for a new connection?

A. It is allowed because subnet rules take precedence.

B. It is blocked because both applicable NSGs must allow it.

C. It is allowed if the subnet allow rule has a lower priority number.

D. It is allowed if the VM has a public IP address.

15. An NSG allows a VM to initiate an outbound TCP connection. What additional NSG rule is normally required for the response traffic?

A. An inbound rule allowing every port

B. An inbound rule matching the remote server’s ephemeral port

C. No separate response rule, because NSGs are stateful

D. An inbound rule using the AzureLoadBalancer service tag

16. You want NSG rules to identify web, application, and database VMs by workload role rather than individual IP addresses. What should you use?

A. Application Security Groups

B. Azure resource metadata tags

C. FQDN tags

D. DNS aliases

17. Which statement correctly differentiates an Azure Firewall service tag from an FQDN tag?

A. Both are labels assigned manually to VM resources.

B. Service tags apply only to NSGs; Firewall cannot use them.

C. FQDN tags identify individual VM NICs.

D. Service tags represent IP prefixes; FQDN tags represent Microsoft-managed domain groups.

18. Which Azure Firewall capability requires Premium?

A. Basic network filtering by IP address and port

B. TLS inspection and IDPS

C. Stateful connection tracking

D. Outbound source NAT

19. You want administrators to manage VMs without assigning public IP addresses to the VMs or exposing their RDP/SSH ports directly to the internet. What should you deploy?

A. A public DNS zone

B. An internet-facing NAT rule for every VM

C. Azure Bastion

D. A Storage service endpoint

20. Which statement about combining Bastion and Defender for Cloud JIT VM access is correct?

A. Bastion provides the connection path; JIT can temporarily permit the required management-port access.

B. Enabling Bastion automatically enables JIT for every VM.

C. JIT replaces the need for guest operating-system authentication.

D. JIT expiry always terminates active Bastion sessions.

21. You enable a Microsoft.Storage service endpoint on a subnet. You also want to restrict which storage accounts that subnet can access through service endpoints. What should you configure?

A. An NS record for each approved account

B. An Azure resource tag on each approved account

C. A NAT Gateway public IP prefix

D. A Storage service endpoint policy

22. You create a private endpoint for a storage account’s Blob service. What additional configuration is needed to make applications use private access and prevent public access?

A. Enable VM auto-registration on the public DNS zone.

B. Configure private DNS resolution and separately restrict or disable public network access.

C. Assign a public IP address to the private endpoint NIC.

D. Peer the VNet directly with the Microsoft.Storage service.

Configure name resolution and load balancing — 8 questions

23. You register contoso.com with an external registrar and create an Azure public DNS zone with that name. What must you do for public queries to use the Azure-hosted zone?

A. Link the public zone to each client VNet.

B. Enable auto-registration on the public zone.

C. Delegate the domain to Azure’s assigned authoritative name servers.

D. Configure every client to query 168.63.129.16.

24. Four peered VNets need VM name resolution using contoso.com, with minimal manual record maintenance. What should you configure?

A. A Private DNS zone linked to all four VNets with auto-registration enabled

B. A public DNS zone containing each VM’s private IP address

C. Azure-provided name resolution without a custom zone

D. An individual DNS server on every VM

25. All four VNets are configured to use a DNS server on VM1 in VNet1. The other VNets cannot reach VM1, and no connectivity exists between the VNets. What should you configure first?

A. Additional TXT records on VM1

B. A public Load Balancer in VNet1

C. Auto-registration on each VNet

D. Peering between each client VNet and VNet1

26. On-premises DNS must resolve Azure Private DNS zones through Azure DNS Private Resolver. Where should the on-premises conditional forwarder send those queries?

A. Directly to 168.63.129.16

B. The resolver’s inbound endpoint private IP

C. The resolver’s outbound endpoint

D. The storage account’s public IP address

27. You need to distribute private TCP connections across backend VMs. URL-path routing and TLS termination are unnecessary. Which service is the best fit?

A. Azure Front Door

B. Azure Public DNS

C. An internal Standard Azure Load Balancer

D. Application Gateway with a multi-site listener

28. Application Gateway v2 hosts several specific domains and a basic catch-all listener. How should you prevent the catch-all rule from handling requests intended for a specific domain?

A. Give specific-domain rules higher precedence using lower numeric rule priorities.

B. Create the catch-all listener first and rely on creation order.

C. Give the catch-all rule the lowest numeric priority.

D. Configure a public Load Balancer health probe for each listener.

29. A public web application runs in multiple regions and needs global HTTP routing, edge acceleration, and caching of eligible content. Which service is the best fit?

A. An internal Load Balancer

B. Azure DNS Private Resolver

C. NAT Gateway

D. Azure Front Door

30. A backend VM’s application is running, but Azure Load Balancer marks the backend unhealthy. Which investigation is most appropriate?

A. Increase the public DNS TTL.

B. Check the probe protocol/port/path, service listener, and NSG/guest firewall access for health probes.

C. Add an MX record for the frontend.

D. Enable cookie-based affinity on Azure Load Balancer.

Answer key and explanations

#	Answer	Explanation
1	B	Both /24 ranges are inside 10.0.0.0/16 and do not overlap.
2	D	A /24 has 256 addresses; Azure reserves five, leaving 251 assignable.
3	A	Multiple NICs require a supported VM size, and all NICs must connect to the same VNet.
4	C	NAT Gateway provides subnet-level outbound connectivity and allows return traffic without accepting internet-initiated connections through the NAT path.
5	B	Ordinary VNet peering is non-transitive; direct A-to-C connectivity requires explicit peering or a separately designed transit path.
6	D	Global VNet Peering connects VNets across regions over Microsoft’s backbone.
7	A	The /16 route is more specific than either /0 route.
8	C	The Virtual appliance next-hop type sends matching traffic to the firewall’s private IP.
9	B	Network Watcher is enabled once per subscription per region.
10	D	A VPN gateway supports encrypted IPsec/IKE site-to-site connectivity.
11	A	PPGs reduce physical separation; Accelerated Networking reduces host networking overhead and jitter.
12	C	Standard supports P2S, ExpressRoute, VNet transit, and inter-hub connectivity.
13	D	Within an NSG, lower numeric priorities are processed first, and the first matching rule applies.
14	B	Each associated NSG independently evaluates the flow; an allow in one does not override a deny in another.
15	C	NSGs automatically permit response traffic for an allowed, tracked connection.
16	A	ASGs group NIC IP configurations so NSG rules can reference application roles.
17	D	Service tags simplify IP-based rules; FQDN tags simplify application rules for Microsoft-managed endpoint groups.
18	B	Premium provides TLS inspection and intrusion detection and prevention capabilities.
19	C	Bastion connects administrators to VM private IPs without directly exposing VM management ports to the internet.
20	A	Bastion and JIT complement each other. JIT is separate, and expiry does not terminate established connections.
21	D	A Storage service endpoint policy restricts service-endpoint egress to approved Storage resources.
22	B	Private endpoint creation does not automatically configure every client’s DNS or disable public access.
23	C	Delegation directs public DNS resolution to the Azure-hosted authoritative zone.
24	A	Shared Private DNS with auto-registration maintains eligible VM records across linked VNets.
25	D	Clients need a network path to VM1 before their DNS queries can reach it.
26	B	The inbound endpoint provides a reachable private IP for queries originating outside Azure.
27	C	Internal Azure Load Balancer provides private Layer 4 TCP/UDP distribution.
28	A	Application Gateway v2 uses explicit rule priority; specific listeners should precede catch-all matches.
29	D	Front Door provides global Layer 7 delivery, acceleration, and configured edge caching.
30	B	Probe failures can result from incorrect probe settings, a missing listener, or blocked probe traffic even when the application process is running.