AZ-104 Implement and Manage Virtual Networking Practice Questions

Free AZ-104 Implement and Manage Virtual Networking practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main AZ-104 page. Sign up free to practice the full set.

1. Question 1Implement and Manage Virtual Networking

   You have two VNets with non-overlapping address spaces: VNet1 (10.1.0.0/16) and VNet2 (10.2.0.0/16). You configure peering from VNet1 to VNet2, but a VM in VNet1 cannot reach a VM in VNet2. What is the most likely cause?

   • AThe address spaces overlap
   • BService endpoints are not configured
   • CThe VMs are in different Azure regions
   • DPeering was configured in only one directionCorrect
   ✓ Correct answer: D

   Azure VNet peering requires configuration in both directions to establish connectivity. When you configure peering from VNet1 to VNet2 only, the peering status shows as "Initiated" rather than "Connected." Traffic cannot flow until the reciprocal peering is created from VNet2 to VNet1. Once both sides are configured, the status changes to "Connected" and communication between VMs in the two VNets becomes possible. This bidirectional requirement is a fundamental aspect of VNet peering.

   Why the other options are wrong

   • AThe address spaces overlap is incorrect because the question explicitly states the address spaces are non-overlapping (10.1.0.0/16 and 10.2.0.0/16).
   • BService endpoints are not configured is incorrect because service endpoints are used for accessing Azure PaaS services, not for VM-to-VM communication across peered VNets.
   • CThe VMs are in different Azure regions is incorrect because global VNet peering supports cross-region connectivity and being in different regions would not prevent communication.
2. Question 2Implement and Manage Virtual Networking

   Alpine Ski House has a hybrid network with an on-premises datacenter connected to Azure via ExpressRoute. They have an Azure VNet named VNet-Hub (10.0.0.0/16) peered with VNet-Spoke1 (10.1.0.0/16) and VNet-Spoke2 (10.2.0.0/16). Resources in the spoke VNets cannot reach the on-premises network through the ExpressRoute gateway in VNet-Hub. You need to fix the connectivity. What should you configure?

   • ACreate direct VNet peerings between each spoke VNet and the on-premises network directly.
   • BConfigure a separate site-to-site VPN between each spoke VNet and the on-premises datacenter.
   • CEnable 'Allow gateway transit' on VNet-Hub's peering and 'Use remote gateways' on each spoke peering.Correct
   • DDeploy additional, separate ExpressRoute gateways individually into each spoke VNet resource.
   ✓ Correct answer: C

   In a hub-spoke design the ExpressRoute or VPN gateway lives only in the hub, and spokes must be told to use it through two complementary peering settings. On the hub side of each peering you enable Allow gateway transit so the hub advertises its gateway, and on each spoke side you enable Use remote gateways so the spoke routes on-premises-bound traffic through the hub's gateway. This lets every spoke reach the on-premises network over the shared ExpressRoute gateway without deploying its own. It is the standard, cost-effective way to extend hybrid connectivity from the hub to the spokes.

   Why the other options are wrong

   • ACreating direct VNet peerings to the on-premises network is impossible because peering connects Azure virtual networks to each other, not to physical on-premises sites, which require a VPN or ExpressRoute gateway.
   • BConfiguring a separate site-to-site VPN for every spoke adds redundant gateways and cost when the hub's existing ExpressRoute gateway can already be shared through gateway transit.
   • DDeploying an additional ExpressRoute gateway in each spoke is expensive and redundant, since gateway transit lets the spokes reuse the single gateway already running in the hub.
3. Question 3Implement and Manage Virtual Networking

   Adventure Works has a virtual machine that should only be accessible for management via RDP from their corporate network (public IP 203.0.113.0/24). Currently, the VM is accessible from any IP address. Which NSG rule change should you make?

   • AAdd an inbound deny rule that blocks all traffic on every port and protocol
   • BModify the inbound RDP allow rule to restrict its source to 203.0.113.0/24 onlyCorrect
   • CAdd an outbound deny rule blocking RDP traffic leaving the VM
   • DRemove the network security group entirely from the VM's NIC
   ✓ Correct answer: B

   By changing the source address prefix of the existing inbound RDP (port 3389) allow rule from Any to 203.0.113.0/24, you restrict RDP access exclusively to the corporate network's public IP range. This follows the principle of least privilege by allowing only authorized network addresses to initiate RDP connections. The NSG rule continues to allow RDP traffic but only when the source IP falls within the specified corporate CIDR range. All RDP connection attempts from other IP addresses will be denied by the default rules.

   Why the other options are wrong

   • AAdding an inbound deny rule for all traffic on all ports is incorrect because this would block all traffic including legitimate web traffic or other services, not just restrict RDP to the corporate network; it is overly restrictive and does not meet the management access requirement.
   • CAdding an outbound deny rule for RDP traffic is incorrect because outbound rules control traffic leaving the VM, not traffic arriving at it; blocking outbound RDP would prevent the VM from initiating RDP connections to other hosts but would not restrict who can RDP into the VM.
   • DRemoving the network security group from the VM's NIC is incorrect because removing the NSG entirely would eliminate all network filtering, making the VM accessible from any source on all ports, which is the opposite of the security requirement.
4. Question 4Implement and Manage Virtual NetworkingSelect all that apply

   Munson's Pickles and Preserves Farm is configuring Azure Load Balancer for their web application. Which TWO of the following are required components when setting up a Standard Load Balancer? (Choose TWO)

   • AA VPN gateway in the same virtual network
   • BA backend pool containing the target virtual machines or instancesCorrect
   • CA health probe to monitor the status of backend instancesCorrect
   • DAn Azure Firewall in the same resource group
   ✓ Correct answer: B, C

   Azure Standard Load Balancer requires several key components to function: a frontend IP configuration (to receive incoming traffic), a backend pool (containing the VMs or instances that will serve requests), health probes (to monitor the availability of backend instances), and load balancing rules (to define how traffic is distributed). The backend pool defines the group of resources that will serve traffic, and health probes continuously monitor each backend instance to ensure traffic is only sent to healthy instances. Without a backend pool there are no targets for traffic distribution, and without health probes the load balancer cannot determine which instances are available.

   Why the other options are wrong

   • AA VPN gateway in the same virtual network is incorrect because VPN gateways provide connectivity between networks (site-to-site or point-to-site) and are not a component of load balancer configuration.
   • DAn Azure Firewall in the same resource group is incorrect because Azure Firewall is a network security service for filtering and inspecting traffic, and is not required for or related to load balancer setup.
5. Question 5Implement and Manage Virtual Networking

   Azure Network Watcher provides tools for diagnosing network connectivity issues, including IP flow verify, next hop analysis, and packet capture.

   • AFalse
   • BTrueCorrect
   ✓ Correct answer: B

   Azure Network Watcher is a regional service that provides a comprehensive suite of tools for monitoring, diagnosing, and gaining insights into network health and performance in Azure. Its diagnostic capabilities include IP flow verify (which checks whether traffic to or from a VM is allowed or denied by NSG rules and identifies the specific rule), next hop analysis (which determines the next hop type and IP address for traffic from a VM, helping identify routing issues with system routes and user-defined routes), and packet capture (which captures network packets to and from a VM for detailed traffic analysis and troubleshooting). Additional tools include connection troubleshoot, NSG flow logs, VPN troubleshoot, and network topology visualization. This is confirmed by Microsoft Azure documentation for the AZ-104 exam.

   Why the other options are wrong

   • AFalse is incorrect. The statement is true: Azure Network Watcher is a regional service that provides a comprehensive suite of tools for monitoring, diagnosing, and gaining insights into network health and performance in Azure.
6. Question 6Implement and Manage Virtual Networking

   A blob named temp/report.csv in the logs container was last modified 120 days ago. Which lifecycle actions apply to it?

   • ABoth: moved to Archive by archive-old, and deleted by delete-temp
   • BMove to Cool, then to Archive
   • CDelete blob onlyCorrect
   • DMove to Archive only
   ✓ Correct answer: C

   Azure Blob Storage lifecycle management does not execute every matching rule on a blob. When more than one action would apply to the same blob, the service applies only the least expensive action, where delete is cheaper than tierToArchive, which is cheaper than tierToCool. The blob temp/report.csv (in the logs container, last modified 120 days ago) matches both archive-old (move to Archive, >90 days, all logs blobs) and delete-temp (delete, >30 days, temp/ prefix). Because delete is the least expensive of the two, the blob is deleted; the move-to-Archive action is superseded and does not run.

   Why the other options are wrong

   • ABoth actions do not execute. Lifecycle management applies only the least expensive matching action, so the delete supersedes the move-to-Archive rather than both running.
   • BMove to Cool then Archive does not apply: the only cool-down rule targets the uploads container, but this blob is in the logs container, so no tier-to-Cool action ever matches.
   • DMove to Archive only is wrong because delete-temp also matches (temp/ prefix, >30 days) and delete is the least expensive action, so it supersedes the archive action - the blob is deleted, not archived.
7. Question 7Implement and Manage Virtual NetworkingSelect all that apply

   Fourth Coffee is deploying Azure services that need to securely access an Azure SQL Database and an Azure Storage account from within a virtual network. The security team mandates that traffic to these PaaS services must not traverse the public internet. The company also requires that the PaaS services remain inaccessible from outside the virtual network. The network architect is evaluating service endpoints and private endpoints. Requirements: - Azure SQL Database must be accessible only from Subnet-App (10.0.1.0/24) - Azure Storage must be accessible only from Subnet-Data (10.0.2.0/24) - Both PaaS services must have their public endpoints disabled or restricted - DNS resolution for the services must resolve to private IP addresses within the VNet - The solution must work with existing on-premises DNS infrastructure connected via ExpressRoute Which TWO features should you implement to meet ALL requirements? (Choose two.)

   • AService endpoints for Microsoft.Sql on Subnet-App and Microsoft.Storage on Subnet-Data
   • BPrivate endpoints for Azure SQL Database and Azure Storage, each deployed into their respective subnetsCorrect
   • CAzure Private DNS zones for privatelink.database.windows.net and privatelink.blob.core.windows.net linked to the VNetCorrect
   • DNSG rules blocking outbound traffic to Azure SQL and Azure Storage public IP ranges
   ✓ Correct answer: B, C

   Private endpoints give each PaaS service a private IP inside the VNet, keep traffic off the public internet, and let you disable the public endpoints, satisfying the access and exposure requirements. To make the service FQDNs resolve to those private IPs, you create the corresponding Azure Private DNS zones (privatelink.database.windows.net and privatelink.blob.core.windows.net) and link them to the VNet, which also integrates with on-premises DNS over ExpressRoute via conditional forwarding. Together private endpoints plus private DNS zones meet every requirement.

   Why the other options are wrong

   • AService endpoints keep traffic on the Azure backbone but the services still use public IP endpoints and cannot have their public access fully replaced by a private IP, so DNS would not resolve to private addresses.
   • DNSG rules blocking public IP ranges are brittle, hard to maintain as IP ranges change, and do not provide private IP DNS resolution or disable the public endpoints properly.
8. Question 8Implement and Manage Virtual NetworkingSelect all that apply

   You have the VNet configuration shown in the table. You need to deploy a new Azure Container Instance with VNet integration. Which TWO subnets can be used? Each correct answer presents a complete solution.

   • ASubnet-DefaultCorrect
   • BSubnet-ACICorrect
   • CSubnet-SQL
   • DSubnet-Web
   • ESubnet-Gateway
   ✓ Correct answer: A, B

   Azure Container Instances with VNet integration require a subnet delegated to Microsoft.ContainerInstance/containerGroups. Subnet-ACI already has this delegation configured, so it can be used immediately. Subnet-Default has no existing delegation, so the ACI delegation can be added to it, making it eligible for use. A subnet can only have one delegation at a time.

   Why the other options are wrong

   • CSubnet-SQL is incorrect because it is already delegated to Microsoft.Sql/managedInstances and cannot have a second delegation added.
   • DSubnet-Web is incorrect because it is already delegated to Microsoft.Web/serverFarms and cannot have a second delegation added.
   • ESubnet-Gateway is incorrect because gateway subnets are reserved for VPN and ExpressRoute gateways and cannot be delegated to container instances.

How Implement and Manage Virtual Networking is tested

This domain holds 194 of the 956 questions in the AZ-104 bank, about 20%. The mix is 103 single-answer multiple choice, 25 multiple-response, 21 yes/no scenario, 18 hotspot, 16 true/false and 11 ordering, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill Implement and Manage Virtual Networking on its own rather than re-running full-length mocks.

Other AZ-104 exam domains

• Manage Azure Identities and Governance225 questions
• Implement and Manage Storage195 questions
• Deploy and Manage Azure Compute Resources200 questions
• Monitor and Maintain Azure Resources142 questions
• All AZ-104 practice questions956 total
• Implement and Manage Virtual Networking study notesKey concepts
• Microsoft practice examsAll Microsoft

AZ-104 Implement and Manage Virtual Networking FAQ