Configure and Manage Virtual Networks in Azure AZ-104 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   You have a virtual machine (VM) that needs to be accessible from the internet via a public IP address. You also need to ensure that the public IP address does not change if the VM is stopped and started. What should you do?

   • AUse a load balancer with a public IP and no backend pool.
   • BAssign a dynamic public IP address to the VM.
   • CUse a private IP address and Azure Bastion.
   • DAssign a static public IP address to the VM.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   You have two virtual networks in different Azure regions. VNet-A has a VPN gateway, and VNet-B does not. You need to allow resources in VNet-B to use the VPN gateway in VNet-A to connect to on-premises. You create a peering between VNet-A and VNet-B. What else must you configure?

   • ACreate a local network gateway in VNet-B and connect it to the VPN gateway in VNet-A.
   • BEnable 'Allow forwarded traffic' on both peerings.
   • CEnable 'Allow gateway transit' on the peering from VNet-A to VNet-B, and enable 'Use remote gateways' on the peering from VNet-B to VNet-A.
   • DAdd a user-defined route in VNet-B's subnets with next hop set to the VPN gateway's public IP.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   You have two virtual networks in the same Azure region: VNet-A uses address space 10.1.0.0/16 and VNet-B uses 10.2.0.0/16. You need to enable resources in VNet-A to communicate with resources in VNet-B over the Microsoft backbone. You create a peering from VNet-A to VNet-B and from VNet-B to VNet-A. Both peerings show 'Connected'. However, a VM in VNet-A cannot ping a VM in VNet-B. What is the most likely cause?

   • AYou must enable 'Allow forwarded traffic' on both peerings for ping to work.
   • BThe address spaces overlap, so peering cannot route traffic between the VNets.
   • CPeering requires a VPN gateway to be attached to both virtual networks.
   • DThe VMs are in subnets that have network security groups blocking ICMP or the traffic.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   You have a VM that is not reachable from the internet. The VM has a public IP, and the NSG on the NIC allows inbound HTTP (TCP 80). The subnet has an NSG that allows inbound HTTP from the internet. You check the effective security rules and see that the subnet NSG has a rule that denies inbound HTTP from the internet. What is the most likely cause?

   • AThe public IP is not associated with the VM's NIC.
   • BThe VM's operating system firewall is blocking HTTP.
   • CThe subnet NSG's deny rule overrides the NIC NSG's allow rule because both are evaluated and the deny is applied.
   • DThe NIC NSG is not applied to the VM.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   You have a virtual network with a subnet that contains a VM. You need to route all outbound traffic from the VM to a network virtual appliance (NVA) for inspection, except traffic to the Azure DNS service (168.63.129.16). You create a user-defined route with destination 0.0.0.0/0 and next hop set to the NVA. What else should you do to ensure DNS traffic is not sent to the NVA?

   • AAdd a more specific user-defined route with destination 168.63.129.16/32 and next hop type 'Internet'.
   • BConfigure the VM's DNS server to use a custom DNS server instead of Azure DNS.
   • CAdd a user-defined route with destination 168.63.129.16/32 and next hop type 'Virtual network gateway'.
   • DAdd a network security group rule that allows outbound traffic to 168.63.129.16.
   Reveal Solution Discussion Select an answer first