A company has multiple VMs that need to communicate with each other on specific ports. They want to group VMs by function (e.g., web, app, database) and create NSG rules based on these groups. What should you use?

Network security groups with IP address ranges

Azure Firewall with application rules

What is the primary purpose of an application security group (ASG) in Azure?

To provide a public IP address for a group of virtual machines

To encrypt network traffic between virtual machines

To group virtual machines by workload and use the group as a source or destination in NSG rules

To automatically scale virtual machines based on network traffic

A company has an Azure Storage account that must be accessible only from a specific VNet. They also need to ensure that traffic from the VNet to the storage account does not traverse the public internet. They are considering both service endpoints and private endpoints. Which statement is true?

Service endpoints can be used with any PaaS service, while private endpoints are limited to a few services.

Both service endpoints and private endpoints can provide private connectivity, but private endpoints assign a private IP to the storage account, while service endpoints do not.

Service endpoints are more secure than private endpoints because they use the Azure backbone.

Private endpoints require a VPN or ExpressRoute to be used, while service endpoints do not.

A company has a three-tier application with web, app, and database VMs. They want to allow the web tier to communicate with the app tier on port 8080, and the app tier to communicate with the database tier on port 1433. They also want to ensure that the web tier cannot communicate directly with the database tier. They plan to scale out by adding more VMs. What is the most efficient way to configure NSG rules?

Create three application security groups (Web, App, DB), assign VMs to them, and create two NSG rules: Allow Web to App on 8080 and Allow App to DB on 1433. The default deny rules block other traffic.

Create a single NSG with rules using IP addresses for each tier, and update the rules whenever VMs are added.

Use Azure Firewall with application rules to control traffic between tiers.

Create three NSGs, one per tier, and associate them to each VM's NIC with rules allowing the required traffic.

You have multiple web servers and multiple database servers. You want to allow web servers to communicate with database servers on port 1433. How can you use application security groups (ASGs) to simplify this?

Create an ASG for web servers and an ASG for database servers, then create one NSG rule with the web ASG as source and the database ASG as destination.

Create a single ASG that includes both web and database servers, then allow all traffic within that ASG.

Assign each server to its own ASG and create a rule for each server pair.

Use ASGs only for the database servers and use individual IP addresses for the web servers.

Microsoft Certified:Azure Administrator Associate

Domain 4Objective 2

Configure Secure Access to Virtual Networks AZ-104 Practice Questions (Page 1)

Part of the Implement and manage virtual networking domain, which accounts for 15–20% of the AZ-104 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 2–4 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

6concepts

15–20%of the exam

Questions 1–5

1application · medium
A company has multiple VMs that need to communicate with each other on specific ports. They want to group VMs by function (e.g., web, app, database) and create NSG rules based on these groups. What should you use?
Select an answer first
2foundation · easy
What is the primary purpose of an application security group (ASG) in Azure?
Select an answer first
3expert · hard
A company has an Azure Storage account that must be accessible only from a specific VNet. They also need to ensure that traffic from the VNet to the storage account does not traverse the public internet. They are considering both service endpoints and private endpoints. Which statement is true?
Select an answer first
4expert · hard
A company has a three-tier application with web, app, and database VMs. They want to allow the web tier to communicate with the app tier on port 8080, and the app tier to communicate with the database tier on port 1433. They also want to ensure that the web tier cannot communicate directly with the database tier. They plan to scale out by adding more VMs. What is the most efficient way to configure NSG rules?
Select an answer first
5foundation · easy
You have multiple web servers and multiple database servers. You want to allow web servers to communicate with database servers on port 1433. How can you use application security groups (ASGs) to simplify this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-104

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-104” is a trademark of its owner, used for identification only.