Configure Secure Access to Virtual Networks AZ-104 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   When you view the effective security rules for a network interface, what do the rules represent?

   • AOnly the rules from the NSG applied directly to the network interface
   • BThe combined result of all NSGs applied to the subnet and the network interface, after processing
   • COnly the rules from the NSG applied to the subnet
   • DThe default security rules that Azure provides
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of Azure Bastion?

   • ATo provide secure RDP and SSH connectivity to virtual machines without exposing them to the public internet
   • BTo provide a VPN connection for remote users
   • CTo provide a public IP address for virtual machines
   • DTo act as a firewall that filters traffic between virtual networks
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   You need to ensure that a SQL database is accessible only from a specific virtual network, without using a public endpoint. Which Azure feature should you configure?

   • AService endpoint
   • BNetwork security group
   • CPrivate endpoint
   • DAzure Firewall
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   You are troubleshooting why a VM cannot connect to the internet. The VM has an NSG associated to its NIC and the subnet has a different NSG. You need to determine which rules are being applied. What should you do?

   • AUse the Effective security rules feature in the Azure portal for the VM's network interface.
   • BCheck the NSG associated to the subnet only, because the NIC NSG is ignored when both are present.
   • CReview the diagnostic logs of the VM to see which NSG rules were matched.
   • DUse Network Watcher's IP flow verify to test connectivity, but this does not show the effective rules.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   You have a virtual network with multiple subnets. You need to ensure that only VMs in the Frontend subnet can communicate with VMs in the Backend subnet. You also need to ensure that VMs in the Backend subnet can communicate with the internet. You have an NSG associated with the Backend subnet that has a rule allowing inbound traffic from the Frontend subnet. However, VMs in the Backend subnet cannot communicate with the internet. You review the effective security rules for a VM in the Backend subnet and see the following outbound rules: 65000 Allow Internet outbound, 65001 Deny all outbound, and a custom rule at priority 100 that denies internet traffic. What is the most likely reason the VM cannot communicate with the internet?

   • AThe Allow Internet outbound rule at priority 65000 is being overridden by the Deny all outbound rule at priority 65001.
   • BThe NSG associated with the Backend subnet is blocking outbound traffic to the internet.
   • CThe VM's network interface has a separate NSG that is blocking internet traffic.
   • DThe custom rule at priority 100 is being applied, which denies internet traffic.
   Reveal Solution Discussion Select an answer first