A company has multiple VMs running the same web application. They want to allow the application tier to communicate with the database tier on port 1433, but only between VMs that belong to the same application. They plan to add more VMs later. What should you use to simplify NSG rule management?

Create an application security group for the web tier and another for the database tier, then create an NSG rule allowing port 1433 from the web ASG to the database ASG.

Create separate NSGs for each VM and manually update rules whenever a new VM is added.

Use service endpoints to allow communication between the web and database tiers on port 1433.

Create a single NSG rule allowing port 1433 from any source to any destination, and associate the NSG to both subnets.

A company wants to connect to an Azure SQL database from a VM in a VNet without exposing the database to the public internet. They need the connection to use a private IP address. What should you implement?

Enable a service endpoint for Microsoft.Sql on the subnet and add the subnet to the SQL firewall.

Create a private endpoint for the SQL database and configure the VM to connect to the private endpoint's IP address.

Configure a site-to-site VPN and connect to the SQL database over the VPN.

Use Azure Bastion to connect to the SQL database.

What is the primary purpose of a private endpoint in Azure?

To filter traffic between subnets in a virtual network

To provide a private IP address for an Azure PaaS resource within a virtual network, enabling access over a private connection

To encrypt traffic between a virtual network and a PaaS resource

To provide a public IP address for an Azure PaaS resource

You are configuring a network security group (NSG) for a subnet that hosts web servers. Which two components are required for an NSG security rule to be valid?

Source, destination, and action only

Source, destination, port, and protocol

Source IP, destination IP, and port only

Priority, action, and name only

Microsoft Certified:Azure Administrator Associate

Domain 4Objective 2

Configure Secure Access to Virtual Networks AZ-104 Practice Questions (Page 3)

Part of the Implement and manage virtual networking domain, which accounts for 15–20% of the AZ-104 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 2–4 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

6concepts

15–20%of the exam

Questions 11–15

11application · medium
A company has multiple VMs running the same web application. They want to allow the application tier to communicate with the database tier on port 1433, but only between VMs that belong to the same application. They plan to add more VMs later. What should you use to simplify NSG rule management?
Select an answer first
12foundation · easy
You need to provide a developer with secure RDP access to a virtual machine that has no public IP address. Which Azure service should you use?
Select an answer first
13application · medium
A company wants to connect to an Azure SQL database from a VM in a VNet without exposing the database to the public internet. They need the connection to use a private IP address. What should you implement?
Select an answer first
14foundation · easy
What is the primary purpose of a private endpoint in Azure?
Select an answer first
15foundation · easy
You are configuring a network security group (NSG) for a subnet that hosts web servers. Which two components are required for an NSG security rule to be valid?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-104

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-104” is a trademark of its owner, used for identification only.