AZ-104 Questions 31-40: Azure Virtual Networking, Routing, and Load Balancing

0
0

Focus keyphrase: AZ-104 practice questions

Use these AZ-104 practice questions to review the Implement and manage virtual networking objective domain for the Microsoft Azure Administrator exam. This batch focuses on virtual networks, peering, user-defined routes, network security groups, VPN Gateway, Azure Bastion, private endpoints, private DNS, load balancing, and application routing.

These are original certification-style questions based on public Microsoft exam objectives and official Azure documentation. They are realistic and exam-like, but they are not copied, paraphrased, or reconstructed from real exam-dump content.

AZ-104Questions 31-40Implement and manage virtual networkingAzure Administrator
Where this fits in the series: This post continues the AZ-104 sequence after AZ-104 Questions 21-30: Azure Compute, VMs, App Service, and Containers, which is currently in the review queue. Questions 31-40 move into Azure networking administration. You can also browse the AZ-104 category for reviewed posts.

AZ-104 Questions 31-40: Azure networking practice

For each item, choose the best answer unless the question explicitly says otherwise. AZ-104 networking questions usually test whether you can translate a requirement into the right Azure control: a route table, an NSG rule, a private endpoint, a private DNS zone, a gateway, or the right load-balancing service.

Exam lens: Layer 3/4 traffic distribution usually points to Azure Load Balancer.
Exam lens: HTTP routing, host/path routing, TLS termination, and WAF usually point to Application Gateway.
Exam lens: Private service access over a private IP usually points to Private Link/private endpoint plus DNS.
Exam tip: When a question mentions “no public IP on the VM,” do not panic-click NSG. Think about the access path. Azure Bastion solves administrator access; private endpoints solve private access to PaaS services; NSGs only filter traffic that already has a route.
Domain: Implement and manage virtual networking — configure virtual network peering and routing

Question 31: Routing spoke-to-spoke traffic through a hub firewall

Scenario: A company uses a hub-and-spoke network design. SpokeA and SpokeB are each peered with HubVNet. Azure Firewall is deployed in HubVNet. The administrator wants traffic between SpokeA and SpokeB to be inspected by Azure Firewall instead of creating a direct peering between the two spokes.

Choose one answer.

  1. Create a service endpoint for Microsoft.Storage on both spoke subnets
  2. Associate route tables with the spoke subnets that send the opposite spoke address range to the firewall private IP, and allow forwarded traffic on the peerings
  3. Add an inbound NSG rule that allows VirtualNetwork traffic on both spokes only
  4. Create a public IP address for each spoke VNet and route traffic through the Internet

Correct answer: B — Associate route tables with the spoke subnets that send the opposite spoke address range to the firewall private IP, and allow forwarded traffic on the peerings

Explanation: VNet peering is not automatically transitive for arbitrary spoke-to-spoke routing. In a hub-and-spoke inspection design, user-defined routes on the spoke subnets can direct traffic for the other spoke to the firewall private IP as a virtual appliance, and peering settings must allow forwarded traffic.

Why the other options are wrong

  • A. Service endpoints secure access to supported Azure services from a subnet; they do not route spoke-to-spoke traffic.
  • C. NSGs filter traffic but do not force a next hop through Azure Firewall.
  • D. Sending private VNet traffic through public IPs is unnecessary and does not implement a secure hub inspection pattern.

Official reference: Azure Virtual Network peering and Azure virtual network traffic routing

Domain: Implement and manage virtual networking — configure VPN Gateway

Question 32: Connecting an on-premises datacenter to Azure

Scenario: An organization needs an encrypted connection between its on-premises VPN device and an Azure virtual network. The solution must use IPsec/IKE tunnels over the Internet and support traffic between on-premises subnets and Azure subnets.

Choose one answer.

  1. Create an Azure VPN gateway in a GatewaySubnet and configure a site-to-site VPN connection
  2. Create an Azure Bastion host in the application subnet
  3. Create an Azure Private DNS zone and link it to the VNet
  4. Create a NAT gateway and associate it with the workload subnet

Correct answer: A — Create an Azure VPN gateway in a GatewaySubnet and configure a site-to-site VPN connection

Explanation: Azure VPN Gateway supports site-to-site VPN connections that use IPsec/IKE to connect on-premises networks to Azure virtual networks. The virtual network must include a dedicated subnet named GatewaySubnet for the gateway resources.

Why the other options are wrong

  • B. Azure Bastion provides RDP/SSH access to VMs; it does not create site-to-site network connectivity.
  • C. Private DNS handles name resolution, not encrypted network tunnels.
  • D. NAT Gateway provides outbound Internet connectivity for subnets; it is not a VPN service.

Official reference: About Azure VPN Gateway

Domain: Implement and manage virtual networking — configure network security groups

Question 33: Allowing HTTPS while blocking other inbound Internet traffic

Scenario: A subnet contains web servers behind a public load balancer. The security team requires that Internet clients can reach the servers only on TCP port 443. All other inbound Internet traffic to the subnet should be blocked.

Choose one answer.

  1. Create an inbound NSG rule with a higher priority number than the default deny rule to allow TCP 443 from Internet
  2. Create an inbound NSG rule with a lower priority number that allows TCP 443 from Internet, and rely on the default deny inbound rule for other Internet traffic
  3. Create an outbound NSG rule that allows TCP 443 to Internet
  4. Create a route table with a next hop type of Internet for 0.0.0.0/0

Correct answer: B — Create an inbound NSG rule with a lower priority number that allows TCP 443 from Internet, and rely on the default deny inbound rule for other Internet traffic

Explanation: NSG rules are processed by priority, where lower numbers are evaluated first. An explicit inbound allow rule for TCP 443 from Internet should have a priority that is evaluated before lower-priority deny rules. Unmatched inbound Internet traffic is blocked by default security rules.

Why the other options are wrong

  • A. A higher priority number is evaluated later. A rule cannot override an earlier matching deny rule.
  • C. Outbound rules do not permit inbound client connections.
  • D. A route table controls next hops; it does not filter ports.

Official reference: Azure network security groups overview

Domain: Implement and manage virtual networking — configure secure VM access

Question 34: Admin access without public VM IP addresses

Scenario: Administrators need to connect to Azure VMs by using RDP and SSH from the Azure portal. The VMs must not have public IP addresses, and inbound RDP/SSH ports must not be exposed to the Internet.

Choose one answer.

  1. Deploy Azure Bastion to the virtual network
  2. Add a public IP address to each VM and restrict access by source IP
  3. Create a storage account private endpoint
  4. Enable accelerated networking on the VM NICs

Correct answer: A — Deploy Azure Bastion to the virtual network

Explanation: Azure Bastion provides browser-based and client-based RDP/SSH connectivity to VMs over private IP addresses. The VMs do not need public IP addresses, and RDP/SSH ports do not need to be exposed directly to the Internet.

Why the other options are wrong

  • B. Public IPs violate the requirement, even if restricted by source IP.
  • C. A storage private endpoint is for private access to a storage account, not VM administrator sessions.
  • D. Accelerated networking improves VM networking performance; it does not provide secure administrative access.

Official reference: What is Azure Bastion?

Domain: Implement and manage virtual networking — configure private endpoints and private DNS

Question 35: Resolving a storage account to a private IP address

Scenario: A storage account is accessed by application VMs in VNet1. The security team wants the VMs to connect to the storage account over a private IP address in VNet1. The application should continue using the storage account’s standard DNS name.

Choose one answer.

  1. Create a private endpoint for the storage account and configure the appropriate Azure Private DNS zone linked to VNet1
  2. Create a public IP prefix and assign it to the storage account
  3. Create a NAT gateway and associate it with the VM subnet
  4. Enable boot diagnostics on each VM

Correct answer: A — Create a private endpoint for the storage account and configure the appropriate Azure Private DNS zone linked to VNet1

Explanation: A private endpoint gives the PaaS resource a private IP address from the virtual network. Private DNS is used so the service’s normal DNS name resolves to the private endpoint IP address from the linked VNet.

Why the other options are wrong

  • B. Public IP prefixes are for reserving public IP addresses, not private PaaS connectivity.
  • C. NAT Gateway affects outbound Internet connectivity; it does not create a private IP endpoint for Storage.
  • D. Boot diagnostics has no effect on service connectivity or DNS resolution.

Official reference: What is a private endpoint? and Azure Private DNS overview

Domain: Implement and manage virtual networking — configure user-defined routes

Question 36: Sending outbound subnet traffic through Azure Firewall

Scenario: A workload subnet currently sends outbound Internet traffic directly to the Internet. The company deploys Azure Firewall in a hub VNet and wants all outbound traffic from the workload subnet to be inspected by the firewall before leaving Azure.

Choose one answer.

  1. Associate a route table with the workload subnet that has a 0.0.0.0/0 route to the firewall private IP with next hop type Virtual appliance
  2. Associate a route table with a 0.0.0.0/0 route to next hop type VNet peering
  3. Create an inbound NSG rule that allows TCP 443 from Internet
  4. Enable a private endpoint for the workload subnet

Correct answer: A — Associate a route table with the workload subnet that has a 0.0.0.0/0 route to the firewall private IP with next hop type Virtual appliance

Explanation: User-defined routes override Azure’s default system routes when they are more specific or applicable. To force outbound traffic through Azure Firewall or another network virtual appliance, use a route table with the firewall private IP as the next hop of type Virtual appliance.

Why the other options are wrong

  • B. “VNet peering” is not the next hop used to send traffic to a firewall appliance.
  • C. An inbound NSG rule does not change the outbound path.
  • D. Private endpoints provide private access to a specific service, not general outbound traffic inspection.

Official reference: Azure virtual network traffic routing

Domain: Implement and manage virtual networking — configure Azure Load Balancer

Question 37: Distributing TCP traffic across healthy VM instances

Scenario: A set of VMs hosts a custom TCP application on port 8443. The administrator needs a regional Layer 4 load-balancing solution that forwards traffic only to healthy backend instances based on a probe.

Choose one answer.

  1. Azure Load Balancer with a backend pool, load-balancing rule, and health probe
  2. Azure Private DNS zone with autoregistration enabled
  3. Azure Application Gateway with path-based routing only
  4. Azure Bastion with native client support

Correct answer: A — Azure Load Balancer with a backend pool, load-balancing rule, and health probe

Explanation: Azure Load Balancer operates at Layer 4 and distributes TCP or UDP traffic to backend instances. Health probes determine whether backend instances should receive traffic.

Why the other options are wrong

  • B. Private DNS resolves names; it does not distribute traffic.
  • C. Application Gateway is a Layer 7 web traffic load balancer. It is not the best fit for a generic custom TCP application.
  • D. Bastion is for administrator access to VMs, not application load balancing.

Official reference: What is Azure Load Balancer?

Domain: Implement and manage virtual networking — configure application routing

Question 38: Routing web requests by URL path and adding WAF protection

Scenario: A web application has two backend pools. Requests to /images/* should route to image servers, and requests to /api/* should route to API servers. The solution should also support web application firewall protection.

Choose one answer.

  1. Azure Application Gateway with path-based routing and WAF tier
  2. Azure Load Balancer with an inbound NAT rule
  3. Azure VPN Gateway with BGP enabled
  4. Azure DNS private zone with two A records

Correct answer: A — Azure Application Gateway with path-based routing and WAF tier

Explanation: Azure Application Gateway is a Layer 7 web traffic load balancer that supports URL path-based routing and can include Web Application Firewall capabilities. That matches both the routing and protection requirements.

Why the other options are wrong

  • B. Azure Load Balancer works at Layer 4 and does not make routing decisions based on HTTP URL paths.
  • C. VPN Gateway provides network connectivity, not web request routing.
  • D. DNS records can point clients to addresses, but DNS does not inspect URL paths or provide WAF protection.

Official reference: What is Azure Application Gateway?

Domain: Implement and manage virtual networking — troubleshoot network access

Question 39: Finding whether an NSG is blocking traffic

Scenario: A VM cannot receive HTTPS traffic from a specific source IP address. The administrator suspects an NSG rule is blocking the flow and wants to test whether traffic is allowed or denied for the VM NIC, protocol, source, destination, and port.

Choose one answer.

  1. Use Network Watcher IP flow verify
  2. Use Azure Cost Management budgets
  3. Use Azure Storage lifecycle management
  4. Use VM boot diagnostics screenshot only

Correct answer: A — Use Network Watcher IP flow verify

Explanation: Network Watcher IP flow verify checks whether a packet is allowed or denied to or from a VM based on direction, protocol, local and remote IP, and port. It also identifies the security rule that allows or denies the traffic.

Why the other options are wrong

  • B. Budgets help manage spending, not network packet evaluation.
  • C. Lifecycle management manages blob data retention and tiering.
  • D. Boot diagnostics can help troubleshoot VM startup, but it does not evaluate NSG rule decisions.

Official reference: Azure Network Watcher IP flow verify overview

Domain: Implement and manage virtual networking — configure virtual network peering

Question 40: Peering virtual networks with overlapping address spaces

Scenario: VNetA uses the address space 10.20.0.0/16. VNetB also uses 10.20.0.0/16. An administrator attempts to create VNet peering between them, but the configuration fails. The business requires private connectivity between workloads in both VNets.

Choose one answer.

  1. Change one VNet to a non-overlapping address space before creating the peering
  2. Add an NSG rule that allows source VirtualNetwork and destination VirtualNetwork
  3. Create a private DNS zone named 10.20.0.0
  4. Enable Azure Bastion in both VNets

Correct answer: A — Change one VNet to a non-overlapping address space before creating the peering

Explanation: Azure virtual networks that are peered cannot have overlapping address spaces. The address ranges must be unique so Azure can route traffic correctly between the networks.

Why the other options are wrong

  • B. NSG rules filter allowed traffic but cannot fix overlapping address ranges.
  • C. Private DNS affects name resolution, not IP route ambiguity.
  • D. Bastion provides administrative access to VMs; it does not enable peering for overlapping networks.

Official reference: Azure Virtual Network peering

Answer key: AZ-104 Questions 31-40

Question Correct answer Objective/domain
31 B Implement and manage virtual networking — hub-and-spoke routing
32 A Implement and manage virtual networking — VPN Gateway
33 B Implement and manage virtual networking — NSG priority and inbound rules
34 A Implement and manage virtual networking — Azure Bastion
35 A Implement and manage virtual networking — private endpoints and DNS
36 A Implement and manage virtual networking — user-defined routes
37 A Implement and manage virtual networking — Azure Load Balancer
38 A Implement and manage virtual networking — Application Gateway and WAF
39 A Implement and manage virtual networking — Network Watcher troubleshooting
40 A Implement and manage virtual networking — VNet peering address spaces
Watch out: AZ-104 networking questions often hide the answer in one adjective. Private service access is not the same as secure admin access. Layer 4 TCP is not the same as HTTP path routing. And overlapping CIDR ranges are not a “try harder” problem — they are a redesign problem.

Sources

📚 More questions from: AZ-104: Azure Administrator

Related QuestionMORE FROM AUTHOR