All Domains

Implement and Manage Virtual Networking

Choose a question set below to start practicing.

1

Set 1

20 questions • ~20 min

Start Set 1
2

Set 2

20 questions • ~20 min

Start Set 2
3

Set 3

20 questions • ~20 min

Start Set 3
4

Set 4

20 questions • ~20 min

Start Set 4
5

Set 5

20 questions • ~20 min

Start Set 5
6

Set 6

20 questions • ~20 min

Start Set 6
7

Set 7

20 questions • ~20 min

Start Set 7
8

Set 8

16 questions • ~20 min

Start Set 8

All Questions

156 questions

Start All

Quick Drill

15 questions • ~15 min

Quick Drill
Choose Different Domain

Sample AZ-104 Implement and Manage Virtual Networking questions with explanations

Use these examples to check how the topics are tested. Read the explanation for every option you were unsure about, then start a scored practice set above.

Question 1 Implement and manage virtual networking

An administrator is troubleshooting connectivity to an Azure VM. The VM has a Network Security Group (NSG) attached to its subnet with a custom inbound rule (priority 100) allowing RDP from the internet. The VM's network interface also has an NSG with a custom inbound rule (priority 200) denying all traffic. The default NSG rules are present. According to Azure's NSG rule processing, what is the effective security rule for an inbound RDP connection attempt from the internet?

  • ○ Allow, because the subnet NSG rule with priority 100 is processed first and matches.
  • ✓ Deny, because the NIC NSG rule with priority 200 is processed after the subnet NSG and matches.
  • ○ Deny, because the NIC NSG rule with higher priority number (200) overrides the subnet NSG rule.
  • ○ Allow, because NSG rules are evaluated independently per NSG and the subnet NSG allows it.
Answer: B. Deny, because the NIC NSG rule with priority 200 is processed after the subnet NSG and matches.
The correct answer is B. For inbound traffic, Azure processes rules in the subnet NSG first, then rules in the NIC NSG. Within each NSG, rules are processed in priority order (lower number first). The subnet NSG has an allow rule (priority 100). The NIC NSG has a deny rule (priority 200). Traffic is first evaluated against the subnet NSG, where it matches the allow rule and would be permitted at that stage. However, the traffic then passes to the NIC NSG for evaluation. Here, it matches the deny rule (priority 200). Since the deny rule is the first matching rule in the NIC NSG (and there are no higher priority allow rules in that NSG), the traffic is denied. The effective rule is the final result after evaluation through both NSGs, which is Deny. Option A is incorrect because processing does not stop after the subnet NSG. Option C is incorrect because the priority number comparison is only meaningful within a single NSG; the rule with priority 200 in the NIC NSG does not 'override' the subnet rule based on priority number across NSGs. Option D is incorrect because NSG rules are not independent; they are evaluated sequentially (subnet then NIC for inbound).
Question 2 Implement and manage virtual networking

Which Azure service/feature is Virtual Network Gateway?

  • ✓ VNet Gateway
  • ○ VPN Gateway
  • ○ Peering
  • ○ ExpressRoute
Answer: A. VNet Gateway
VNet Gateway is correct.
Question 3 Implement and manage virtual networking

Which Azure networking service private ip for paas service?

  • ○ VPN Gateway
  • ○ Service Endpoint
  • ✓ Private Endpoint
  • ○ VNet Peering
Answer: C. Private Endpoint
Private Endpoint: Private IP for PaaS service.
Question 4 Implement and manage virtual networking

Which Azure service/feature is private DNS?

  • ✓ Private DNS
  • ○ Azure DNS
  • ○ Front Door
  • ○ Traffic Manager
Answer: A. Private DNS
Private DNS is correct.
Question 5 Implement and manage virtual networking

Which routing concept default azure routes?

  • ○ Route table
  • ○ UDR
  • ✓ System route
  • ○ BGP
Answer: C. System route
System route: Default Azure routes.
Question 6 Implement and manage virtual networking

Which Azure networking service managed firewall service and is used for layer 7 filtering, threat intel?

  • ✓ Azure Firewall
  • ○ Azure DNS
  • ○ VPN Gateway
  • ○ Azure CDN
Answer: A. Azure Firewall
Azure Firewall: Managed firewall service. Use: Layer 7 filtering, threat intel.
Question 7 Implement and manage virtual networking

An administrator creates a Network Security Group (NSG) named NSG-Prod and associates it with the subnet containing several virtual machines. The NSG has a single inbound rule: Rule 100, which allows TCP port 3389 from the Internet. A user reports they cannot RDP to a VM in the subnet from their on-premises network, which has a public IP of 203.0.113.10. The VM has a public IP assigned, and the on-premises firewall is correctly configured. What is the MOST likely reason for the connection failure?

  • ○ The VM's operating system firewall is blocking port 3389.
  • ○ The NSG's default inbound rule 'DenyAllInbound' is blocking the traffic.
  • ✓ An effective security rule from another NSG associated with the VM's NIC is denying the traffic.
  • ○ The NSG rule priority is set too low, causing it to be overridden.
Answer: C. An effective security rule from another NSG associated with the VM's NIC is denying the traffic.
The correct answer is C because effective security rules for a network interface are a combination of rules from any NSG associated with the subnet *and* the NIC itself. If another NSG with higher-priority deny rules is associated directly with the VM's NIC, it would block the traffic, even if the subnet NSG allows it. Option A is possible but not the *most likely* reason given the Azure-centric scenario; the question focuses on NSG configuration. Option B is incorrect because custom rules (like Rule 100) always override default rules; the default DenyAllInbound has a priority of 65500, so Rule 100 (priority 100) would take precedence and allow the traffic. Option D is incorrect; a lower priority number means higher precedence, so Rule 100 with priority 100 is a high-priority rule and would not be overridden by a default rule.
Question 8 Implement and manage virtual networking

Which Azure network distributes Layer 4 traffic?

  • ✓ Load Balancer
  • ○ Traffic Manager
  • ○ Front Door
  • ○ App Gateway
Answer: A. Load Balancer
Load Balancer is correct.
Question 9 Implement and manage virtual networking

Which Azure service/feature is managed load balancer?

  • ○ Front Door
  • ○ Traffic Manager
  • ○ Application Gateway
  • ✓ Azure Load Balancer
Answer: D. Azure Load Balancer
Azure Load Balancer is correct.. This Azure service is part of Microsoft's cloud platform. It integrates with other Azure services and supports features like RBAC, resource tagging, and Azure Policy for governance.
Question 10 Implement and manage virtual networking

Which Azure feature provides a private IP address from your VNet to an Azure PaaS service, eliminating the need for a public endpoint?

  • ○ VNet peering
  • ✓ Private Link / Private Endpoint
  • ○ Service endpoint
  • ○ NSG
Answer: B. Private Link / Private Endpoint
Private Link and Private Endpoints provide private connectivity to Azure PaaS services. Service endpoints extend VNet identity to Azure services but still use public IPs, and NSGs filter traffic.
Question 11 Implement and manage virtual networking

A technician is configuring a Site-to-Site VPN connection between an on-premises network and an Azure VNet. The on-premises VPN device uses IKEv2 and supports AES256 and SHA256. When creating the connection resource in Azure, which combination of IPsec/IKE policy parameters should the technician specify for Phase 1 (IKE)?

  • ○ DH Group 2, Integrity SHA1, Encryption AES256
  • ✓ DH Group 14, Integrity SHA256, Encryption AES256
  • ○ DH Group 1, Integrity MD5, Encryption 3DES
  • ○ DH Group 24, Integrity SHA384, Encryption GCMAES256
Answer: B. DH Group 14, Integrity SHA256, Encryption AES256
The correct answer is B because it specifies a strong, modern cipher suite that matches the on-premises device's capabilities (AES256 and SHA256) and uses a strong Diffie-Hellman group (DH Group 14). Option A is incorrect because SHA1 is a weaker integrity algorithm and does not match the specified SHA256 support. Option C is incorrect because it uses deprecated algorithms (MD5, 3DES) and a weak DH group (1). Option D is incorrect because while GCMAES256 is a valid encryption for IPsec policies, the question specifies the on-premises device supports AES256, and DH Group 24 is for Phase 2 (IPsec), not Phase 1 (IKE). For IKE Phase 1, common DH groups are 2, 14, 24, etc., but the integrity and encryption must match the device.
Question 12 Implement and manage virtual networking

Which Azure routing concept default routes created by azure?

  • ○ BGP
  • ✓ System route
  • ○ UDR
  • ○ Route table
Answer: B. System route
System route: Default routes created by Azure.
Question 13 Implement and manage virtual networking

Which Azure networking service private connectivity to azure and is used for dedicated, not over internet?

  • ✓ ExpressRoute
  • ○ Network Security Group
  • ○ Azure Firewall
  • ○ Azure CDN
Answer: A. ExpressRoute
ExpressRoute: Private connectivity to Azure. Use: Dedicated, not over internet.
Question 14 Implement and manage virtual networking

Which Azure network is DNS-based global LB?

  • ○ Front Door
  • ○ App Gateway
  • ○ Load Balancer
  • ✓ Traffic Manager
Answer: D. Traffic Manager
Traffic Manager is correct.
Question 15 Implement and manage virtual networking

Which Azure networking service segment of a vnet and is used for ip range allocation and isolation?

  • ○ Azure Firewall
  • ○ Virtual Network (VNet)
  • ○ Network Security Group
  • ✓ Subnet
Answer: D. Subnet
Subnet: Segment of a VNet. Use: IP range allocation and isolation.

Open the full AZ-104 Implement and Manage Virtual Networking question-and-answer guide