Implement and manage virtual networking

AZ-104 · 40 questions

• Cascade Regional Airlines' network architects are provisioning a new Azure VNet for the crew-scheduling tier. The airline's on-premises data center already uses 10.10.0.0/16, and the VNet will connect to it over ExpressRoute. Which address space should the architects choose for the new VNet to avoid a routing conflict?
• The kiosk team at Cascade Regional Airlines requests a /28 subnet for the airport check-in kiosks. How many usable host IP addresses will that subnet actually provide once Azure's reserved addresses are accounted for?
• A Cascade Regional Airlines engineer configures an NSG for the public booking subnet with two inbound custom rules: priority 100 named 'Deny-All' and priority 200 named 'Allow-HTTPS'. The engineer created the Allow-HTTPS rule first and added the Deny-All rule afterward, but HTTPS traffic to the subnet is now blocked. Why?
• Cascade Regional Airlines just created a network security group for the crew-scheduling subnet without adding any custom rules yet. A VM in a different subnet of the same virtual network needs to reach a VM in the crew-scheduling subnet. Will that traffic be allowed?
• The kiosk subnet at Cascade Regional Airlines only needs to send data out to the booking API over HTTPS; the kiosks should never be able to initiate any other outbound connection. Where should this restriction be configured?
• Cascade Regional Airlines applies a network security group to both the outstation-office subnet and the network interface of a specific VM within that subnet. For inbound traffic reaching that VM, in what order are the two NSGs evaluated?
• Cascade Regional Airlines wants an NSG rule that allows the reservations-app VMs to reach the payment-processing VMs on port 443, without hardcoding IP addresses since those VMs are added and removed as the fleet autoscales. What should the rule use as its source and destination?
• Cascade Regional Airlines peers VNet A (headquarters) with VNet B (an outstation office), and separately peers VNet B with VNet C (a maintenance depot). No peering exists directly between VNet A and VNet C. Can a VM in VNet A reach a VM in VNet C by routing through VNet B?
• Cascade Regional Airlines has an ExpressRoute gateway deployed in the headquarters VNet and wants the outstation-office VNet, which is peered to headquarters, to reach on-premises resources through that same gateway instead of deploying a second ExpressRoute gateway. What must be configured to allow this?
• Cascade Regional Airlines wants to peer its headquarters VNet in East US with a new VNet in West Europe that will support the outstation office there. What is required for this cross-region peering to succeed?
• Cascade Regional Airlines needs a public IP for its booking-tier load balancer that is zone-redundant and denies all inbound traffic by default unless an NSG explicitly allows it. Which SKU should they choose, and why?
• The outstation office's on-premises firewall references its Azure VPN gateway's public IP address by its exact numeric value, so that address must never change. Which public IP allocation method must be assigned to the gateway?
• VMs in the crew-scheduling subnet at Cascade Regional Airlines need a stable, predictable outbound public IP address for connecting to a third-party scheduling API, but the subnet must not expose any inbound public endpoint. What should be attached to the subnet to meet this need?
• Cascade Regional Airlines wants to connect its new outstation office's on-premises router to its Azure VNet over an encrypted tunnel across the public internet, without provisioning any dedicated private circuit. Which connection type should they configure?
• A Cascade Regional Airlines network engineer is traveling and needs to connect a single laptop directly to the crew-scheduling VNet from a hotel network, without any on-premises VPN hardware available. Which connection type fits this need?
• Cascade Regional Airlines' compliance team requires that traffic between the headquarters data center and Azure never traverse the public internet under any circumstances. Which connectivity option meets this requirement?
• Cascade Regional Airlines wants VMs in the booking-tier subnet to reach an Azure Storage account using a private IP address from the VNet's own address space, with the storage account fully removed from public exposure. What should they implement?
• Cascade Regional Airlines wants to restrict an Azure SQL Database's firewall so it only accepts connections originating from the crew-scheduling subnet, while traffic still travels over the Azure backbone to the database's existing public endpoint, with no new network interface or private IP address required. Which feature satisfies this?
• Cascade Regional Airlines needs a subnet for the maintenance depot with room for at least 100 usable host addresses, sized as efficiently as possible once Azure's reserved addresses are taken into account. Which CIDR prefix should they use?
• Cascade Regional Airlines' VNet is 10.30.0.0/16. The team has already created 10.30.0.0/24 for the public booking tier and 10.30.1.0/24 for crew-scheduling. Which of the following ranges can be safely used for a new airport-kiosk subnet without overlapping either existing subnet?
• Cascade Regional Airlines is rebuilding its public booking site behind an Azure Load Balancer that fronts identical web farms in the Denver and Boise regions, and the network team wants the load balancer's frontend to keep working even if an entire availability zone in a region goes down. Which load balancer SKU must they choose to get zone-redundant frontend IP configurations?
• An engineer at Cascade Regional Airlines needs temporary RDP access to troubleshoot one specific backend virtual machine behind a Standard Load Balancer, without disturbing the load-balancing rule that spreads HTTPS booking traffic across the whole backend pool. Which load balancer feature should map a distinct frontend port straight to RDP on that single VM?
• Gate-agent kiosks at Cascade Regional Airlines' Seattle hub intermittently freeze because the Standard Load Balancer keeps sending traffic to a backend VM that crashed hours ago and never came back online. Which load balancer component should the network team configure so unhealthy instances are automatically pulled out of rotation?
• During a fare-sale spike, Cascade Regional Airlines notices that shopping-cart state built up on one backend web server is being lost mid-checkout because a customer's follow-up requests keep landing on a different VM behind the Standard Load Balancer. Which load balancer setting should route all of that customer's requests back to the same backend instance for the duration of the session?
• Cascade Regional Airlines wants a single Application Gateway to send requests for /booking to its web-farm backend pool and requests for /api to its internal reservations API backend pool, all behind one public IP and hostname. Which Application Gateway feature accomplishes this split?
• Cascade Regional Airlines wants to publish both its public booking site (booking.cascaderegional.com) and a separate partner portal (partners.cascaderegional.com) through the same Application Gateway public IP, with each hostname routed to its own backend pool. Which Application Gateway feature makes this possible?
• After enabling the WAF policy on Cascade Regional Airlines' Application Gateway in Prevention mode, the security team notices legitimate booking submissions from a partner travel agency are being blocked, and they need to understand what's triggering the block before re-enabling strict enforcement. What should they do first?
• Cascade Regional Airlines' internal reservations API only needs to be reachable from clients inside its own VNet, and the platform team wants Layer 7 path-based routing and a WAF applied to that internal traffic without exposing anything to the public internet. Which service fits this requirement?
• Cascade Regional Airlines wants to give global customers a single hostname for its booking site that accelerates HTTPS traffic at the network edge, applies a WAF close to the user, and can fail over between regional backends, rather than simply resolving a DNS name to whichever region is currently healthy. Which service best fits this need?
• Cascade Regional Airlines runs its booking site primarily out of its East US region, with a fully provisioned but idle standby deployment in West US 2 meant only to take over if East US becomes completely unavailable. Which Traffic Manager routing method should route all traffic to East US under normal conditions and only shift to West US 2 during an outage?
• Cascade Regional Airlines' flight-status lookup service is deployed in both the US and Europe, and the goal is simply to send each customer to whichever deployment gives them the fastest response based on network latency, with no preference for one region over the other. Which Traffic Manager routing method fits this goal?
• Cascade Regional Airlines just created a public Azure DNS zone for cascaderegional.com to host its booking site's records, but external resolvers still aren't finding any of the new records when customers try to reach the site. What step is still missing?
• Cascade Regional Airlines wants its bare root domain, cascaderegional.com (with no subdomain), to resolve directly to its Azure Front Door endpoint, but Front Door only exposes a DNS name rather than a static IP, and DNS standards prohibit a CNAME record at the zone apex. Which Azure DNS record type solves this?
• Cascade Regional Airlines' internal reservations API, running in one VNet, needs to resolve the private endpoint name of a database service that lives in a peered VNet, using a private DNS zone that already contains the correct record. What must be configured on the private DNS zone for the API's VNet to actually query and resolve that name?
• Cascade Regional Airlines' crew-scheduling application scales a pool of worker VMs up and down constantly inside its own VNet, and the platform team wants each new VM to automatically get a resolvable DNS A record in the linked private DNS zone the moment it's created, without any manual record entry. Which private DNS zone setting achieves this?
• Staff at Cascade Regional Airlines' on-premises office in Missoula report they cannot resolve the private-link name of an Azure storage account's private endpoint, and the query instead returns the storage account's public IP address. The privatelink DNS zone in Azure is correctly configured and linked to the VNet. What is most likely missing?
• An engineer at Cascade Regional Airlines suspects a network security group rule is silently blocking traffic from the crew-scheduling app VM to the backend database VM on port 1433, but nothing in the application logs confirms it. Which Network Watcher tool directly tests whether a specific flow between two VMs is allowed or denied, and by which rule?
• Packets from Cascade Regional Airlines' internal API VM destined for the on-premises reservations database are silently failing to arrive, and the network team suspects a misconfigured user-defined route is sending traffic somewhere other than the VPN gateway. Which Network Watcher tool identifies the actual next hop a packet takes toward a given destination?
• A virtual machine in Cascade Regional Airlines' baggage-tracking subnet has both a subnet-level NSG and a NIC-level NSG applied, and the security team is troubleshooting unexpected blocked traffic but isn't sure which combined set of rules is actually being enforced on that VM. Which Network Watcher tool shows the full, merged rule set actually applied to the VM?
• Cascade Regional Airlines' compliance team needs a historical, queryable record of every allowed and denied connection through the NSGs protecting the booking VNet, to support an upcoming security audit. Which Network Watcher feature should be enabled to capture this?