Microsoft AZ-104 Practice Test 18
Question 170
A subnet creation fails because its prefix extends outside the parent VNet CIDR. What must be corrected?
- Renumber a distant peering partner instead of correcting a new subnet prefix that falls outside this VNet's CIDR.
- Choose a subnet CIDR fully contained in the parent VNet address space.
- Rename or create the dedicated subnet with the exact AzureBastionSubnet name and supported prefix.
- Set the NIC IP configuration's private IP allocation method to Static with an available subnet address.
Explanation
Correct Answer
B:Subnet prefixes must be subsets of a VNet's configured address ranges. An adjacent private prefix outside the VNet is invalid.
Incorrect Answers
A:A subnet must be contained within its own VNet address blocks. Modifying another network's addresses doesn't repair an invalid local subnet definition.
C:Azure Bastion discovers its required subnet by specific naming. An arbitrary subnet alias cannot replace it.
D:Static private IP allocation makes the address stable across supported VM lifecycle events. DNS records must agree with the NIC configuration.
Question 171
An admin wants to grow one VNet without replacing the network. What configuration supports multiple address blocks?
- Select a subnet prefix within the VNet's declared 10.4.0.0/16 space.
- Add a supported nonoverlapping address space prefix to the VNet.
- Create subnets outside the current VNet prefix without first adding the needed VNet address block.
- Use supported BGP-propagated gateway routes with appropriate virtual network gateway configuration.
Explanation
Correct Answer
B:Azure VNets can have multiple address spaces, subject to overlap, peerings and service constraints. Routing and existing subnets must be reviewed.
Incorrect Answers
A:A subnet must be fully contained within one of the VNet address prefixes. Private addressing alone does not make the prefix eligible.
C:Subnet definitions must be contained within declared VNet address spaces. Add a supported nonoverlapping VNet prefix before provisioning subnets in it.
D:Gateway-learned routes can appear in subnet effective routes under supported propagation and topology. A random public IP rule cannot establish private routing.
Question 172
After adding a VNet address range, peered clients cannot route to new subnet prefixes. What should be checked?
- Add another subnet locally but never synchronize the remote peering with the VNet's changed address range.
- Review peering address-space synchronization and effective route propagation.
- Compare every existing and proposed VNet CIDR before applying peering or expansion.
- Bind the application listener and guest network interface to the secondary private IP as required.
Explanation
Correct Answer
B:Peering connections may need synchronization after address changes. A new address prefix must be represented in the reachable topology. This matters here because after adding a VNet address range, peered clients cannot route to new subnet prefixes.
Incorrect Answers
A:A new subnet doesn't update a peer's knowledge of an added VNet prefix. Synchronize peering and inspect effective routes after the address-space change.
C:Unique address ranges prevent ambiguous routes and unsupported peering. Address plans must account for future subnet growth.
D:Azure IP configuration and guest OS listener binding are separate. The guest must accept traffic for the assigned address.
Question 173
A cloud network uses 10.9.0.0/24 and needs two equally sized subnets. Which prefix size should each subnet use?
- Split the /24 into two distinct /25 subnet ranges.
- Define 10.9.0.0/24 and 10.9.0.128/25 as equal, nonoverlapping child subnets.
- Select a subnet prefix within the VNet's declared 10.4.0.0/16 space.
- Call 10.9.0.0/24 and 10.9.0.128/25 two equal disjoint halves of the original /24.
Explanation
Correct Answer
A:Each one-bit prefix increase halves the address block, producing two equal /25 networks. Azure reserves several addresses in every subnet.
Incorrect Answers
B:The /24 includes every address in the /25, so these definitions overlap and have unequal sizes. Two distinct /25 prefixes divide the /24 evenly.
C:A subnet must be fully contained within one of the VNet address prefixes. Private addressing alone does not make the prefix eligible. This matters here because a cloud network uses 10.9.0.0/24 and needs two equally sized subnets. Which prefix size should each subnet use.
D:The first prefix contains the second, so the proposed pair overlaps and cannot be used as distinct equal halves. Separate /25 subnet ranges fit.
Question 174
A /25 subnet contains 128 total IPv4 addresses but Azure reports fewer usable. Why?
- Account for Azure's five reserved IP addresses per IPv4 subnet.
- Select a subnet prefix within the VNet's declared 10.4.0.0/16 space.
- Inspect the route table's subnet association and effective routes on the VM NIC.
- Add secondary private IP configurations to a supported Azure network interface.
Explanation
Correct Answer
A:Azure reserves the first four and last address in each subnet. Usable host count is lower than raw CIDR size.
Incorrect Answers
B:A subnet must be fully contained within one of the VNet address prefixes. Private addressing alone does not make the prefix eligible. This matters here because a /25 subnet contains 128 total IPv4 addresses but Azure reports fewer usable. Why.
C:A route table has no effect until associated with the source subnet. Effective route inspection shows the selected next hop.
D:A NIC can hold multiple private IP configurations within applicable subnet and SKU limits. Each assigned address must be available.
Question 175
A web VM should accept HTTPS from the Internet but deny unrelated inbound traffic. Which Azure network rule set is appropriate?
- Associate its network interface IP configuration with the correct application security group.
- Require Azure Bastion or an approved private access path and remove general public SSH rules.
- Apply a network security group with a priority allow for TCP 443 and restrictive default behavior.
- Add a higher-priority narrow allow for HTTPS and retain the default deny.
Explanation
Correct Answer
C:NSGs filter traffic by source, destination, protocol and port. A broad AllowAny rule would expose unnecessary services.
Incorrect Answers
A:ASG membership is explicit at the NIC IP configuration. Joining the same subnet does not automatically join an ASG.
B:Private management paths reduce the VM's direct attack surface. SSH keys alone do not make a public SSH endpoint private.
D:A specific allow evaluated before the default deny admits only the intended port/source combination. Removing the default deny would widen exposure.
Question 176
Two NSG rules match incoming HTTPS traffic: priority 200 deny and priority 300 allow. Which decision applies?
- Recognize flow logs summarize network conversations and do not expose encrypted payload contents.
- Both subnet and NIC NSG evaluations must permit the connection; one allow cannot bypass another deny.
- Give the specific deny rule a higher processing precedence than the broader outbound allow.
- The lower numerical priority 200 deny rule is evaluated first.
Explanation
Correct Answer
D:NSG priorities process lower numbers first; evaluation stops at the first matching rule. An allow at a later priority cannot override an earlier match.
Incorrect Answers
A:Flow telemetry supports traffic-path analysis, not full packet inspection or decryption. Packet capture requires separately authorized diagnostics.
B:NSG evaluation occurs at all applicable levels. The effective packet decision reflects combined constraints.
C:NSG decisions are priority ordered; the first matching rule wins. An earlier broad allow can shadow a later deny.
Question 177
An application subnet needs a common inbound security policy for several VMs. Where can an NSG be associated?
- Associate a suitable network security group with the subnet.
- Restrict the destination to the intended NIC, IP or application security group.
- Associate its network interface IP configuration with the correct application security group.
- Create an Azure Storage private endpoint to apply a common inbound access policy to several VM network interfaces.
Explanation
Correct Answer
A:Subnet-level NSGs apply to traffic entering or leaving its NICs, with any NIC NSGs also evaluated as applicable.
Incorrect Answers
B:Subnet-level Any destination can affect multiple servers. Matching the intended destination prevents overly broad access.
C:ASG membership is explicit at the NIC IP configuration. Joining the same subnet does not automatically join an ASG. This matters here because an application subnet needs a common inbound security policy for several VMs. Where can an NSG be associated.
D:Private endpoints provide service-specific private connectivity; they don't replace subnet or NIC NSG assignments. Associate an appropriate NSG with the VM subnet for shared inbound filtering.
Question 178
A VM unexpectedly denies TCP 1433 despite its NIC NSG allowing it. What other NSG must be evaluated?
- Check storage firewall network rules to permit the service-endpoint-enabled subnet.
- Review the subnet NSG as well as the NIC NSG and effective security rules.
- Restrict the destination to the intended NIC, IP or application security group.
- Inspect Network Watcher effective security rules for the target VM NIC.
Explanation
Correct Answer
B:Both subnet and NIC NSGs can restrict connectivity. One allow rule does not override a deny in another applicable group.
Incorrect Answers
A:Enabling a service endpoint alone does not authorize a subnet in every storage account. The service firewall must allow it.
C:Subnet-level Any destination can affect multiple servers. Matching the intended destination prevents overly broad access. This matters here because a VM unexpectedly denies TCP 1433 despite its NIC NSG allowing it. What other NSG must be evaluated.
D:Effective security rules show merged applicable NSG rules and their priorities. Reading one configured NSG can miss another filtering point.
Question 179
A team wants NSG rules to target web VMs without listing each individual VM address. Which Azure object can represent membership?
- Run Network Watcher IP flow verify for the VM and packet tuple.
- Inspect Network Watcher effective security rules for the target VM NIC.
- Recognize flow logs summarize network conversations and do not expose encrypted payload contents.
- Create an application security group and reference it in relevant NSG rules.
Explanation
Correct Answer
D:ASGs group supported NIC configurations for use as security rule source or destination. Membership changes avoid editing IP lists.
Incorrect Answers
A:IP flow verify evaluates traffic against effective Azure security rules and reports an allow or deny rule. It is a diagnostic, not a rule mutation.
B:Effective security rules show merged applicable NSG rules and their priorities. Reading one configured NSG can miss another filtering point. This matters here because a team wants NSG rules to target web VMs without listing each individual VM address. Which Azure object can….
C:Flow telemetry supports traffic-path analysis, not full packet inspection or decryption. Packet capture requires separately authorized diagnostics. This matters here because a team wants NSG rules to target web VMs without listing each individual VM address. Which Azure object can….
Question 180
A VM recently moved to a different ASG but traffic still follows old expected permissions. What should be inspected?
- Restrict the destination to the intended NIC, IP or application security group.
- Confirm the VM NIC's ASG membership and the NSG rules referencing that group.
- Check storage firewall network rules to permit the service-endpoint-enabled subnet.
- ASG membership is a NIC configuration, not automatic matching from resource tags.
Explanation
Correct Answer
B:ASG filtering depends on NIC membership and matching rule definitions. A VM resource tag alone does not assign it to an ASG.
Incorrect Answers
A:Subnet-level Any destination can affect multiple servers. Matching the intended destination prevents overly broad access. This matters here because a VM recently moved to a different ASG but traffic still follows old expected permissions.
C:Enabling a service endpoint alone does not authorize a subnet in every storage account. The service firewall must allow it. This matters here because a VM recently moved to a different ASG but traffic still follows old expected permissions.
D:Azure resource tags and application security group membership are separate constructs. Tags cannot substitute for joining an ASG.
