Microsoft AZ-104 Practice Test 48
Question 470
A VM can reach peers but cannot download OS updates after public IP removal. What should be checked?
- Bind the application listener and guest network interface to the secondary private IP as required.
- Inspect hub Allow gateway transit and spoke Use remote gateways settings plus effective routes.
- Verify effective default routes and an explicit supported outbound Internet method.
- Attach an Azure NAT Gateway to the workload subnet for supported outbound connectivity.
Explanation
Correct Answer
C:Removing a public IP can eliminate an implicit egress path. VNet connectivity alone does not guarantee outbound Internet reachability. This matters here because a VM can reach peers but cannot download OS updates after public IP removal.
Incorrect Answers
A:Azure IP configuration and guest OS listener binding are separate. The guest must accept traffic for the assigned address. This matters here because a VM can reach peers but cannot download OS updates after public IP removal.
B:A spoke must opt into supported remote gateway use. Gateway advertisements and route tables also determine reachability. This matters here because a VM can reach peers but cannot download OS updates after public IP removal.
D:NAT Gateway provides outbound SNAT using allocated public addresses while VMs remain privately addressed. This matters here because a VM can reach peers but cannot download OS updates after public IP removal.
Question 471
A team adds a second NIC to a VM to connect two subnets of the same VNet. What configuration should be validated?
- Create AzureBastionSubnet with supported address size and configuration.
- Review NAT Gateway SNAT port capacity, assigned public IPs and connection patterns.
- Remove overlapping subnet definitions and choose disjoint CIDR blocks.
- Verify VM SKU NIC limits and that every NIC connects to an allowed VNet/subnet topology.
Explanation
Correct Answer
D:Azure VM multi-NIC configurations have SKU and network constraints. A NIC cannot arbitrarily attach to every VNet.
Incorrect Answers
A:Azure Bastion requires its dedicated, particularally named subnet in the VNet. Ordinary app subnets are not substitutes.
B:NAT Gateway capacity is finite and depends on allocated IP resources. Excessive concurrent connections can exhaust port availability. This matters here because a team adds a second NIC to a VM to connect two subnets of the same VNet. What configuration should be validated.
C:The /25 occupies part of the /24 range. Azure subnet definitions cannot overlap even if they have different names. This matters here because a team adds a second NIC to a VM to connect two subnets of the same VNet. What configuration should be validated.
Question 472
An operator tries to attach a NIC in a different VNet to the same VM and gets an error. Why?
- Review NSG and endpoint allow rules because Standard public IPs are secure by default.
- Use nonoverlapping VNet address prefixes and check peering conflicts.
- Ensure all NICs for the VM are placed within the supported single-VNet topology.
- Use global VNet peering with supported nonoverlapping address spaces.
Explanation
Correct Answer
C:Azure multi-NIC VMs require compatible NIC placement; attaching a NIC from an unrelated VNet is not a normal supported design.
Incorrect Answers
A:A public address alone does not permit unsolicited traffic. Azure NSG and workload firewall permissions still govern ingress. This matters here because an operator tries to attach a NIC in a different VNet to the same VM and gets an error. Why.
B:A VNet cannot contain conflicting address spaces in ways that undermine subnet allocation and routing. Peering also requires unique address planning. This matters here because an operator tries to attach a NIC in a different VNet to the same VM and gets an error. Why.
D:Global peering connects VNets in different regions over Microsoft's backbone. Costs and special limitations must be reviewed. This matters here because an operator tries to attach a NIC in a different VNet to the same VM and gets an error. Why.
Question 473
An application must be isolated in a delegated subnet used by a managed Azure service. What must be configured?
- Apply the service's supported subnet delegation to the intended subnet.
- Add secondary private IP configurations to a supported Azure network interface.
- Recognize the address may be released on resource deletion and cannot always be recovered.
- Review NSG and endpoint allow rules because Standard public IPs are secure by default.
Explanation
Correct Answer
A:Some Azure platform services require delegated subnets to manage network interfaces or service resources. A generic VNet name does not grant delegation.
Incorrect Answers
B:A NIC can hold multiple private IP configurations within applicable subnet and SKU limits. Each assigned address must be available. This matters here because an application must be isolated in a delegated subnet used by a managed Azure service.
C:Releasing the address resource can return it to the pool. Retaining the IP resource is safer than relying on reacquisition. This matters here because an application must be isolated in a delegated subnet used by a managed Azure service.
D:A public address alone does not permit unsolicited traffic. Azure NSG and workload firewall permissions still govern ingress. This matters here because an application must be isolated in a delegated subnet used by a managed Azure service.
Question 474
Deployment of a managed service to a subnet fails because another incompatible service delegated it. What is the issue?
- Use nonoverlapping VNet address prefixes and check peering conflicts.
- Change only the subnet CIDR while keeping an incompatible service delegation in place.
- Review exclusive delegation and service-specific subnet eligibility requirements.
- Rename or create the dedicated subnet with the exact AzureBastionSubnet name and supported prefix.
Explanation
Correct Answer
C:Subnet delegation constrains which service can manage certain resources in that subnet. Incompatible reuse can block deployment.
Incorrect Answers
A:A VNet cannot contain conflicting address spaces in ways that undermine subnet allocation and routing. Peering also requires unique address planning. This matters here because deployment of a managed service to a subnet fails because another incompatible service delegated it. What is the issue.
B:The failure stems from a subnet already dedicated to another incompatible service. A new CIDR does not resolve exclusive delegation or the target service's subnet requirements.
D:Azure Bastion discovers its required subnet by particular naming. An arbitrary subnet alias cannot replace it.
Question 475
An NSG rule should allow a group of application servers to talk to a group of database servers on TCP 1433. Which abstraction avoids IP-by-IP lists?
- Create application security groups but leave the NSG rule using a broad address prefix without ASG references.
- Place one unrestricted inbound TCP 443 allow rule on the subnet and assume it creates a narrow app-to-database TCP 1433 group mapping.
- Use application security groups as the source and destination in the NSG rule.
- Restrict the destination to the intended NIC, IP or application security group.
Explanation
Correct Answer
C:ASGs simplify policy for dynamic VM NIC membership. Destination ports and direction must still be scoped to the app connection.
Incorrect Answers
A:Creating ASGs alone does not scope the NSG rule. The rule must actually use the applicable ASGs for source and destination so membership, rather than a broad IP prefix, governs selection.
B:The database traffic is on TCP 1433 between defined application and database members. A broad HTTPS rule neither identifies those ASGs nor narrows the database destination.
D:Subnet-level Any destination can affect multiple servers. Matching the intended destination prevents overly broad access. This matters here because an NSG rule should allow a group of application servers to talk to a group of database servers on TCP 1433. Which….
Question 476
A newly deployed DB VM does not match an ASG-based inbound rule. What should be checked?
- Add a catch-all Internet-to-HTTPS allow rule instead of associating the new database NIC with its intended ASG.
- Associate its network interface IP configuration with the correct application security group.
- Associate a suitable network security group with the subnet.
- Use Private Link to required PaaS services with private DNS and enforce egress policy.
Explanation
Correct Answer
B:ASG membership is explicit at the NIC IP configuration. Joining the same subnet does not automatically join an ASG. This matters here because a newly deployed DB VM does not match an ASG-based inbound rule.
Incorrect Answers
A:An NSG cannot match the new NIC as an ASG member if that NIC configuration is not assigned to the group. Fix its ASG association before changing ingress scope.
C:Subnet-level NSGs apply to traffic entering or leaving its NICs, with any NIC NSGs also evaluated as applicable. This matters here because a newly deployed DB VM does not match an ASG-based inbound rule.
D:Private endpoints provide network-level private addresses for supported service resources. Public service endpoints may not meet private-only policy. This matters here because a newly deployed DB VM does not match an ASG-based inbound rule.
Question 477
A subnet has an NSG with a default DenyAllInbound, but a new server should receive only HTTPS. How should exceptions be ordered?
- Add a higher-priority narrow allow for HTTPS and retain the default deny.
- The lower numerical priority 200 deny rule is evaluated first.
- Approve the private endpoint connection through the service owner workflow.
- Configure the HTTPS exception at a numerically higher priority value than the matching DenyAllInbound rule.
Explanation
Correct Answer
A:A specific allow evaluated before the default deny admits only the intended port/source combination. Removing the default deny would widen exposure. This matters here because a subnet has an NSG with a default DenyAllInbound, but a new server should receive only HTTPS.
Incorrect Answers
B:NSG priorities process lower numbers first; evaluation stops at the first matching rule. An allow at a later priority cannot override an earlier match. This matters here because a subnet has an NSG with a default DenyAllInbound, but a new server should receive only HTTPS.
C:A private endpoint can remain unusable until the target service accepts the connection. DNS and routes should be validated after approval. This matters here because a subnet has an NSG with a default DenyAllInbound, but a new server should receive only HTTPS.
D:Lower NSG priority numbers execute first. If the deny matches before the HTTPS allow, the latter cannot permit that inbound flow; choose a valid more-precedent number.
Question 478
An administrator creates a custom Azure network security group rule with priority 4097, and Azure rejects the rule. Which change directly satisfies the priority constraint?
- Keep priority 4097 but change the direction from inbound to outbound because outbound rules permit larger values.
- Keep priority 4097 with a unique rule name; name uniqueness is the only NSG custom-priority constraint.
- Choose priority 50 to make the rule precede the default NSG security rules.
- Assign an unused custom-rule priority from 100 to 4096 inclusive for the requested rule direction.
Explanation
Correct Answer
D:Azure custom NSG security-rule priorities are integers from 100 through 4096 inclusive. Rules use lower numbers first and must not collide with an existing rule of the same direction. Because 4097 exceeds the permitted maximum, replace it with an available value in that interval.
Incorrect Answers
A:Custom NSG priorities use the same permitted numeric range for inbound and outbound security rules. The value 4097 is outside 100 to 4096, so changing direction cannot make this invalid priority acceptable.
B:A unique rule name cannot override the custom-rule priority range. Priority 4097 remains invalid even if no other security rule shares its name or numeric value; use an unused supported priority in the desired direction.
C:Smaller NSG rule priority numbers are evaluated earlier, but custom security rules must not use numbers below 100. Priority 50 is also out of range, so it would not fix the rule creation request.
Question 479
An administrator must block all outbound traffic to a known malicious IP while keeping other outbound Internet access. Which rule should be configured?
- Associate a UDR directing the intended destination prefixes to the firewall appliance.
- Use NSG flow logging or supported virtual-network flow logs for traffic metadata rather than packet payload capture.
- Create a targeted outbound NSG deny matching the malicious destination IP prefix.
- Create an inbound allow for TCP 443 and assume it blocks outbound traffic to the malicious destination IP.
Explanation
Correct Answer
C:A narrow deny can block only the disallowed destination while leaving approved paths intact. A whole-subnet default deny would have a wider effect.
Incorrect Answers
A:User-defined routes can steer subnet traffic to a network appliance. Firewall existence alone does not insert it into the datapath. This matters here because an administrator must block all outbound traffic to a known malicious IP while keeping other outbound Internet….
B:Flow logs provide flow records under supported configurations and destinations. They do not normally record complete packet contents. This matters here because an administrator must block all outbound traffic to a known malicious IP while keeping other outbound Internet….
D:A direction-specific inbound allow does not deny the targeted outbound destination. Configure a higher-precedence outbound deny for that malicious address while preserving intended egress.
Question 480
A malicious IP deny rule does not trigger because another outbound allow at lower numeric priority matches first. What should change?
- Associate a suitable network security group with the subnet.
- Add a higher-priority narrow allow for HTTPS and retain the default deny.
- Give the specific deny rule a higher processing precedence than the broader outbound allow.
- The lower numerical priority 200 deny rule is evaluated first.
Explanation
Correct Answer
C:NSG decisions are priority ordered; the first matching rule wins. An earlier broad allow can shadow a later deny. This matters here because a malicious IP deny rule does not trigger because another outbound allow at lower numeric priority matches first.
Incorrect Answers
A:Subnet-level NSGs apply to traffic entering or leaving its NICs, with any NIC NSGs also evaluated as applicable. This matters here because a malicious IP deny rule does not trigger because another outbound allow at lower numeric priority matches first.
B:A specific allow evaluated before the default deny admits only the intended port/source combination. Removing the default deny would widen exposure. This matters here because a malicious IP deny rule does not trigger because another outbound allow at lower numeric priority matches first.
D:NSG priorities process lower numbers first; evaluation stops at the first matching rule. An allow at a later priority cannot override an earlier match. This matters here because a malicious IP deny rule does not trigger because another outbound allow at lower numeric priority matches first.
