Home › Certifications › Microsoft Azure Administrator AZ-104 › Virtual Networking
53 multiple-choice questions and 33 flashcards on Virtual Networking, about 19% of the Microsoft Azure Administrator AZ-104 bank. Every one carries a written rationale.
Virtual Networking is one of 6 chapters in CoStudy's Microsoft Azure Administrator (AZ-104) bank, and it holds 53 of the bank's 280 multiple-choice questions — roughly 19% of the total. That proportion is not arbitrary: chapters follow the certifying body's published exam outline, and the number of questions in each is set by that domain's published weight, so the share of your practice time this chapter takes matches the share of the real exam it accounts for.
Studying by chapter is worth doing once you have a diagnostic score. A single overall percentage tells you whether you are close; it does not tell you which domain is dragging. Working a weak chapter in isolation, and re-testing it in isolation, is the fastest way to move a score that has stalled — and it is why the mock exams in CoStudy report by domain rather than as one number.
10 questions drawn from this chapter, with the full rationale shown — the controlling principle behind the right answer, and why each wrong option tempts and fails.
A route table with a 0.0.0.0/0 route to a network virtual appliance is associated with AzureBastionSubnet. What is the effect?
Answer: C — Bastion needs direct outbound access to its control plane, so it breaks.
C is right because the Bastion host depends on outbound connectivity to the Azure control plane and to certain service endpoints, and forcing all of that through an appliance breaks management and session brokering. A assumes the subnet is exempt from routing, which it is not - the association is accepted and then causes failures. B is a plausible-sounding relocation, but the damage here is caused by where the route already is. D assumes the appliance can proxy control-plane traffic, which is not supported for the Bastion service.
What does Azure Bastion provide for virtual machines in a virtual network?
Answer: B — Browser-based RDP and SSH access to machines that have no public IP of their own
B is the service in one line: a managed host inside the virtual network brokers RDP and SSH over TLS from the portal, so the target machines keep private addressing and no management port faces the internet. A is precisely the exposure the service exists to remove. C is wrong because security groups still apply to the Bastion subnet and to the targets. D describes cross-premises connectivity. E is a Key Vault function that Bastion does not perform on its own.
An administrator plans a new virtual network that must later peer with an existing network using 10.0.0.0/16. Which address space choice is valid for the new network?
Answer: B — 172.16.0.0/16, which does not overlap the existing address space
B) Correct — peering requires non-overlapping address spaces, and 172.16.0.0/16 shares no addresses with 10.0.0.0/16. A) 10.0.128.0/17 sits inside 10.0.0.0/16, so it overlaps and peering is refused. C) A smaller prefix carved from the same range still overlaps. D) A supernet contains the existing range entirely and nothing supersedes anything in peering.
A network security group rule is created with priority 100. What does that low number mean?
Answer: C — The rule is evaluated first, because rules are processed in ascending order of priority
C states the evaluation order: network security group rules are processed from the lowest priority number upward and the first match decides the flow, so 100 is checked before 200. A and B both read the number as a rank where larger means stronger, which is the usual mistake. D invents a behaviour; priority never disables a rule. E is wrong because direction is a separate property of the rule and has no bearing on the number chosen. The platform default rules sit at 65000 and above so custom rules always win.
A virtual machine's effective routes show a system route for a peered network and a user-defined route for the same prefix pointing at a virtual appliance. Which route is used?
Answer: C — The user-defined route, because UDRs take precedence over system routes
C) Correct — when prefixes match, Azure prefers a user-defined route over a BGP route and a BGP route over a system route, so the appliance receives the traffic. A) This reverses the precedence order, which is the most common misconception here. B) Route conflicts are resolved by precedence, not by dropping traffic. D) Azure selects one route by precedence and longest prefix match; it does not alternate.
A network security group's default rules deny inbound RDP from the internet. An administrator adds a rule at priority 4096 allowing TCP 3389 from the internet. What is the result?
Answer: B — The allow at 4096 takes effect unless a lower-numbered deny exists.
B is right because rules are evaluated from the lowest priority number upward and the first match wins, so an allow at 4096 beats the default deny at 65500 but loses to any custom deny numbered below 4096. A is nearly right but overstates it: a custom deny at a lower number would still win. C is wrong on the range, which runs from 100 to 4096 inclusive. D invents a cut-off that does not exist. Note that allowing RDP from the internet is poor practice even when it works; Bastion or just-in-time access is the safer pattern.
A private endpoint for a storage account exists in VNet-A, and the account's public network access is disabled. What is the result?
Answer: C — VNet-A and any connected network resolving that record can reach it.
C is right because the private endpoint is just a NIC with a private IP: anything with a route to it and DNS that resolves the account name to that IP - peered networks or connected on-premises networks included - can reach the account. A is the common misconception that a private endpoint is confined to its own virtual network. B ignores that the private path is exactly what remains open when public access is disabled. D inverts the DNS requirement: linking the zone to more networks widens access rather than restricting it.
Service Endpoints vs Private Endpoints. Which provides a private IP in YOUR VNet?
Answer: B — Private Endpoints.
Private Endpoints assign a private IP from your subnet to the service. Service Endpoints extend VNet identity to the service but the service keeps its public IP (traffic stays on Microsoft backbone). Common confusion.
A network security group allows TCP 443 inbound from the internet and has no explicit outbound rule for that traffic. Can the VMs send replies?
Answer: B — Yes; NSGs are stateful, so return traffic on the flow is allowed.
B is right because NSG rules are evaluated per flow, not per packet: once inbound traffic is allowed, the response on that established flow is permitted regardless of outbound rules. A applies stateless firewall thinking and would require symmetric rules that Azure does not need. C confuses routing with filtering; a route decides the path but does not create the permission. D invents a protocol distinction - statefulness applies to TCP and UDP flows alike.
A public DNS zone is hosted in Azure DNS. What makes internet resolvers answer from that zone?
Answer: C — Delegating the domain at the registrar to the zone's name servers.
C is right because a zone is only authoritative once the parent delegation points at the four Azure name servers assigned to that zone; without changing NS records at the registrar the zone is created but never queried. A confuses the anycast footprint of the name server infrastructure with the per-record data. B describes a reverse proxy, which is a traffic path rather than name resolution. D describes route advertisement, which moves packets and has nothing to do with delegating a DNS namespace.
4 cards from the 33 in this chapter.
What is Azure Bastion for, and what subnet does it require?
It gives RDP and SSH access to virtual machines over TLS from the portal or a native client, so the machines need no public IP address and no open management ports from the internet. It requires a dedicated subnet named AzureBastionSubnet, at least a /26 in the production tiers.
Application Security Group (ASG)?
Group VMs by app/role. Use as source/destination in NSG rules.
In what order are network security group rules evaluated, and what are the default rules?
By priority from 100 to 4096, lowest number first, and the first match wins so no later rule is considered. Default rules that cannot be deleted allow inbound traffic from the virtual network and from the load balancer probe and deny all other inbound, and allow outbound to the virtual network and the internet and deny all else.
Azure Bastion — what does it provide?
Browser-based RDP and SSH to VMs through the Azure portal over TLS. • Target VMs need no public IP address and no inbound RDP or SSH rule from the internet. • Deployed into a dedicated subnet named AzureBastionSubnet.
These are a sample. The full Virtual Networking chapter runs 86 items with per-chapter progress tracking, on the web and in the iOS app.
Open Microsoft Azure Administrator AZ-104 in CoStudy →
All Microsoft Azure Administrator AZ-104 practice questions →