CoStudy

HomeCertificationsMicrosoft Azure Administrator AZ-104 › Virtual Networking

Virtual Networking — Microsoft Azure Administrator AZ-104 practice questions

53 multiple-choice questions and 33 flashcards on Virtual Networking, about 19% of the Microsoft Azure Administrator AZ-104 bank. Every one carries a written rationale.

Written and maintained by Nick Burton · last updated 2026-08-22 · how we write and review questions

What this chapter covers

Virtual Networking is one of 6 chapters in CoStudy's Microsoft Azure Administrator (AZ-104) bank, and it holds 53 of the bank's 280 multiple-choice questions — roughly 19% of the total. That proportion is not arbitrary: chapters follow the certifying body's published exam outline, and the number of questions in each is set by that domain's published weight, so the share of your practice time this chapter takes matches the share of the real exam it accounts for.

Studying by chapter is worth doing once you have a diagnostic score. A single overall percentage tells you whether you are close; it does not tell you which domain is dragging. Working a weak chapter in isolation, and re-testing it in isolation, is the fastest way to move a score that has stalled — and it is why the mock exams in CoStudy report by domain rather than as one number.

Free Virtual Networking practice questions

10 questions drawn from this chapter, with the full rationale shown — the controlling principle behind the right answer, and why each wrong option tempts and fails.

A route table with a 0.0.0.0/0 route to a network virtual appliance is associated with AzureBastionSubnet. What is the effect?

  1. No effect at all; Bastion ignores route tables on its own subnet.
  2. The route must instead be applied to the target VM subnet to work.
  3. Bastion needs direct outbound access to its control plane, so it breaks.
  4. The appliance transparently forwards the Bastion session traffic instead.

Answer: C — Bastion needs direct outbound access to its control plane, so it breaks.

C is right because the Bastion host depends on outbound connectivity to the Azure control plane and to certain service endpoints, and forcing all of that through an appliance breaks management and session brokering. A assumes the subnet is exempt from routing, which it is not - the association is accepted and then causes failures. B is a plausible-sounding relocation, but the damage here is caused by where the route already is. D assumes the appliance can proxy control-plane traffic, which is not supported for the Bastion service.

What does Azure Bastion provide for virtual machines in a virtual network?

  1. A public IP address on each virtual machine so that RDP can reach them directly
  2. Browser-based RDP and SSH access to machines that have no public IP of their own
  3. A replacement for the network security groups on the subnets holding the machines
  4. A site-to-site tunnel so that on-premises clients can reach the machines by name
  5. Storage of the credentials used in each session inside an Azure Key Vault secret

Answer: B — Browser-based RDP and SSH access to machines that have no public IP of their own

B is the service in one line: a managed host inside the virtual network brokers RDP and SSH over TLS from the portal, so the target machines keep private addressing and no management port faces the internet. A is precisely the exposure the service exists to remove. C is wrong because security groups still apply to the Bastion subnet and to the targets. D describes cross-premises connectivity. E is a Key Vault function that Bastion does not perform on its own.

An administrator plans a new virtual network that must later peer with an existing network using 10.0.0.0/16. Which address space choice is valid for the new network?

  1. 10.0.128.0/17, which is a distinct subnet of the existing range
  2. 172.16.0.0/16, which does not overlap the existing address space
  3. 10.0.0.0/24, because a smaller prefix is treated as a separate space
  4. 10.0.0.0/8, because a larger prefix supersedes the existing allocation

Answer: B — 172.16.0.0/16, which does not overlap the existing address space

B) Correct — peering requires non-overlapping address spaces, and 172.16.0.0/16 shares no addresses with 10.0.0.0/16. A) 10.0.128.0/17 sits inside 10.0.0.0/16, so it overlaps and peering is refused. C) A smaller prefix carved from the same range still overlaps. D) A supernet contains the existing range entirely and nothing supersedes anything in peering.

A network security group rule is created with priority 100. What does that low number mean?

  1. The rule is treated as the least important and applies only when no other rule matches
  2. The rule is evaluated last, after every rule that carries a larger priority number is checked
  3. The rule is evaluated first, because rules are processed in ascending order of priority
  4. The rule stays disabled until an administrator raises the number above the default range
  5. The rule applies to inbound traffic only, since outbound rules must start from a higher number

Answer: C — The rule is evaluated first, because rules are processed in ascending order of priority

C states the evaluation order: network security group rules are processed from the lowest priority number upward and the first match decides the flow, so 100 is checked before 200. A and B both read the number as a rank where larger means stronger, which is the usual mistake. D invents a behaviour; priority never disables a rule. E is wrong because direction is a separate property of the rule and has no bearing on the number chosen. The platform default rules sit at 65000 and above so custom rules always win.

A virtual machine's effective routes show a system route for a peered network and a user-defined route for the same prefix pointing at a virtual appliance. Which route is used?

  1. The system route, because platform routes always take precedence over custom ones
  2. Neither, because a conflicting pair of routes causes the traffic to be dropped
  3. The user-defined route, because UDRs take precedence over system routes
  4. Both alternately, because Azure balances traffic across equal-prefix routes

Answer: C — The user-defined route, because UDRs take precedence over system routes

C) Correct — when prefixes match, Azure prefers a user-defined route over a BGP route and a BGP route over a system route, so the appliance receives the traffic. A) This reverses the precedence order, which is the most common misconception here. B) Route conflicts are resolved by precedence, not by dropping traffic. D) Azure selects one route by precedence and longest prefix match; it does not alternate.

A network security group's default rules deny inbound RDP from the internet. An administrator adds a rule at priority 4096 allowing TCP 3389 from the internet. What is the result?

  1. RDP is allowed because any custom rule overrides all default rules.
  2. The allow at 4096 takes effect unless a lower-numbered deny exists.
  3. Priority 4096 sits outside the valid range, so the rule is rejected.
  4. Custom rules numbered above 4000 are ignored by the platform entirely.

Answer: B — The allow at 4096 takes effect unless a lower-numbered deny exists.

B is right because rules are evaluated from the lowest priority number upward and the first match wins, so an allow at 4096 beats the default deny at 65500 but loses to any custom deny numbered below 4096. A is nearly right but overstates it: a custom deny at a lower number would still win. C is wrong on the range, which runs from 100 to 4096 inclusive. D invents a cut-off that does not exist. Note that allowing RDP from the internet is poor practice even when it works; Bastion or just-in-time access is the safer pattern.

A private endpoint for a storage account exists in VNet-A, and the account's public network access is disabled. What is the result?

  1. Only resources inside VNet-A can reach the storage account privately.
  2. The storage account is unreachable because public access is disabled.
  3. VNet-A and any connected network resolving that record can reach it.
  4. Access works only if a Private DNS zone is linked to VNet-A alone.

Answer: C — VNet-A and any connected network resolving that record can reach it.

C is right because the private endpoint is just a NIC with a private IP: anything with a route to it and DNS that resolves the account name to that IP - peered networks or connected on-premises networks included - can reach the account. A is the common misconception that a private endpoint is confined to its own virtual network. B ignores that the private path is exactly what remains open when public access is disabled. D inverts the DNS requirement: linking the zone to more networks widens access rather than restricting it.

Service Endpoints vs Private Endpoints. Which provides a private IP in YOUR VNet?

  1. Service Endpoints.
  2. Private Endpoints.
  3. Both.
  4. Neither; both use public IPs.

Answer: B — Private Endpoints.

Private Endpoints assign a private IP from your subnet to the service. Service Endpoints extend VNet identity to the service but the service keeps its public IP (traffic stays on Microsoft backbone). Common confusion.

A network security group allows TCP 443 inbound from the internet and has no explicit outbound rule for that traffic. Can the VMs send replies?

  1. No; an explicit outbound rule is required before any replies can leave.
  2. Yes; NSGs are stateful, so return traffic on the flow is allowed.
  3. No; replies work only after a route table sends them back out.
  4. Only replies carried over UDP are permitted by the implicit rules.

Answer: B — Yes; NSGs are stateful, so return traffic on the flow is allowed.

B is right because NSG rules are evaluated per flow, not per packet: once inbound traffic is allowed, the response on that established flow is permitted regardless of outbound rules. A applies stateless firewall thinking and would require symmetric rules that Azure does not need. C confuses routing with filtering; a route decides the path but does not create the permission. D invents a protocol distinction - statefulness applies to TCP and UDP flows alike.

A public DNS zone is hosted in Azure DNS. What makes internet resolvers answer from that zone?

  1. An Azure-managed anycast address published for each record set.
  2. A Layer 7 HTTP proxy that answers on behalf of the record owner.
  3. Delegating the domain at the registrar to the zone's name servers.
  4. BGP advertisement of the zone's prefixes to upstream peers.

Answer: C — Delegating the domain at the registrar to the zone's name servers.

C is right because a zone is only authoritative once the parent delegation points at the four Azure name servers assigned to that zone; without changing NS records at the registrar the zone is created but never queried. A confuses the anycast footprint of the name server infrastructure with the per-record data. B describes a reverse proxy, which is a traffic path rather than name resolution. D describes route advertisement, which moves packets and has nothing to do with delegating a DNS namespace.

Virtual Networking flashcards

4 cards from the 33 in this chapter.

What is Azure Bastion for, and what subnet does it require?

It gives RDP and SSH access to virtual machines over TLS from the portal or a native client, so the machines need no public IP address and no open management ports from the internet. It requires a dedicated subnet named AzureBastionSubnet, at least a /26 in the production tiers.

Application Security Group (ASG)?

Group VMs by app/role. Use as source/destination in NSG rules.

In what order are network security group rules evaluated, and what are the default rules?

By priority from 100 to 4096, lowest number first, and the first match wins so no later rule is considered. Default rules that cannot be deleted allow inbound traffic from the virtual network and from the load balancer probe and deny all other inbound, and allow outbound to the virtual network and the internet and deny all else.

Azure Bastion — what does it provide?

Browser-based RDP and SSH to VMs through the Azure portal over TLS. • Target VMs need no public IP address and no inbound RDP or SSH rule from the internet. • Deployed into a dedicated subnet named AzureBastionSubnet.

Practise the full chapter

These are a sample. The full Virtual Networking chapter runs 86 items with per-chapter progress tracking, on the web and in the iOS app.

Open Microsoft Azure Administrator AZ-104 in CoStudy →

Other Microsoft Azure Administrator AZ-104 chapters

All Microsoft Azure Administrator AZ-104 practice questions →