Implement and manage virtual networking
Domain 4 of AZ-104 accounts for 15-20% of the exam. EarnYourCert has 119 original questions for this domain, all with explanations: 80 multiple choice, 21 yes/no and 18 completion or ordering items, like the real exam.
What this domain covers
- 4.1Configure and manage virtual networks in Azure42 questions
- 4.2Configure secure access to virtual networks41 questions
- 4.3Configure name resolution and load balancing36 questions
Domain 4 sample questions
8 questions from our 119-question bank for this domain. Try to answer before revealing the solution.
1. Which Azure Network Watcher tool lets you check whether traffic between two virtual machines (or between a VM and an endpoint) is allowed or blocked, and by which NSG rule?
- Azure Bastion, for RDP/SSH access without a public IP
- Network topology, showing a visual map of resources
- Boot diagnostics, showing screenshots from the serial console
- IP flow verify
Show answer
Correct answer: D. Network Watcher's IP flow verify checks whether a packet with a given source, destination, port, and protocol is allowed or denied, and also indicates which security rule (NSG) is enforcing that decision.
2. In a hub-and-spoke topology, what is the main purpose of the hub VNet?
- Host all production and development workloads of the organization in a centralized and secure network space
- Host shared services such as firewall, DNS and VPN gateway, connecting spokes via peering
- Act as an automatic transitive peering point between spoke VNets eliminating the need for additional UDRs
- Provide low-latency direct connectivity between all spokes via Azure system routes without going through the hub
Show answer
Correct answer: B. In a hub-and-spoke topology, the hub centralizes shared services such as firewall, DNS, and VPN or ExpressRoute gateways. Spokes host individual workloads and connect to the hub via peering. Traffic between spokes passes through the hub, which applies centralized security and routing policies.
3. What is the minimum bandwidth available on an ExpressRoute circuit?
- 10 Mbps
- 50 Mbps
- 100 Mbps
- 1 Gbps
Show answer
Correct answer: B. ExpressRoute circuits are available from 50 Mbps to 100 Gbps. The minimum bandwidth is 50 Mbps. Available options include: 50 Mbps, 100 Mbps, 200 Mbps, 500 Mbps, 1 Gbps, 2 Gbps, 5 Gbps, 10 Gbps, and 100 Gbps.
4. Which point-to-site VPN protocol is most recommended for non-Windows clients because it is cross-platform (Windows, macOS, Linux, iOS, Android)?
- SSTP (Secure Socket Tunneling Protocol)
- IKEv2
- OpenVPN
- L2TP/IPsec
Show answer
Correct answer: C. OpenVPN is the open-source TLS-based protocol that works across all major platforms: Windows, macOS, Linux, iOS, and Android. SSTP is Windows-exclusive. IKEv2 works on Windows, macOS, and iOS but has limited Linux and Android support. OpenVPN is also the only one that supports Azure AD authentication.
5. What Azure Firewall feature allows blocking traffic to known malicious domains automatically, without creating manual rules?
- Application rules with wildcard FQDN
- Threat Intelligence
- Network rules based on service tags
- Hierarchical firewall policies
Show answer
Correct answer: B. Azure Firewall's Threat Intelligence feature uses Microsoft's threat feed to automatically identify and block traffic to known malicious IPs and FQDNs. It can be configured in Alert or Alert and Deny mode, without needing to create manual rules for each threat.
6. A global application needs to serve static content from locations near users worldwide, along with layer 7 load balancing, WAF, and acceleration via an integrated content delivery network (CDN). Which Azure service is most appropriate?
- Azure Front Door
- Internal Azure Load Balancer
- NAT Gateway
- Private DNS zone
Show answer
Correct answer: A. Azure Front Door is a global application delivery service operating at layer 7, combining global load balancing, intelligent routing, content acceleration via integrated CDN, and Web Application Firewall (WAF), ideal for global web applications.
7. An administrator needs sessions from a specific user to always be directed to the same backend server (session affinity). What distribution mode should be configured in Azure Load Balancer?
- 5-tuple distribution (default)
- Source IP affinity (2 or 3 tuples)
- Weighted round-robin
- Least connections distribution
Show answer
Correct answer: B. Source IP affinity mode uses 2 tuples (source IP + destination IP) or 3 tuples (source IP + destination IP + protocol) to ensure sessions from the same client always go to the same backend. The default 5-tuple mode also includes the source port, so different sessions from the same client may go to different backends.
8. In Azure Application Gateway, what component allows routing traffic to different backend pools based on the URL path (for example, /images/* to one pool and /api/* to another)?
- Basic listener with a simple routing rule that redirects all traffic to the default backend pool
- Path-based routing rule
- Custom health probe with HTTP routes configured per application
- SSL offloading configuration with TLS termination at the gateway and unencrypted HTTP forwarding to the backend
Show answer
Correct answer: B. Path-based routing rules in Application Gateway allow defining a URL path map where each path or pattern is associated with a specific backend pool. For example, /images/* routes to the image server pool and /api/* to the API pool. They require a multi-site or basic listener with a 'path-based' rule type.