Implement and manage virtual networking
Free Microsoft Certified: Azure Administrator Associate practice — 6 questions on Implement and manage virtual networking, with explanations. No sign-up. Full 12-question mixed test →
A VM's NIC is associated with NSG-A, which has a rule at priority 100 denying all inbound traffic from the Internet. The subnet containing the VM is associated with NSG-B, which has a rule at priority 100 allowing inbound TCP 443 from the Internet. Users report that HTTPS traffic never reaches the VM. What is the cause?
When NSGs exist at both the subnet and NIC level, inbound traffic must be explicitly allowed by both NSGs to reach the VM. Priority numbers are only compared within the same NSG, not across NSGs. Since NSG-A's deny rule at the NIC level blocks the traffic outright, NSG-B's allow rule at the subnet level is irrelevant — the traffic never reaches the VM.
A company's on-premises network is connected to an Azure VNet via a Site-to-Site VPN Gateway. The company needs on-premises servers to reach an Azure Storage account using a private IP address, with name resolution working correctly from on-premises, and without traffic traversing the public internet. Which solution meets these requirements?
A private endpoint assigns the storage account a private IP address inside the VNet. For on-premises clients to resolve the storage account's FQDN to that private IP, the Private DNS zone must be linked to the VNet, and on-premises DNS must forward the relevant zone to a DNS server (or Azure DNS Private Resolver) reachable in Azure. This achieves fully private connectivity and correct name resolution.
A Hub VNet contains a VPN Gateway connected to an on-premises network. A Spoke VNet is peered with the Hub VNet. You need on-premises resources to reach VMs in the Spoke VNet through the Hub's VPN Gateway, without deploying a separate gateway in the Spoke. What must you configure?
Gateway transit lets a spoke VNet use a gateway deployed in the hub VNet instead of deploying its own. The hub side of the peering must have 'Allow gateway transit' enabled, and the spoke side must have 'Use remote gateways' enabled. Once configured, Azure automatically propagates the necessary routes.
You deploy a third-party firewall Network Virtual Appliance (NVA) in a Hub VNet. You need all internet-bound traffic from VMs in a peered Spoke subnet to be inspected by the NVA before leaving Azure. What should you configure on the Spoke subnet?
To force traffic through an NVA, you create a UDR with the destination prefix 0.0.0.0/0 and next hop type 'Virtual appliance', pointing to the NVA's private IP address. This overrides the default system route to the internet and directs all outbound traffic through the NVA for inspection first.
Contoso hosts a web application at contoso.com. Requests to /images and /api must route to two different backend pools, TLS must be terminated at the edge, and the solution must inspect and block SQL injection and cross-site scripting attempts. Which Azure service configuration BEST meets these requirements?
Application Gateway operates at Layer 7, supports SSL/TLS termination, and can route based on URL path (path-based routing rules) to different backend pools. The WAF_v2 SKU adds Web Application Firewall capability to inspect and block OWASP threats like SQL injection and XSS — matching all stated requirements.
You need to configure an Azure VPN Gateway in active-active mode so that two on-premises VPN devices can each maintain simultaneous active tunnels to both gateway instances for maximum resiliency. Which requirement must be met to enable this configuration?
Active-active mode requires a Route-based VPN Gateway using a non-Basic SKU (VpnGw1 and above support it). In active-active mode, both gateway instances are active simultaneously, and each instance is assigned its own public IP address so on-premises devices can establish tunnels to both.
Ready for the real thing?
The full course has two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed answer explanations.
Start my full course on Udemy →