AZ-104 Practice Questions with Correct
Answers
You have an Azure subscription that contains a storage account named storage1.
You need to provide a partner organization with access to storage1. Access to storage1
must automatically expire after 24 hours.
What should you configure?
a shared access signature (SAS)
You have an Azure subscription that contains two virtual networks named VNet1 and
VNet2.
You need to ensure that the resources on both VNet1 and VNet2 can communicate
seamlessly between both networks.
What should you configure from the Azure portal?
peerings
You have an Azure subscription that contains a virtual network named VNet1.
You plan to deploy a virtual machine named VM1 to be used as a network inspection
appliance.
You need to ensure that all network traffic passes through VM1.
What should you do?
Configure a user-defined route.
Azure automatically creates a route table for each subnet on an Azure virtual network and
adds system default routes to the table. You can override some of the Azure system routes
with custom user-defined routes and add more custom routes to route tables. Azure routes
outbound traffic from a subnet based on the routes on a subnet's route table.
,You have two Azure subscriptions named Sub1 and Sub2.
Sub1 contains a virtual network named VNet1 and a VPN gateway. Sub2 contains a
virtual network named VNet2.
You have an on-premises device named Device1 that runs Windows and has a Point-to-
Site (P2S) VPN client installed.
You configure network peering between VNet1 and VNet2.
You need to ensure that Device1 can access VNet2 when a VPN connection is
established.
What should you do?
Download and reinstall the P2S VPN client on Device1.
Point-to-Site (P2S) VPN clients must be downloaded and reinstalled again after virtual
network peering is successfully configured to ensure that the new routes are downloaded to
the client.
A private endpoint and Azure Front Door are not required nor used to be able to access
VNet2 from VNet1.
Device1 already has a digital certificate when you install the P2S VPN client, so you do not
need to create new certificate manually.
You have an Azure subscription that contains two resource groups named RG1 and
RG2.
RG1 contains the following resources:
A virtual network named VNet1 located in the East US Azure region
A network security group (NSG) named NSG1 located in the West US Azure region
RG2 contains the following resources:
A virtual network named VNet2 located in the East US Azure region
, A virtual network named VNet3 located in the West US Azure region
You need to associate NSG1.
To which subnets can you associate NSG1?
the subnets of VNet3 only
You can assign an NSG to the subnet of the virtual network in the same region as the NSG
and NSG1 is in the West US region.
You have an Azure subscription that contains a network security group (NSG) named
NSG1.
You plan to configure NSG1 to allow the following types of traffic:
Remote Desktop Management
Secured HTTPS
Which two ports should you allow in NSG1? Each correct answer presents part of the
solution.
443 & 3389
You must open port 443 to secured HTTPS traffic, port 3389 for Remote Desktop, and 587 to
send outbound email by using authenticated SMTP relay. Port 80 is used for unsecured
traffic. Port 25 is used by mail traffic.
You have an Azure virtual network that contains four subnets. Each subnet contains 10
virtual machines.
You plan to configure a network security group (NSG) that will allow inbound traffic
over TCP port 8080 to two virtual machines on each subnet. The NSG will be associated
to each subnet.
Answers
You have an Azure subscription that contains a storage account named storage1.
You need to provide a partner organization with access to storage1. Access to storage1
must automatically expire after 24 hours.
What should you configure?
a shared access signature (SAS)
You have an Azure subscription that contains two virtual networks named VNet1 and
VNet2.
You need to ensure that the resources on both VNet1 and VNet2 can communicate
seamlessly between both networks.
What should you configure from the Azure portal?
peerings
You have an Azure subscription that contains a virtual network named VNet1.
You plan to deploy a virtual machine named VM1 to be used as a network inspection
appliance.
You need to ensure that all network traffic passes through VM1.
What should you do?
Configure a user-defined route.
Azure automatically creates a route table for each subnet on an Azure virtual network and
adds system default routes to the table. You can override some of the Azure system routes
with custom user-defined routes and add more custom routes to route tables. Azure routes
outbound traffic from a subnet based on the routes on a subnet's route table.
,You have two Azure subscriptions named Sub1 and Sub2.
Sub1 contains a virtual network named VNet1 and a VPN gateway. Sub2 contains a
virtual network named VNet2.
You have an on-premises device named Device1 that runs Windows and has a Point-to-
Site (P2S) VPN client installed.
You configure network peering between VNet1 and VNet2.
You need to ensure that Device1 can access VNet2 when a VPN connection is
established.
What should you do?
Download and reinstall the P2S VPN client on Device1.
Point-to-Site (P2S) VPN clients must be downloaded and reinstalled again after virtual
network peering is successfully configured to ensure that the new routes are downloaded to
the client.
A private endpoint and Azure Front Door are not required nor used to be able to access
VNet2 from VNet1.
Device1 already has a digital certificate when you install the P2S VPN client, so you do not
need to create new certificate manually.
You have an Azure subscription that contains two resource groups named RG1 and
RG2.
RG1 contains the following resources:
A virtual network named VNet1 located in the East US Azure region
A network security group (NSG) named NSG1 located in the West US Azure region
RG2 contains the following resources:
A virtual network named VNet2 located in the East US Azure region
, A virtual network named VNet3 located in the West US Azure region
You need to associate NSG1.
To which subnets can you associate NSG1?
the subnets of VNet3 only
You can assign an NSG to the subnet of the virtual network in the same region as the NSG
and NSG1 is in the West US region.
You have an Azure subscription that contains a network security group (NSG) named
NSG1.
You plan to configure NSG1 to allow the following types of traffic:
Remote Desktop Management
Secured HTTPS
Which two ports should you allow in NSG1? Each correct answer presents part of the
solution.
443 & 3389
You must open port 443 to secured HTTPS traffic, port 3389 for Remote Desktop, and 587 to
send outbound email by using authenticated SMTP relay. Port 80 is used for unsecured
traffic. Port 25 is used by mail traffic.
You have an Azure virtual network that contains four subnets. Each subnet contains 10
virtual machines.
You plan to configure a network security group (NSG) that will allow inbound traffic
over TCP port 8080 to two virtual machines on each subnet. The NSG will be associated
to each subnet.
