AZ-900 Azure Virtual Network Practice
Test 2026–2027 | VNet Architecture,
Subnets, Connectivity & Detailed
Answers
1. A company needs to deploy Azure VMs that must communicate with each
other over private IP addresses. Which Azure service provides the
foundational private networking capability?
A. Azure DNS
B. Azure Virtual Network
C. Azure Traffic Manager
D. Azure Front Door
Answer: Azure Virtual Network
Rationale: Azure Virtual Network (VNet) provides the private networking
foundation for Azure resources, allowing resources such as virtual machines to
communicate using private IP addresses.
, 2. Which statement best describes an Azure virtual network?
A. A global DNS namespace
B. A logically isolated network in Azure
C. A physical data center network
D. A replacement for Microsoft Entra ID
Answer: A logically isolated network in Azure
Rationale: An Azure VNet is a logically isolated network that enables Azure
resources to communicate securely with one another, the internet, and on-
premises networks.
3. You create a VNet with address space 10.10.0.0/16. Which address is within
the VNet address space?
A. 10.10.5.20
B. 10.11.5.20
C. 10.20.5.20
D. 11.10.5.20
Answer: 10.10.5.20
Rationale: The 10.10.0.0/16 address space covers addresses from 10.10.0.0
through 10.10.255.255, so 10.10.5.20 is included.
4. What is the primary purpose of a subnet in an Azure VNet?
A. To create a separate Azure subscription
B. To divide the VNet address space into smaller network segments
C. To replace network security groups
D. To create a billing boundary
Answer: To divide the VNet address space into smaller network segments
,Rationale: Subnets divide a VNet into smaller logical network segments,
allowing resources to be organized and network traffic to be controlled more
effectively.
5. A VNet uses the address space 192.168.0.0/16. You need a subnet
containing 256 total IPv4 addresses. Which CIDR prefix provides that
address range?
A. /22
B. /24
C. /26
D. /28
Answer: /24
Rationale: An IPv4 /24 network contains 256 total addresses. Azure reserves
some addresses in each subnet, so usable addresses are fewer than the total.
6. Which Azure component controls inbound and outbound network traffic at
the subnet or network-interface level?
A. Network Security Group
B. Azure Policy
C. Azure Monitor
D. Resource Lock
Answer: Network Security Group
Rationale: A Network Security Group (NSG) contains inbound and outbound
security rules that allow or deny network traffic based on criteria such as source,
destination, protocol, and port.
, 7. A security administrator wants to prevent inbound TCP traffic on port 3389
to virtual machines. Which technology should be configured?
A. Azure DNS
B. Network Security Group
C. Azure Storage firewall only
D. Azure Resource Manager template
Answer: Network Security Group
Rationale: RDP uses TCP port 3389, and an NSG can contain a rule that denies
inbound traffic to that port.
8. Which statement about NSG rules is correct?
A. NSGs only control outbound traffic
B. NSGs only work with storage accounts
C. NSGs can control inbound and outbound traffic
D. NSGs replace Azure Firewall in every scenario
Answer: NSGs can control inbound and outbound traffic
Rationale: NSGs contain both inbound and outbound security rules and can be
associated with subnets and network interfaces.
9. An organization needs centralized, stateful network traffic inspection across
multiple Azure VNets. Which service is the most appropriate?
A. Azure Firewall
B. Azure DNS
C. Network Watcher
D. Azure Bastion
Answer: Azure Firewall
Test 2026–2027 | VNet Architecture,
Subnets, Connectivity & Detailed
Answers
1. A company needs to deploy Azure VMs that must communicate with each
other over private IP addresses. Which Azure service provides the
foundational private networking capability?
A. Azure DNS
B. Azure Virtual Network
C. Azure Traffic Manager
D. Azure Front Door
Answer: Azure Virtual Network
Rationale: Azure Virtual Network (VNet) provides the private networking
foundation for Azure resources, allowing resources such as virtual machines to
communicate using private IP addresses.
, 2. Which statement best describes an Azure virtual network?
A. A global DNS namespace
B. A logically isolated network in Azure
C. A physical data center network
D. A replacement for Microsoft Entra ID
Answer: A logically isolated network in Azure
Rationale: An Azure VNet is a logically isolated network that enables Azure
resources to communicate securely with one another, the internet, and on-
premises networks.
3. You create a VNet with address space 10.10.0.0/16. Which address is within
the VNet address space?
A. 10.10.5.20
B. 10.11.5.20
C. 10.20.5.20
D. 11.10.5.20
Answer: 10.10.5.20
Rationale: The 10.10.0.0/16 address space covers addresses from 10.10.0.0
through 10.10.255.255, so 10.10.5.20 is included.
4. What is the primary purpose of a subnet in an Azure VNet?
A. To create a separate Azure subscription
B. To divide the VNet address space into smaller network segments
C. To replace network security groups
D. To create a billing boundary
Answer: To divide the VNet address space into smaller network segments
,Rationale: Subnets divide a VNet into smaller logical network segments,
allowing resources to be organized and network traffic to be controlled more
effectively.
5. A VNet uses the address space 192.168.0.0/16. You need a subnet
containing 256 total IPv4 addresses. Which CIDR prefix provides that
address range?
A. /22
B. /24
C. /26
D. /28
Answer: /24
Rationale: An IPv4 /24 network contains 256 total addresses. Azure reserves
some addresses in each subnet, so usable addresses are fewer than the total.
6. Which Azure component controls inbound and outbound network traffic at
the subnet or network-interface level?
A. Network Security Group
B. Azure Policy
C. Azure Monitor
D. Resource Lock
Answer: Network Security Group
Rationale: A Network Security Group (NSG) contains inbound and outbound
security rules that allow or deny network traffic based on criteria such as source,
destination, protocol, and port.
, 7. A security administrator wants to prevent inbound TCP traffic on port 3389
to virtual machines. Which technology should be configured?
A. Azure DNS
B. Network Security Group
C. Azure Storage firewall only
D. Azure Resource Manager template
Answer: Network Security Group
Rationale: RDP uses TCP port 3389, and an NSG can contain a rule that denies
inbound traffic to that port.
8. Which statement about NSG rules is correct?
A. NSGs only control outbound traffic
B. NSGs only work with storage accounts
C. NSGs can control inbound and outbound traffic
D. NSGs replace Azure Firewall in every scenario
Answer: NSGs can control inbound and outbound traffic
Rationale: NSGs contain both inbound and outbound security rules and can be
associated with subnets and network interfaces.
9. An organization needs centralized, stateful network traffic inspection across
multiple Azure VNets. Which service is the most appropriate?
A. Azure Firewall
B. Azure DNS
C. Network Watcher
D. Azure Bastion
Answer: Azure Firewall
