AZ104 ACTUAL EXAM QUESTIONS AND
CORRECT ANSWERS COMPLETE SOLUTION
●● You have an Azure subscription that contains the following virtual
networks:
VNet1 has an IP address range of 192.168.0.0/24.
VNet2 has an IP address range of 10.10.0.0/24.
VNet3 has an IP address range of 192.168.0.0/16.
You need configure virtual network peering.
Which two peerings can you create? Each correct answer presents
complete solution.
Select all answers that apply.
VNet1 can be peered with VNet2.
VNet1 can be peered with VNet3.
VNet2 can be peered with VNet3.
VNet3 can be peered with VNet1.
Answer: VNet1 can be peered with VNet2.
VNet2 can be peered with VNet3.
●● You have two Azure subscriptions named Sub1 and Sub2.
,Sub1 contains a virtual network named VNet1 and a VPN gateway. Sub2
contains a virtual network named VNet2.
You have an on-premises device named Device1 that runs Windows and
has a Point-to-Site (P2S) VPN client installed.
You configure network peering between VNet1 and VNet2.
You need to ensure that Device1 can access VNet2 when a VPN
connection is established.
What should you do?
Select only one answer.
Create a private endpoint in Sub2.
Deploy Azure Front Door to Sub2.
Download and reinstall the P2S VPN client on Device1.
Run the New-SelfSignedCertificate cmdlet on Device1.
Answer: Download and reinstall the P2S VPN client on Device1.
●● You have an Azure subscription that contains two resource groups
named RG1 and RG2.
RG1 contains the following resources:
A virtual network named VNet1 located in the East US Azure region
A network security group (NSG) named NSG1 located in the West US
Azure region
RG2 contains the following resources:
A virtual network named VNet2 located in the East US Azure region
,A virtual network named VNet3 located in the West US Azure region
You need to associate NSG1.
To which subnets can you associate NSG1?
Select only one answer.
the subnets of all the virtual networks
the subnets of VNet1 only
the subnets of VNet1 and VNet2
the subnets of VNet3 only
Answer: the subnets of VNet3 only
●● You have a virtual machine named VM1 that is assigned to a network
security group (NSG) named NSG1.
NSG1 has the following outbound security rules:
Rule1:
Priority: 900
Name: BlockInternet
Port: 80
Protocol: TCP
Source: Any
Destination: Any
Action: Block
Rule2:
, Priority: 1000
Name: AllowInternet
Port: 80
Protocol: TCP
Source: Any
Destination: Any
Action: Allow
You need to ensure that internet access to VM1 on port 80 is allowed.
What should you do?
Select only one answer.
Change the action of Rule2.
Change the name of Rule1.
Change the priority of Rule2.
Change the source in Rule2.
Answer: Change the priority of Rule2.
●● You have three network security groups (NSGs) named NSG1,
NSG2, and NSG3. Port 80 is blocked in NSG3 and allowed in NSG1
and NSG2.
You have four Azure virtual machines that have the following
configurations:
VM1:
Subnet: Subnet1
CORRECT ANSWERS COMPLETE SOLUTION
●● You have an Azure subscription that contains the following virtual
networks:
VNet1 has an IP address range of 192.168.0.0/24.
VNet2 has an IP address range of 10.10.0.0/24.
VNet3 has an IP address range of 192.168.0.0/16.
You need configure virtual network peering.
Which two peerings can you create? Each correct answer presents
complete solution.
Select all answers that apply.
VNet1 can be peered with VNet2.
VNet1 can be peered with VNet3.
VNet2 can be peered with VNet3.
VNet3 can be peered with VNet1.
Answer: VNet1 can be peered with VNet2.
VNet2 can be peered with VNet3.
●● You have two Azure subscriptions named Sub1 and Sub2.
,Sub1 contains a virtual network named VNet1 and a VPN gateway. Sub2
contains a virtual network named VNet2.
You have an on-premises device named Device1 that runs Windows and
has a Point-to-Site (P2S) VPN client installed.
You configure network peering between VNet1 and VNet2.
You need to ensure that Device1 can access VNet2 when a VPN
connection is established.
What should you do?
Select only one answer.
Create a private endpoint in Sub2.
Deploy Azure Front Door to Sub2.
Download and reinstall the P2S VPN client on Device1.
Run the New-SelfSignedCertificate cmdlet on Device1.
Answer: Download and reinstall the P2S VPN client on Device1.
●● You have an Azure subscription that contains two resource groups
named RG1 and RG2.
RG1 contains the following resources:
A virtual network named VNet1 located in the East US Azure region
A network security group (NSG) named NSG1 located in the West US
Azure region
RG2 contains the following resources:
A virtual network named VNet2 located in the East US Azure region
,A virtual network named VNet3 located in the West US Azure region
You need to associate NSG1.
To which subnets can you associate NSG1?
Select only one answer.
the subnets of all the virtual networks
the subnets of VNet1 only
the subnets of VNet1 and VNet2
the subnets of VNet3 only
Answer: the subnets of VNet3 only
●● You have a virtual machine named VM1 that is assigned to a network
security group (NSG) named NSG1.
NSG1 has the following outbound security rules:
Rule1:
Priority: 900
Name: BlockInternet
Port: 80
Protocol: TCP
Source: Any
Destination: Any
Action: Block
Rule2:
, Priority: 1000
Name: AllowInternet
Port: 80
Protocol: TCP
Source: Any
Destination: Any
Action: Allow
You need to ensure that internet access to VM1 on port 80 is allowed.
What should you do?
Select only one answer.
Change the action of Rule2.
Change the name of Rule1.
Change the priority of Rule2.
Change the source in Rule2.
Answer: Change the priority of Rule2.
●● You have three network security groups (NSGs) named NSG1,
NSG2, and NSG3. Port 80 is blocked in NSG3 and allowed in NSG1
and NSG2.
You have four Azure virtual machines that have the following
configurations:
VM1:
Subnet: Subnet1
