4.0 Implement and manage virtual networking AZ-104 Practice Quiz

• A. Create a virtual network with a non-overlapping address space and add subnets sized for the workload
• B. Use Application Insights only for production and skip dev/test environments
• C. Use Azure Spot VMs for stateful database workloads requiring zero downtime
• D. Use a Network Security Group as a stateful application-layer firewall

Virtual network address planning must avoid overlap and leave enough space for resources that will be deployed.

• A. Review reserved Azure IP addresses when planning usable addresses in each subnet
• B. Treat Azure Backup as a substitute for Site Recovery for region-level outages
• C. Use Azure Cost Management to deploy infrastructure code
• D. Treat Azure Policy as an alert system rather than an enforcement mechanism

Azure reserves addresses in every subnet, so the usable capacity is smaller than the CIDR range suggests.

• A. Assign privileged roles permanently to all team members
• B. Create separate subnets for tiers that require different routing or security controls
• C. Use Microsoft Entra roles in place of Azure RBAC roles for resource access
• D. Use AWS Cost Explorer to manage Azure spend

Subnet boundaries allow administrators to apply NSGs, routes, and service integrations to specific groups of resources.

• A. Use Azure Front Door as a layer 4 TCP/UDP load balancer
• B. Create peering from each virtual network to the other and enable traffic options that match the design
• C. Use Azure Monitor without Log Analytics workspaces and store logs only in storage accounts
• D. Create a resource group tag as the alert condition

Virtual network peering must be configured in both directions for private connectivity.

• A. Use NSG Flow Logs without a Log Analytics workspace and expect interactive analytics
• B. Check NSGs, route tables, and DNS after peering when VMs still cannot communicate
• C. Create a storage lifecycle rule to change subnet routing
• D. Place a customer firewall appliance without a user-defined route to direct traffic to it

Peering provides a path, but security rules, routes, and name resolution can still block traffic.

• A. Configure backup reports without delegating ownership to a recipient
• B. Use a single shared admin account for all team members to simplify access
• C. Adjust the subnet address range before deploying resources when the planned IP capacity is insufficient
• D. Assign licenses by editing CSV files instead of using group-based licensing

Subnet sizing is easier to correct before dependent resources consume addresses.

• A. Configure MFA only after a security incident has already occurred
• B. Use Network Watcher Connection Troubleshoot as a packet-capture utility
• C. Enable gateway transit and use remote gateways only when one peered network should share its VPN gateway
• D. Disable soft delete in the vault to reduce storage costs

Gateway transit allows one virtual network to use a gateway in the peered virtual network when configured correctly.

• A. Treat Azure RBAC role assignments as automatically inherited from on-premises Active Directory
• B. Use a Basic-tier Azure Load Balancer for production workloads
• C. Assign a subscription Owner role to fix packet flow
• D. Enable the required subnet delegation when a PaaS service needs delegated subnet control

Some Azure services require subnet delegation before they can be deployed into the subnet.