MicrosoftAssociate levelAZ-104Page 3 of 3

AZ-104 exam dumps: questions 201 to 288 of 288

Page 3 of the free AZ-104 question bank for the Microsoft Certified: Azure Administrator Associate exam. Questions 201 to 288 are listed below, the first 5 in full with answers and explanations. Back to page 1 for the exam overview and FAQ.

Question bank last updated January 2025

Free AZ-104 practice questions

Questions 201 to 205 of 288

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

AZ-104 Question 201

Single answer

You have an existing Azure virtual network (VNet) named VNet1 with an address space of 10.0.0.0/16. Currently, VNet1 has one subnet named Subnet1, which uses the 10.0.0.0/24 address prefix. You need to create an additional subnet named Subnet2 with an address prefix of 10.0.1.0/24 for application workloads without restructuring any existing subnets. Which action should you take in the Azure portal?

  1. A

    Add a new address space of 10.0.1.0/24 to VNet1 and then create a separate virtual network for the new subnet.

  2. B

    Create Subnet2 directly under the Subnets blade of VNet1 using the 10.0.1.0/24 address prefix.

  3. C

    Reconfigure Subnet1 to use 10.0.0.0/25 and create Subnet2 with 10.0.0.128/25.

  4. D

    Create a new resource group in the same region and add a new subnet with 10.0.1.0/24 to it.

Show answer and explanation

Correct answer: B

Explanation

When creating additional subnets within an existing Azure virtual network, you simply define a new subnet under the same VNet in the Azure portal with a non-overlapping address prefix. Adding Subnet2 (10.0.1.0/24) directly under VNet1 meets the scenario requirements without modifying any existing configuration.

  • A. Incorrect.

    Adding a new address space and then creating a separate virtual network is unnecessary. You only need to add a new subnet to the existing VNet1.

  • B. Correct.

    Defining Subnet2 (10.0.1.0/24) directly on VNet1 under the Subnets blade is the correct way to add another subnet without impacting Subnet1 or the existing address space.

  • C. Incorrect.

    Splitting Subnet1 into two /25 subnets is not required, and it would require reconfiguring an existing subnet, which the scenario does not call for.

  • D. Incorrect.

    You do not need a separate resource group or a separate subnet outside VNet1. You can create the new subnet in the existing VNet1.

AZ-104 Question 202

Single answer

You have two virtual networks, VNET1 and VNET2, in separate regions. VNET1 hosts a network virtual appliance (NVA) that you want VNET2 to use for Internet egress. You plan to create a virtual network peering between VNET1 and VNET2 to enable this configuration. Which settings must you enable so that VNET2 can route outbound traffic through the NVA in VNET1?

  1. A

    Enable 'Allow gateway transit' on VNET1's peering to VNET2 and 'Use remote gateways' on VNET2's peering to VNET1

  2. B

    Enable 'Allow gateway transit' on VNET2's peering to VNET1 and 'Use remote gateways' on VNET1's peering to VNET2

  3. C

    Enable 'Allow forwarded traffic' on both peerings

  4. D

    Manually configure UDRs on both VNETs to point to the NVA in VNET1

Show answer and explanation

Correct answer: A

Explanation

To route traffic from VNET2 through VNET1’s NVA, VNET1 must 'Allow gateway transit' so that its gateway (or NVA) is available for remote use, and VNET2 must 'Use remote gateways' to direct its outbound traffic via VNET1.

  • A. Correct.

    This is the correct setting to allow VNET2 to use VNET1's gateway or NVA for outbound traffic. VNET1 sets 'Allow gateway transit', and VNET2 sets 'Use remote gateways'.

  • B. Incorrect.

    The gateway transit option must be enabled on the VNET hosting the gateway (VNET1), not on the remote VNET (VNET2).

  • C. Incorrect.

    Enabling 'Allow forwarded traffic' alone is insufficient for VNET2 to use VNET1’s NVA for Internet egress. You need the gateway transit options.

  • D. Incorrect.

    While you may need to adjust user-defined routes for more complex routing scenarios, without the correct peering settings, VNET2 cannot use VNET1’s gateway or NVA.

AZ-104 Question 203

Single answer

You manage an Azure environment with two separate virtual networks: VNet1 (which has a VPN gateway) and VNet2. You need to configure VNet peering so that resources in VNet2 can use the VPN gateway in VNet1 for on-premises connectivity. Which configuration should you implement on the peerings?

  1. A

    Enable 'Allow gateway transit' on the VNet1 peering and 'Use remote gateways' on the VNet2 peering to share VNet1’s gateway.

  2. B

    Enable 'Use remote gateways' on both VNet peerings to allow each VNet to use its own local gateway.

  3. C

    Enable 'Allow forwarded traffic' on both VNet peerings to allow traffic to be forwarded between VNet1 and VNet2.

  4. D

    Disable 'Allow gateway transit' on both VNet peerings to ensure local traffic does not leave its VNet.

Show answer and explanation

Correct answer: A

Explanation

When peering two VNets so that one can use the other's VPN gateway, the gateway-hosting VNet must have 'Allow gateway transit' enabled. The other VNet must have 'Use remote gateways' configured, enabling it to route traffic through the remote gateway.

  • A. Correct.

    This is the correct configuration. The VNet hosting the gateway must have 'Allow gateway transit' enabled, and the peered VNet must be set to 'Use remote gateways' to leverage the gateway in the other VNet.

  • B. Incorrect.

    Enabling 'Use remote gateways' on both sides without 'Allow gateway transit' on the gateway-hosting VNet will not allow shared access to the VPN gateway.

  • C. Incorrect.

    Allowing forwarded traffic is used for scenarios like NVA forwarding but does not alone enable the use of a gateway from another VNet.

  • D. Incorrect.

    Disabling 'Allow gateway transit' prevents the use of a gateway in a peered VNet, so on-premises connectivity through the remote gateway will not be possible.

AZ-104 Question 204

Select 2

You manage an Azure environment that includes two virtual networks (VNetA and VNetB) in different subscriptions. Both VNets have unique, non-overlapping address spaces. You want to enable direct communication between these networks over the Azure backbone with minimal latency. Which two actions should you take to establish connectivity between VNetA and VNetB?

  1. A

    Create a virtual network peering from VNetA to VNetB

  2. B

    Create a virtual private gateway to route traffic between the VNets

  3. C

    Enable traffic forwarding on a Network Security Group (NSG) tied to each VNet

  4. D

    Create a virtual network peering from VNetB to VNetA

Show answer and explanation

Correct answers: A, D

Explanation

When configuring virtual network peering, each VNet must have a peering to the other, ensuring that traffic can flow bidirectionally using the Azure backbone. Because the VNets already have non-overlapping address ranges, the only additional required steps are to create the peerings from each side.

  • A. Correct.

    A separate virtual network peering must be created in each direction (from VNetA to VNetB) for bidirectional communication. This is one of the required steps.

  • B. Incorrect.

    A virtual private gateway (or VPN gateway) is not required for direct peering within Azure. This is used for site-to-site VPN or connection to on-premises networks, not VNet peering between Azure VNets.

  • C. Incorrect.

    You do not need to enable 'traffic forwarding' on an NSG for this scenario. NSGs control traffic at a subnet or network interface level but do not establish the virtual network peering itself.

  • D. Correct.

    A matching peering must also be created from VNetB to VNetA, ensuring both VNets trust and can route traffic to each other over the Azure backbone.

AZ-104 Question 205

Single answer

You are an Azure Administrator for a company that hosts a web application on a virtual machine. The development team reports that the public IP address to access the application changes whenever the VM is deallocated and then started again. Which configuration step should you perform next to ensure the VM always uses the same public IP address?

  1. A

    Change the public IP address assignment method to Static in the IP configuration

  2. B

    Enable Accelerated Networking on the virtual machine’s network interface

  3. C

    Deploy the VM into an Availability Zone to lock the public IP address

  4. D

    Configure a reserved private IP address in the virtual network settings

Show answer and explanation

Correct answer: A

Explanation

When you require a public IP address to remain the same after deallocation, you should configure a Static assignment for the public IP resource. Dynamic IP addresses can change whenever the VM is stopped and deallocated, making Static assignment crucial for consistently reachable external endpoints.

  • A. Correct.

    Switching from Dynamic to Static assignment is the recommended approach to ensure the public IP address remains consistent even if the VM is deallocated and restarted.

  • B. Incorrect.

    Accelerated Networking improves network performance for the VM but does not affect how the public IP address is assigned.

  • C. Incorrect.

    Availability Zones provide higher availability by distributing VMs across physically separate locations, but they do not guarantee a consistent public IP address by themselves.

  • D. Incorrect.

    Private IP addresses pertain to internal communication within the virtual network and do not ensure a consistent public-facing IP.

Timed practice exam

Take a AZ-104 practice test under exam conditions

60 questions in 60 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

AZ-104 practice questions 201 to 288 of 288

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 3 pages of up to 100 questions.

  1. 201.You have an existing Azure virtual network (VNet) named VNet1 with an address space of 10.0.0.0/16....
  2. 202.You have two virtual networks, VNET1 and VNET2, in separate regions. VNET1 hosts a network virtual appliance...
  3. 203.You manage an Azure environment with two separate virtual networks: VNet1 (which has a VPN gateway) and...
  4. 204.You manage an Azure environment that includes two virtual networks (VNetA and VNetB) in different...
  5. 205.You are an Azure Administrator for a company that hosts a web application on a virtual machine. The...
  6. 206.Your company hosts a web application on multiple Azure VMs placed behind an Azure Load Balancer. You notice...
  7. 207.You are managing a multi-tier application hosted in Azure that requires a single consistent public IP address...
  8. 208.You have a virtual network with multiple subnets. You want to route traffic from the front-end subnet to a...
  9. 209.You have created a route table with a user-defined route that directs all outbound traffic (0.0.0.0/0) to a...
  10. 210.You manage an Azure Virtual Network that includes multiple subnets, including Subnet A hosting a set of VMs....
  11. 211.You have an Azure VM named VM1 in a subnet secured by a Network Security Group (NSG). VM1 can ping the...
  12. 212.You have deployed a new Azure VM in a subnet that routes all outbound traffic through a Network Virtual...
  13. 213.You have deployed a new Azure virtual machine (VM) within a virtual network that hosts multiple subnets. This...
  14. 214.You are an Azure Administrator for Contoso. You have a private virtual network hosting several Windows and...
  15. 215.You have an Azure VM running a web application on port 443 within a single virtual network (VNet). All...
  16. 216.You are an Azure Administrator for Contoso. The company uses an ExpressRoute connection to reach an Azure...
  17. 217.You have a virtual network (VNet) containing multiple subnets for web and database virtual machines (VMs)....
  18. 218.You manage an Azure environment that hosts multiple virtual machines (VMs) for different workloads in the...
  19. 219.You have deployed several virtual machines to a single subnet in an Azure Virtual Network. All these VMs are...
  20. 220.You have an Azure VM running a custom web service on TCP port 8080. The VM is in a subnet associated with an...
  21. 221.Your company requires inbound HTTPS traffic (TCP port 443) from an on-premises network to reach an Azure VM....
  22. 222.An Azure administrator configures a network security group (NSG) named NSG-Subnet on a subnet to allow...
  23. 223.You are an Azure Administrator for an organization that wants to enable secure RDP and SSH connections to...
  24. 224.You are administering a new deployment in Azure where multiple Windows and Linux virtual machines need to be...
  25. 225.Your organization has an Azure virtual network (VNet) in the East US region with an address space of...
  26. 226.You manage an Azure environment that hosts a web application in Azure App Service and an Azure SQL Database....
  27. 227.You are the Azure Administrator for Contoso. You have an Azure web app running in a subnet within your...
  28. 228.You manage a virtual network (VNet) that hosts several Azure VMs in a single subnet. You also have an Azure...
  29. 229.You are an Azure Administrator for an online retail company. The company’s Azure environment includes a...
  30. 230.You have configured a private endpoint for an Azure Storage account to restrict access to your internal...
  31. 231.You have successfully created a Private Endpoint for an Azure Storage account in a virtual network (VNet)....
  32. 232.Your company hosts a custom internal web application on a set of Azure virtual machines within the same...
  33. 233.Your organization hosts a multi-tier application in Azure and uses a Public Load Balancer to distribute...
  34. 234.You are an Azure Administrator for a company that hosts multiple internal apps on Azure Virtual Machines, all...
  35. 235.You have a custom domain named contosostorage.com and an Azure Storage account named contosostorage that...
  36. 236.Your company has a custom domain name (for example, contoso.com) registered with an external provider. You...
  37. 237.You manage the contoso.com DNS zone in Azure. Your company wants a partner organization to independently...
  38. 238.You manage a multi-tier application in Azure. The front-end VMs should connect to a set of backend VMs that...
  39. 239.Your company is deploying a multi-tier web application in Azure. The front-end needs to be publicly...
  40. 240.You manage an Azure environment hosting a multi-tier application. The web front-end VMs reside in a public...
  41. 241.You are an Azure Administrator for an e-commerce application that uses an Azure Load Balancer to distribute...
  42. 242.You have configured a public Azure Load Balancer with two virtual machines in the backend pool. The health...
  43. 243.You have configured a Standard Azure Load Balancer to distribute inbound requests across two Linux VMs in a...
  44. 244.You are an Azure Administrator for Fabrikam, Inc., which hosts multiple Azure VMs and Azure App Service web...
  45. 245.You have an Azure virtual machine (VM) running a critical application. You need Azure Monitor to...
  46. 246.You manage an Azure environment with multiple resource groups in two subscriptions and need to centrally...
  47. 247.You are an Azure administrator overseeing a busy e-commerce Azure VM hosting a web API. Recently, the API's...
  48. 248.You manage an Azure Kubernetes Service (AKS) cluster hosting a busy e-commerce application. Customers are...
  49. 249.You are the Azure Administrator for a mission-critical application running on multiple Windows virtual...
  50. 250.You manage an Azure App Service and need to collect and retain diagnostic logs for long-term analysis. You...
  51. 251.Your company runs a line-of-business web application on Azure App Service. A new compliance requirement...
  52. 252.Your company requires you to retain Azure Storage account logs for 60 days in a Log Analytics workspace,...
  53. 253.You are an Azure Administrator for a company whose Windows-based virtual machines send event logs to a Log...
  54. 254.You are the Azure Administrator for an application that sends all HTTP request logs to Azure Monitor. The app...
  55. 255.You manage a multi-subscription Azure environment hosting a distributed containerized application. You need...
  56. 256.Your company has a critical web application deployed in Azure App Service. You want to configure an alert...
  57. 257.You are an Azure Administrator for a critical web application running on multiple Azure VMs. You need to be...
  58. 258.Your company hosts several virtual machines in a resource group named ProductionRG. You want to be notified...
  59. 259.You are the Azure Administrator for an e-commerce application consisting of multiple Windows and Linux VMs, a...
  60. 260.Your team wants to track real-time performance metrics for their Azure virtual machines, while also...
  61. 261.A company is migrating their on-premises environment to Azure and has created multiple Windows and Linux VMs,...
  62. 262.A multi-tier application is deployed across two Azure VMs: one in the West Europe region and another in the...
  63. 263.You have two virtual machines (VMs) in the same region. You want to verify connectivity and measure latency...
  64. 264.You manage several Azure VMs in East US, and users report intermittent connectivity problems when these VMs...
  65. 265.Your organization runs multiple Azure virtual machines and requires that each VM backup is recoverable even...
  66. 266.You are an Azure Administrator for an e-commerce company that hosts a critical application on an Azure VM...
  67. 267.You are an Azure Administrator for Contoso, Inc. They have a critical line-of-business application running on...
  68. 268.You are an Azure Administrator for Contoso. You need to create a new Recovery Services vault in the East US...
  69. 269.You manage an Azure subscription with virtual machines (VMs) running in both the East US and West US regions....
  70. 270.You are managing multiple Azure virtual machines hosted in the East US region for your company’s production...
  71. 271.Your organization needs to protect both on-premises Windows Server workloads and Azure VMs using Azure...
  72. 272.Your company runs multiple Windows and Linux VMs in the East US region. You want to back up these VMs using...
  73. 273.Your organization has multiple Azure VMs running in the East US region. You have been tasked with...
  74. 274.Your organization runs several Azure VMs hosting critical workloads. You need to back up these VMs to an...
  75. 275.You have deployed multiple Windows and Linux VMs in Azure that must be backed up daily with a retention...
  76. 276.You have an Azure VM hosting critical financial data. You need to create a backup policy that performs daily...
  77. 277.You are an Azure Administrator for a company that hosts a mission-critical application on an Azure VM. A...
  78. 278.You are the Azure Administrator for a manufacturing company. One of your Azure VMs running a critical...
  79. 279.You are responsible for an Azure VM named VM1 hosting an application with critical data. The VM is protected...
  80. 280.You are an Azure Administrator for a company that hosts a critical application in a VM in the East US region....
  81. 281.Your organization hosts a critical web application on several Windows-based Azure Virtual Machines in the...
  82. 282.You are an Azure Administrator for a large retail company. You have multiple Azure VMs running in the East US...
  83. 283.Your primary Azure region hosting production workloads has experienced a critical outage, and you need to...
  84. 284.During a regional outage in your primary Azure region, you need to fail over your replicated virtual machines...
  85. 285.Your primary region has experienced a critical outage, making it completely unavailable. You need to bring...
  86. 286.Your organization protects a large number of Azure VMs using Azure Backup within a Recovery Services vault....
  87. 287.Your organization uses Azure Backup via a Recovery Services vault to protect several Azure virtual machines....
  88. 288.You are an Azure Administrator for an organization using Azure Backup to protect multiple Azure virtual...