Microsoft Azure Administrator (AZ-104) — All Questions
← Back to practice4 questions
You want to allow inbound HTTPS (TCP 443) traffic to a subnet while blocking all other inbound traffic. Which resource and configuration should you use?
- a.An application security group with no rules
- b.A network security group with an inbound allow rule for port 443 and the default deny✓
- c.A route table with a custom route to the internet
- d.Azure Bastion enabled on the subnet
A network security group (NSG) contains prioritized allow and deny rules for inbound and outbound traffic; adding an allow rule for TCP 443 permits HTTPS while the default rules deny other inbound traffic. Application security groups are used to group VM NICs for use inside NSG rules, not as standalone filters. Route tables control traffic paths, not filtering, and Bastion provides secure management access.
Two virtual networks in the same Azure region must communicate directly with low latency using the Azure backbone, without a gateway. What should you configure?
- a.A site-to-site VPN connection
- b.A VPN Gateway with VNet-to-VNet
- c.Azure DNS private zones
- d.Virtual network peering✓
Virtual network peering connects two VNets directly over the Azure backbone with low latency and high bandwidth, and it does not require a VPN gateway. A VPN Gateway VNet-to-VNet connection also links VNets but adds gateway cost and latency, making it better suited when peering is not possible or across certain scenarios. Azure DNS handles name resolution, not connectivity.
You need to distribute inbound HTTP traffic across backend VMs with URL path-based routing and web application firewall protection. Which Azure service should you use?
- a.A public Standard Load Balancer
- b.Azure Bastion
- c.Azure Application Gateway✓
- d.A VPN Gateway
Azure Application Gateway is a layer 7 (HTTP/HTTPS) load balancer that supports URL path-based routing and an optional Web Application Firewall. A Load Balancer operates at layer 4 (TCP/UDP) and cannot route based on URL paths or provide a WAF. Bastion and VPN Gateway serve management access and cross-network connectivity, not load balancing.
You want to securely connect to your Azure VMs over RDP and SSH from the Azure portal without exposing public IP addresses or opening inbound ports on the VMs. What should you deploy?
- a.Azure Bastion in the virtual network✓
- b.A public IP address on each VM with an NSG rule for RDP
- c.A VPN Gateway with point-to-site configuration
- d.Azure Application Gateway
Azure Bastion provides secure RDP and SSH connectivity to VMs directly through the Azure portal over TLS, so the VMs need no public IP and no inbound RDP/SSH ports open to the internet. Assigning public IPs and opening ports increases the attack surface. A VPN Gateway is a broader connectivity solution and Application Gateway is a load balancer, neither being the simplest secure-access answer.