Microsoft Azure Administrator (AZ-104) — All Questions

You want to allow inbound HTTPS (TCP 443) traffic to a subnet while blocking all other inbound traffic. Which resource and configuration should you use?

• a.An application security group with no rules
• b.A route table with a custom route to the internet
• c.Azure Bastion enabled on the subnet
• d.A network security group with an inbound allow rule for port 443 and the default deny✓

A network security group (NSG) contains prioritized allow and deny rules for inbound and outbound traffic; adding an allow rule for TCP 443 permits HTTPS while the default rules deny other inbound traffic. Application security groups are used to group VM NICs for use inside NSG rules, not as standalone filters. Route tables control traffic paths, not filtering, and Bastion provides secure management access.

Two virtual networks in the same Azure region must communicate directly with low latency using the Azure backbone, without a gateway. What should you configure?

• a.Virtual network peering✓
• b.Azure DNS private zones
• c.A site-to-site VPN connection
• d.A VPN Gateway with VNet-to-VNet

Virtual network peering connects two VNets directly over the Azure backbone with low latency and high bandwidth, and it does not require a VPN gateway. A VPN Gateway VNet-to-VNet connection also links VNets but adds gateway cost and latency, making it better suited when peering is not possible or across certain scenarios. Azure DNS handles name resolution, not connectivity.

You need to distribute inbound HTTP traffic across backend VMs with URL path-based routing and web application firewall protection. Which Azure service should you use?

• a.Azure Application Gateway✓
• b.A public Standard Load Balancer
• c.A VPN Gateway
• d.Azure Bastion

Azure Application Gateway is a layer 7 (HTTP/HTTPS) load balancer that supports URL path-based routing and an optional Web Application Firewall. A Load Balancer operates at layer 4 (TCP/UDP) and cannot route based on URL paths or provide a WAF. Bastion and VPN Gateway serve management access and cross-network connectivity, not load balancing.

You want to securely connect to your Azure VMs over RDP and SSH from the Azure portal without exposing public IP addresses or opening inbound ports on the VMs. What should you deploy?

• a.A public IP address on each VM with an NSG rule for RDP
• b.A VPN Gateway with point-to-site configuration
• c.Azure Bastion in the virtual network✓
• d.Azure Application Gateway

Azure Bastion provides secure RDP and SSH connectivity to VMs directly through the Azure portal over TLS, so the VMs need no public IP and no inbound RDP/SSH ports open to the internet. Assigning public IPs and opening ports increases the attack surface. A VPN Gateway is a broader connectivity solution and Application Gateway is a load balancer, neither being the simplest secure-access answer.