AZ-104 - Configure and Manage Virtual Networking (19% of the exam) - Section 4.1

Configure and manage virtual networks including subnets, peering, and service endpoints.

Design virtual network address spaces and divide them into subnets to segment workloads, then connect virtual networks with VNet peering for low-latency private traffic. Distinguish service endpoints, which reach PaaS services over the Azure backbone while keeping a public endpoint, from private endpoints, which project a service into the network on a private IP.

virtual networkssubnetsVNet peeringservice endpointsprivate endpoints

Practice question for this objective

Free sampleConfigure and Manage Virtual Networkingmedium

An administrator enables a service endpoint for Azure Storage on a virtual machine subnet and then adds a virtual network rule on the storage account. After enabling the endpoint, what change occurs to the source IP address that storage sees for requests from VMs in that subnet?

AIt switches from a private IPv4 address to a new public IPv4 address of the VM in the subnet.
BIt switches from a public IPv4 address to a shared gateway IPv4 address in front of the subnet.
CIt switches from a public IPv4 address over to the private IPv4 address of the VM in the subnet. Correct
DIt switches from a private IPv4 address to a reserved firewall IPv4 address held for the subnet.

Service endpoints change the request source to the VM private IPv4 address, enabling virtual network rules on the service. With service endpoints, the source IP addresses of VMs in the subnet switch from using public IPv4 addresses to using private IPv4 addresses when accessing the service, which is what lets a virtual network rule secure the resource.

Why A is wrong: This reverses the actual behaviour; service endpoints move the source to the private address.

Why B is wrong: No NAT or gateway device is introduced; the source becomes the VM private address itself.

Why C is correct: Correct. With service endpoints, the source IP addresses of VMs in the subnet switch from using public IPv4 addresses to using private IPv4 addresses when accessing the service, which is what lets a virtual network rule secure the resource.

Why D is wrong: Service endpoints remove the need for reserved public addresses rather than introducing a reserved one.

See more AZ-104 practice questions, answers explained.

Exam traps in Configure and Manage Virtual Networking

Answers that look right on this material and are not. Each one is a distractor from a different question in the AZ-104 bank for this domain.

Virtual network peering, which forwards over an already configured peering
Why it is wrong: The grounding states you can't specify Virtual network peering as the next hop type in UDRs; Azure creates it only when you configure a peering.
Configure regional virtual network peering between the two virtual networks
Why it is wrong: Regional virtual network peering connects virtual networks within the same Azure region, so it cannot join networks in different regions.
Yes
Why it is wrong: Saying Yes ignores the Azure SQL-specific rule; the all-region flexibility applies to other services, not to Azure SQL Database.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.