AZ-104 - Configure and Manage Virtual Networking (19% of the exam) - Section 4.2

Configure secure access to virtual networks using NSGs, Azure Firewall, and Azure Bastion.

Apply network security groups and application security groups to filter inbound and outbound traffic at the subnet and NIC level, and use Azure Firewall for centralised, stateful inspection across virtual networks. Reach virtual machines through Azure Bastion without a public IP, and use just-in-time VM access to keep management ports closed until approved.

network security groupsapplication security groupsAzure FirewallAzure Bastionjust-in-time VM access

Practice question for this objective

Free sampleConfigure and Manage Virtual Networkingmedium

An administrator allows outbound traffic to any address over port 80 with a single outbound rule and authors no inbound rule for the return path. A colleague says responses to that allowed outbound traffic will still return because the network security group keeps a flow record per connection. Is the colleague correct?

AYes Correct
BNo

Network security groups are stateful, so allowed outbound traffic gets its responses back without a matching inbound rule, and the reverse also holds. A flow record makes the network security group stateful, so if you allow outbound traffic over a port it is not necessary to specify an inbound rule for the response; an inbound rule is only needed when communication is initiated externally.

Why A is correct: Correct. A flow record makes the network security group stateful, so if you allow outbound traffic over a port it is not necessary to specify an inbound rule for the response; an inbound rule is only needed when communication is initiated externally.

Why B is wrong: Answering No treats the group as stateless, but the flow record allows the response to return without a separately authored inbound rule.

See more AZ-104 practice questions, answers explained.

Exam traps in Configure and Manage Virtual Networking

Answers that look right on this material and are not. Each one is a distractor from a different question in the AZ-104 bank for this domain.

Each network interface may belong to only one application security group at a time
Why it is wrong: A network interface can be a member of multiple application security groups, up to the Azure limits.
Yes
Why it is wrong: Answering Yes assumes subnet association alone applies the rule, but a rule scoped to an application security group only affects interfaces that are members of that group.
Assign a public IP to each VM and restrict the inbound RDP port with a network security group rule.
Why it is wrong: This still assigns public IP addresses to the VMs, which the stated security policy forbids.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.