Free AZ-104 Practice Test – 2025 Updated

B. Azure PowerShell: While Azure PowerShell can manage Azure DNS, it lacks a single,

dedicated cmdlet for importing an entire zone file. Accomplishing this would require writing a

custom script to parse the file and create each record individually, which is more effort.

C. the Azure portal: Using the Azure portal would require manually creating each of the

1,000 DNS records. This is the most time-consuming and error-prone method, representing

the maximum administrative effort.

D. the DNS Manager console: This tool is used to manage on-premises Windows Server

DNS. It has no native capability to interact with or migrate zones directly to the Azure DNS

service.

1. Microsoft Azure Documentation, "Tutorial: Import and export a DNS zone file using the

Azure CLI": This official tutorial explicitly details the use of the az network dns zone import

command as the primary method for importing a zone file. It states, "This article explains

how to import and export a DNS zone file for Azure DNS by using the Azure CLI."

URL: https://learn.microsoft.com/en-us/azure/dns/dns-import-export

2. Microsoft Azure Documentation, "az network dns zone import": The reference for the

specific Azure CLI command confirms its purpose: "Create a DNS zone and records from a

local zone file." This directly addresses the requirement to move the zone with minimal

effort.

URL: https://learn.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-clilatest#az-network-dns-zone-import

3. Microsoft Azure Documentation, "New-AzDnsRecordSet": The documentation for the

comparable Azure PowerShell cmdlet shows it is designed to create individual record sets,

confirming that a bulk import requires additional scripting, unlike the Azure CLI's direct

import command.

URL: https://learn.microsoft.com/en-us/powershell/module/az.dns/new-azdnsrecordset

B. a new public load balancer for VM3: This is an inefficient and unnecessary solution. The

existing load balancer is capable of handling this requirement with the correct rule

configuration, avoiding additional cost and complexity.

C. a frontend IP configuration: This defines the public IP address for the load balancer.

While necessary for the load balancer to function, it does not define the rules for directing

traffic to backend resources.

D. a load balancing rule: A load balancing rule would distribute RDP connections across all

three virtual machines (VM1, VM2, and VM3), not direct them exclusively to VM3 as

required.

1. Microsoft Azure Documentation - What is Azure Load Balancer?: "An inbound NAT rule

forwards incoming traffic sent to the frontend IP address and port combination to a specific

virtual machine or instance in the backend pool. A load balancing rule distributes incoming

traffic across all instances within the backend pool."

URL: https://docs.microsoft.com/en-us/azure/load-balancer/load-balanceroverview#inbound-nat-rule

2. Microsoft Azure Documentation - Manage inbound NAT rules for Azure Load Balancer:

"Azure Load Balancer supports inbound network address translation (NAT) rules. You use

these rules to specify a backend resource to route traffic to from the load balancer

frontend."

URL: https://docs.microsoft.com/en-us/azure/load-balancer/manage-inbound-nat-rules

•

Microsoft Azure Documentation - Load Balancer SKUs: This document

explicitly details the differences between Basic and Standard SKU load

balancers. In the feature comparison table, under "Backend pool," it specifies

that the Basic SKU backend pool is limited to a "single availability set, single

virtual machine scale set, or a single virtual machine." This confirms that

multiple standalone VMs are not supported in a single backend pool for the

Basic SKU.

o URL: https://docs.microsoft.com/en-us/azure/load-balancer/skus (Refer

to the "SKU comparison" section).

•

Microsoft Azure Documentation - Load Balancer Components: This page

details the components of a load balancer, including the backend pool. It

states, "For a Basic load balancer, the backend pool can't include more than

one virtual machine that isn't part of an availability set or a virtual machine

scale set."

o URL: https://learn.microsoft.com/en-us/azure/loadbalancer/components#backend-pools (Refer to the "Backend pools"

section).

1. Microsoft Azure Docs What is Azure Private DNS? (Functions: linking, auto-registration)

https://learn.microsoft.com/en-us/azure/dns/private-dns-overview#virtual-network-links

2. Microsoft Azure Docs Create a private DNS zone and link it to a virtual network (linking

rules, auto-registration option)

https://learn.microsoft.com/en-us/azure/dns/private-dns-getstarted-portal#link-a-virtualnetwork-to-the-private-zone

3. Microsoft Azure Docs Reverse DNS for Private DNS (automatic PTR registration)

https://learn.microsoft.com/en-us/azure/dns/private-dns-reverse-zones

A. Disassociating the NSG removes all its rules, permitting not blocking Internet access.

B. Inbound rules govern traffic entering the VM; they do not control outbound traffic to

websites.

D. The outbound deny rule already blocks port 80; no modification is required its scope

must simply include both VMs.

1. Microsoft Azure Documentation Network security groups overview, Associations section:

An NSG linked to a subnet applies to all network interfaces in that subnet.

https://learn.microsoft.com/azure/virtual-network/network-security-groupsoverview#associations

2. Microsoft Azure Documentation Security rules table: Outbound rules filter traffic leaving

the VM to the Internet on specified ports. https://learn.microsoft.com/azure/virtualnetwork/network-security-groups-overview#security-rules

A. Disassociating the NSG removes all its rules, permitting not blocking Internet access.

B. Inbound rules govern traffic entering the VM; they do not control outbound traffic to

websites.

D. The outbound deny rule already blocks port 80; no modification is required its scope

must simply include both VMs.

1. Microsoft Azure Documentation Network security groups overview, Associations section:

An NSG linked to a subnet applies to all network interfaces in that subnet.

https://learn.microsoft.com/azure/virtual-network/network-security-groupsoverview#associations

2. Microsoft Azure Documentation Security rules table: Outbound rules filter traffic leaving

the VM to the Internet on specified ports. https://learn.microsoft.com/azure/virtualnetwork/network-security-groups-overview#security-rules

A. Disassociating the NSG removes all its rules, permitting not blocking Internet access.

B. Inbound rules govern traffic entering the VM; they do not control outbound traffic to

websites.

D. The outbound deny rule already blocks port 80; no modification is required its scope

must simply include both VMs.

1. Microsoft Azure Documentation Network security groups overview, Associations section:

An NSG linked to a subnet applies to all network interfaces in that subnet.

https://learn.microsoft.com/azure/virtual-network/network-security-groupsoverview#associations

2. Microsoft Azure Documentation Security rules table: Outbound rules filter traffic leaving

the VM to the Internet on specified ports. https://learn.microsoft.com/azure/virtualnetwork/network-security-groups-overview#security-rules

A. Move VM1 to Subscription2: Moving a virtual machine does not establish connectivity

between the virtual networks themselves.

B. Move VNet1 to Subscription2: This is a significant administrative change. The direct

method to connect the networks as they are is with gateways, not by moving resources

between tenants.

C. Modify the IP address space of VNet2: The IP address spaces (10.0.0.0/16 and

10.10.0.0/24) do not overlap, so modification is unnecessary.

1. Microsoft Azure Documentation - Configure a VNet-to-VNet VPN gateway connection by

using the Azure portal: This official guide outlines the procedure. The first major

configuration step after creating the VNets is to "Create the virtual network gateways."

URL: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnetresource-manager-portal#create-the-virtual-network-gateways

2. Microsoft Azure Documentation - Virtual network peering: This document clarifies the

limitations of VNet peering, stating that while it can work across subscriptions, those

subscriptions must be associated with the same Azure Active Directory tenant. This

confirms peering is not an option in the given scenario.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peeringoverview#requirements-and-constraints

3. Microsoft Azure Documentation - About VNet-to-VNet VPN gateway connections: This

resource confirms that VNet-to-VNet connections are the appropriate solution for

connecting VNets in different subscriptions, which is necessary for cross-tenant scenarios.

URL: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vnet-to-vnet

B. OS disk type: The disk type (e.g., Standard HDD, Premium SSD) is not the constraint.

The requirement is that the disk must be managed, regardless of its performance tier.

D. Size: The StandardB2s VM size supports Availability Zones in regions where zones are

available. This setting is not the primary configuration that needs to be changed.

E. Image: Standard Azure Marketplace images, such as Windows Server 2016 Datacenter,

are fully compatible with deployment into an Availability Zone.

1. Microsoft Azure Documentation - Create a virtual machine in an availability zone using

the Azure portal: "To use availability zones, your VM must be created in a supported Azure

region. ... VMs must use Azure managed disks to be placed in an availability zone." This

source confirms that both the availability option must be set and managed disks must be

used.

URL: https://learn.microsoft.com/en-us/azure/virtual-machines/create-portal-availabilityzone

2. Microsoft Azure Documentation - Availability options for Azure Virtual Machines:

"Availability zones... To protect your applications from datacenter-level failures, you can

create a virtual machine in an availability zone." This highlights that the "Availability options"

setting is the direct control for this feature.

URL: https://learn.microsoft.com/en-us/azure/virtual-machines/availability

3. Microsoft Azure Documentation - Introduction to Azure managed disks: "Azure managed

disks are required for... Availability zones." This document explicitly states the dependency

on managed disks for the Availability Zone feature.

URL: https://learn.microsoft.com/en-us/azure/virtual-machines/managed-disksoverview#availability-zones

1. Microsoft Learn Add an existing VM to a flexible scale set

https://learn.microsoft.com/azure/virtual-machine-scale-sets/flexible-guestvms#prerequisites

(The VM you add must be in the same subscription, resource group, region, and virtual

network as the scale set.)

•

Microsoft Azure Documentation | Virtual network peering: This official

documentation explicitly states that virtual network peering is non-transitive.

o URL: https://docs.microsoft.com/en-us/azure/virtual-network/virtualnetwork-peering-overview

o Specific Section: Under the "Connectivity" section, it states: "Virtual

network peering is non-transitive. For example, if you peer VNetA to

VNetB and VNetB to VNetC, VNetA isn't peered to VNetC." This

directly applies to the scenario where VNET2 (VNetA) cannot reach

VNET3 (VNetC) through VNET1 (VNetB).

1. Microsoft Learn, "Configure a Point-to-Site VPN connection to a VNet using native Azure

certificate authentication: Azure portal": This document explicitly states the requirement for

client-side certificates: "Each client computer that you want to connect to a VNet using a

Point-to-Site connection must have a client certificate installed." This confirms that the

solution must involve certificate installation, not policy changes in Azure AD.

URL: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-siteresource-manager-portal#client

2. Microsoft Learn, "About Point-to-Site VPN": This article outlines the different

authentication methods available for P2S VPNs, clearly separating "Native Azure certificate

authentication" from "Azure Active Directory authentication." This distinction demonstrates

that modifying policies for one does not affect the other.

URL: https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-siteabout#authentication

1. Microsoft Learn | Configure a Point-to-Site VPN client for certificate authentication: "For a

P2S connection from a Windows client computer to Azure, you must install a client

certificate. The client certificate is used for authentication... For every client computer that

you want to connect to a VNet using a Point-to-Site connection, you must install a client

certificate." This documentation confirms that a client certificate is a mandatory installation

on the client machine.

URL: https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-vpn-clientconfiguration-azure-cert

2. Microsoft Learn | What is an Azure AD joined device?: "Azure AD join allows you to join

devices directly to Azure AD without the need to join to on-premises Active Directory... It

provides users with a single sign-on (SSO) experience to your cloud and on-premises

apps." This source defines Azure AD Join, showing its purpose is related to identity and

access, not certificate distribution for VPNs.

URL: https://learn.microsoft.com/en-us/azure/active-directory/devices/concept-azure-ad-join

1. Azure Resource Locks: Microsoft Learn. (2023). Lock resources to prevent unexpected

changes. "Azure Resource Manager provides the ability to lock a subscription, resource

group, or resource to prevent other users in your organization from accidentally deleting or

modifying critical resources." https://learn.microsoft.com/en-us/azure/azure-resourcemanager/management/lock-resources

2. Azure Policy Overview: Microsoft Learn. (2024). What is Azure Policy?. "Azure Policy is a

service in Azure that you use to create, assign, and manage policies. These policies

enforce different rules and effects over your resources, so those resources stay compliant

with your corporate standards and service level agreements."

https://learn.microsoft.com/en-us/azure/governance/policy/overview

3. Network Security Groups: Microsoft Learn. (2023). Network security groups. "A network

security group contains a list of security rules that allow or deny network traffic to resources

connected to Azure Virtual Networks (VNet)." https://learn.microsoft.com/enus/azure/virtual-network/network-security-groups-overview

A. Change the priority of the RDP rule: The exhibit of effective security rules shows no

existing rule that allows RDP. You cannot change the priority of a rule that does not exist.

B. Attach a network interface: The problem description explicitly states that a network

interface named vm1173 has already been added to VM1, making this action redundant.

C. Delete the DenyAllInBound rule: DenyAllInBound is a default security rule within a

Network Security Group (NSG) and cannot be deleted. It can only be overridden by creating

a new rule with a higher priority.

1. Troubleshoot RDP connections: Microsoft Learn. The primary step in troubleshooting

RDP issues is to check the VM's status. "Check the status of the virtual machine: 1. Sign in

to the Azure portal. 2. Select Virtual machines. 3. Select the problematic virtual machine. 4.

In the overview pane for the virtual machine, check the status of the virtual machine. If the

status of the virtual machine is not Running, start it."

URL: https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/troubleshootrdp-connection#check-the-status-of-the-virtual-machine

2. Adding a Network Interface: Microsoft Learn. This document confirms that adding a NIC

requires the VM to be stopped. "You can only add a network interface to a VM when it's

stopped (deallocated)." This supports the high probability that VM1 is currently stopped.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-machine-networkinterface-add-remove?tabs=windows#add-a-network-interface-to-a-vm

3. Default NSG Rules: Microsoft Learn. This document explains that default rules cannot be

removed. "You can't remove the default rules, but you can override them by creating rules

with higher priorities."

URL: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groupsoverview#default-security-rules

A. Configure a conditional forwarder on VM1: A conditional forwarder is used to forward

queries for specific domains. It does not solve the fundamental network connectivity

problem between the isolated virtual networks.

B. Add service endpoints on VNET1: Service endpoints provide a secure, direct connection

to specific Azure PaaS services (like Azure Storage or SQL Database), not for enabling

general communication between virtual networks.

C. Add service endpoints on VNET2 and VNET3: Similar to option B, service endpoints are

not the correct mechanism for enabling communication from one VNet to a virtual machine

in another VNet.

1. Virtual network peering: "Virtual network peering enables you to seamlessly connect two

or more Azure virtual networks. The virtual networks appear as one for connectivity

purposes. The traffic between virtual machines in peered virtual networks uses the

Microsoft backbone infrastructure."

Microsoft Learn. (2024). Azure virtual network peering. Retrieved from

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

2. Name resolution for resources in Azure virtual networks: "When you're using your own

DNS servers, Azure provides a non-authoritative recursive DNS service. You must specify

your own DNS servers in the virtual network settings. The endpoints for your own DNS

servers must be reachable from the virtual machines in that virtual network." This highlights

the need for reachability, which peering provides.

Microsoft Learn. (2023). Name resolution for resources in Azure virtual networks. Retrieved

from https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-nameresolution-for-vms-and-role-instances#name-resolution-that-uses-your-own-dns-server

3. Virtual network service endpoints: "Virtual Network (VNet) service endpoints extend your

virtual network private address space and the identity of your VNet to the Azure services,

over a direct connection." This confirms service endpoints are for connecting to Azure

services, not other VNETs.

Microsoft Learn. (2024). Virtual Network service endpoints. Retrieved from

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpointsoverview

1. Microsoft Azure documentation Network security groups default and user rules

https://learn.microsoft.com/azure/virtual-network/network-security-groupsoverview#security-rules

(see table: AllowVNetInBound priority 65000, DenyAllInBound priority 65500)

2. Microsoft Azure documentation Diagnose a virtual machine network traffic filter problem

https://learn.microsoft.com/azure/network-watcher/connection-troubleshoot

(example output shows matched NSG rule and explains precedence of lower-number

priority)

A. Modify the address space of the local network gateway: This defines the on-premises IP

address ranges for routing purposes over the VPN; it does not enforce any traffic filtering

rules.

C. Remove the public IP addresses from the virtual machines: This would prevent the

applications from being accessible over the internet on port 443, which violates a key

requirement of the solution.

D. Modify the address space of Subnet1: This changes the internal IP address range for the

subnet and has no impact on filtering inbound traffic from the internet.

1. Microsoft Documentation: Network security groups. "A network security group contains

security rules that allow or deny inbound network traffic to, or outbound network traffic from,

several types of Azure resources."

URL: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groupsoverview

2. Microsoft Documentation: Create, change, or delete a network security group. This page

details the process of creating security rules, including specifying protocol (TCP),

destination port (3389), source (Internet service tag), and action (Deny).

URL: https://learn.microsoft.com/en-us/azure/virtual-network/manage-network-securitygroup?tabs=network-security-group-portal#create-a-security-rule

3. Microsoft Documentation: Virtual network service tags. "A service tag represents a group

of IP address prefixes from a given Azure service. The Internet service tag... contains the IP

address ranges that are outside of the virtual network and reachable by the public internet."

URL: https://learn.microsoft.com/en-us/azure/virtual-network/service-tagsoverview#available-service-tags

B. Modify the properties of ASG1: The properties of an ASG itself (like its name or location)

do not include a list of member VMs or NICs. The association is configured on the NIC, not

the ASG.

C. Modify the properties of NSG1: A Network Security Group (NSG) uses ASGs as sources

or destinations within its security rules. Modifying the NSG is for defining traffic rules, not for

associating a VM with an ASG.

Microsoft Azure Documentation - Application security groups: "You associate a network

interface to an application security group. A virtual machine has one or more network

interfaces attached to it." This source directly confirms that the association is made at the

network interface level.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/application-securitygroups#how-to-configure-application-security-groups

Microsoft Azure Documentation - Tutorial: Filter network traffic with a network security group

using the Azure portal: This tutorial provides a step-by-step guide. In the section "Associate

network interfaces to ASGs," the procedure is to select the network interface and then

associate it with an application security group.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-filter-networktraffic#associate-network-interfaces-to-asgs

D. Create a gateway subnet: While a gateway subnet (named GatewaySubnet) is a

mandatory prerequisite for deploying a virtual network gateway, it is a network configuration

step. The question asks for the three main actions to create the VPN solution, which are

best represented by the three core VPN resources (VNG, LNG, and Connection).

E. Create a VPN gateway that uses the Basic SKU: The Basic SKU is not supported for

configurations where a VPN Gateway and an ExpressRoute gateway coexist in the same

virtual network.

1. Coexistence SKU Limitation: Microsoft Azure Documentation. (2023). Configure

ExpressRoute and Site-to-Site VPN connections that coexist. "Limits and limitations".

"Coexistence is not supported on the Basic SKU."

URL: https://learn.microsoft.com/en-us/azure/expressroute/expressroute-howto-coexistresource-manager#limits-and-limitations

2. S2S VPN Components: Microsoft Azure Documentation. (2024). Tutorial: Create a Site-

to-Site VPN connection in the Azure portal. This tutorial outlines the main steps, which

include creating the virtual network gateway (C), the local network gateway (B), and the

connection (A).

URL: https://learn.microsoft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-portal

3. Gateway Subnet Prerequisite: Microsoft Azure Documentation. (2024). About VPN

Gateway configuration settings. "Gateway subnet". "Before you create a virtual network

gateway, you must create a gateway subnet." This confirms it as a prerequisite for the

gateway itself.

URL: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateway-settings#gwsub

1. Azure Virtual Network peering | Microsoft Learn: This official Microsoft

documentation explains the different peering statuses. It clarifies that a

Connected status is required for connectivity and describes the Disconnected

state.

o URL: https://learn.microsoft.com/en-us/azure/virtual-network/virtualnetwork-peering-overview

o Relevant Section: "Peering status" section explains that if one side of

a peering is deleted, the status on the remaining side becomes

Disconnected.

2. Create, change, or delete a virtual network peering | Microsoft Learn:

This guide details the management of VNet peerings. It implicitly supports the

answer by explaining the process for creating and deleting peerings. To fix a

Disconnected state, which results from deleting the remote link, the local link

must also be deleted and then both must be recreated.

o URL: https://learn.microsoft.com/en-us/azure/virtual-network/virtualnetwork-manage-peering

o Relevant Section: The "Permissions" and "Create a peering" sections

outline the requirements for establishing a Connected state, which

involves reciprocal actions on both virtual networks. The process to

recover from a Disconnected state involves deleting the remaining

peering and starting over.

•

Azure Load Balancer SKUs Documentation: States the constraints for

Basic SKU, including the requirement for backend pool members to be in a

single availability set or scale set.

o Source: Microsoft Azure Documentation

o URL: https://learn.microsoft.com/en-us/azure/load-balancer/skus#skus

(Refer to the "Backend pool" row in the comparison table).

•

Azure Load Balancer Components Documentation: Explains that load

balancing rules are used to define how traffic is distributed to the VMs and

that a health probe monitors the health of the backend instances.

o Source: Microsoft Azure Documentation

o URL: https://learn.microsoft.com/en-us/azure/loadbalancer/components#load-balancing-rule

o URL: https://learn.microsoft.com/en-us/azure/load-balancer/loadbalancer-custom-probe-overview

•

Microsoft Azure Documentation (Official Vendor Documentation):

o Regarding removing the Public IP: In the tutorial for creating a public

standard load balancer, the documentation explicitly states, "Virtual

machines in the backend pool can't have a public IP address. If your

virtual machines have public IP addresses, you must remove them

before you add them to the backend pool of the load balancer."

§

Source: Microsoft Learn, Quickstart: Create a public load

balancer - Azure portal, Section: "Create virtual machines".

Direct URL: https://learn.microsoft.com/en-us/azure/loadbalancer/quickstart-load-balancer-standard-public-

portal?tabs=bicep#create-virtual-machines

o Regarding the need for an NSG: The Standard Load Balancer

overview states, "A standard load balancer is closed to inbound

connections unless opened by a network security group. You can

create a network security group and associate it with a virtual machine

to allow traffic."

§

Source: Microsoft Learn, What is Azure Load Balancer?,

Section: "Standard Load Balancer > Secure by default". Direct

URL: https://learn.microsoft.com/en-us/azure/load-balancer/loadbalancer-overview#standard-load-balancer

A. No VNet exists in North Europe, so a NIC cannot be created there.

C. West Europe and North Europe lack a VNet; without one, a NIC cannot be created in

those regions.

D. West Europe lacks a VNet, so a NIC cannot be created there.

1. Microsoft Azure documentation Create a network interface: The network interface must

be in the same region and subscription as the virtual network.

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-networkinterface#create-a-network-interface

2. Microsoft Azure documentation Requirements and constraints: same-region requirement

reiterated.

https://learn.microsoft.com/en-us/azure/virtual-network/network-interfaceoverview#requirements-and-constraints

A. Update the DNS suffix on VM1 to be adatum.com: A DNS suffix is used for resolving

unqualified, single-label names. It does not fix the underlying inability to resolve a fully

qualified domain name (FQDN) in a public zone.

C. Create an SRV record in the contoso.com zone: An SRV record is for locating specific

services and has no role in resolving standard host (A) records for a different domain

(adatum.com).

D. Modify the Access control (IAM) settings for link1: IAM roles manage permissions for

Azure resources. They do not affect the DNS resolution process for virtual machines within

a virtual network.

1. Microsoft Azure Documentation, "Tutorial: Host your domain in Azure DNS": This tutorial

explicitly states the requirement to delegate the domain. "Before you can delegate your

DNS zone to Azure DNS, you need to know the name servers for your zone... Once the

DNS zone is created... you need to update the parent domain with the Azure DNS name

servers. Each registrar has its own DNS management tools to change the name server

records for a domain."

URL: https://docs.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns

2. Microsoft Azure Documentation, "What is Azure DNS?": This document outlines the

function of public DNS zones. "To host your domain in Azure DNS, you need to buy a

domain name... You then create a DNS zone in Azure DNS for that domain name... Finally,

you must configure the name servers for your domain to point to the Azure DNS name

servers. This process is called domain delegation."

URL: https://docs.microsoft.com/en-us/azure/dns/dns-overview

3. Microsoft Azure Documentation, "Azure Private DNS FAQ": This document clarifies the

distinction between private and public zones. The problem described for adatum.com is a

public DNS configuration issue, separate from the private zone contoso.com which is

working correctly via the VNet link.

URL: https://docs.microsoft.com/en-us/azure/dns/private-dns-faq

1. Microsoft Learn | Azure Network Watcher | IP flow verify overview: "IP flow verify checks

if a packet is allowed or denied to or from a virtual machine... If the packet is denied by a

security group, the name of the rule that denied the packet is returned."

URL: https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flowverify-overview

2. Microsoft Learn | Azure Network Watcher | Troubleshoot connections with Azure Network

Watcher using the Azure portal: "Connection troubleshoot provides the capability to check a

direct TCP connection from a virtual machine (VM) to a VM, fully qualified domain name

(FQDN), URI, or IPv4 address."

URL: https://learn.microsoft.com/en-us/azure/network-watcher/network-watcherconnectivity-portal

3. Microsoft Learn | Azure Network Watcher | What is Azure Network Watcher?: This

document provides an overview of the diagnostic tools, distinguishing the purpose of IP flow

verify (diagnose connectivity filtering problems) from Connection troubleshoot (test

connections between a source and destination).

URL: https://learn.microsoft.com/en-us/azure/network-watcher/network-watcheroverview#diagnose

•

Microsoft Azure Documentation, Name resolution for VMs and role instances:

"If you specify a custom DNS server for a virtual network, you can also specify a

different DNS server for one or more network interfaces in the virtual network. The

DNS server setting for a network interface overrides the DNS server setting for the

virtual network." This document outlines the order of precedence for DNS settings in

Azure.

o URL: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networksname-resolution-for-vms-and-role-instances#name-resolution-that-uses-your-

own-dns-server (Refer to the section on "Name resolution that uses your own

DNS server" and the specifics on Network Interface settings).

1. Microsoft Azure Documentation: Move resources to a new resource

group or subscription. This document provides the primary guidelines for

resource moves.

o URL: https://learn.microsoft.com/en-us/azure/azure-resourcemanager/management/move-resource-group-and-subscription

o Specific Section: Under the "Checklist before moving resources," the

document states, "The source and destination resource groups must

exist in the same subscription." and "When moving a resource, you

also move its dependent resources."

2. Microsoft Azure Documentation: Move guidance for virtual machines.

This resource details the specific requirements for moving virtual machines

and their dependencies.

o URL: https://learn.microsoft.com/en-us/azure/azure-resourcemanager/management/move-support-resources#microsoftcompute

o Specific Section: The table for the Microsoft.Compute resource

provider confirms that virtual machines, disks, and network interfaces

can be moved. It specifies that for a VM, dependent resources like

NICs and disks must be in the same resource group and must be

moved together.

3. Microsoft Azure Documentation: Move guidance for networking

resources. This page confirms the movability of virtual networks.

o URL: https://learn.microsoft.com/en-us/azure/azure-resourcemanager/management/move-support-resources#microsoftnetwork

o Specific Section: The table for the Microsoft.Network resource

provider explicitly lists virtualNetworks as a movable resource.

1. Azure Load Balancer SKUs Comparison: Microsoft Learn. "Virtual machines with a

Standard SKU Public IP address or no Public IP address can be added to the backend pool

of a Standard Load Balancer. Virtual machines with a Basic SKU Public IP address...can be

added to the backend pool of a Basic Load Balancer." This explicitly states the compatibility

rules.

URL: https://learn.microsoft.com/en-us/azure/load-balancer/skus#skus

2. Load Balancer and Public IP address SKUs: Microsoft Learn. "You can't have both basic

and standard SKU resources. You can't mix SKU types for standalone virtual machines,

availability sets, or virtual machine scale sets in the same backend pool." This reinforces

the rule against mixing SKUs.

URL: https://learn.microsoft.com/en-us/azure/load-balancer/skus#limitations

1. Microsoft Azure Documentation - Load Balancer SKUs: "For a standard SKU load

balancer, the virtual machines in the backend pool must have standard SKU public IP

addresses or no public IP address. The network interfaces of the virtual machines must be

associated with a standard SKU public IP address." This document explicitly states the SKU

requirements.

URL: https://learn.microsoft.com/en-us/azure/load-balancer/skus#skus

2. Microsoft Azure Documentation - Azure Load Balancer overview: "Standard Load

Balancer backend pool members can have either no public IP address or a Standard SKU

public IP address." This confirms that Basic SKU public IPs are not permitted in the

backend pool of a Standard Load Balancer.

URL: https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-overview#whyuse-standard-load-balancer

3. Microsoft Azure Documentation - Upgrade a public IP address: "Stopping the resource

does not deallocate the public IP address." This reference clarifies that stopping a VM does

not disassociate or change the properties of its public IP, which is the flaw in the proposed

solution's logic.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ipupgrade#upgrade-a-public-ip-address

1. Microsoft Azure documentation Upgrade a Basic public IP to Standard

https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/standard-pubip#upgrade-a-basic-public-ip-to-standard

(Only Standard public IP addresses can be associated with resources behind a Standard

Load Balancer.)

2. Microsoft Azure documentation Upgrade a basic load balancer to Standard

https://learn.microsoft.com/en-us/azure/load-balancer/upgrade-basicstandard#incompatible-resources

(A VM NIC with a Basic public IP cannot be added to a Standard Load Balancer backend.

Replace the Basic public IP with a Standard SKU IP or remove it.)

1. Microsoft Azure Documentation, "Install an exported client certificate": This official guide

explicitly states, "To create a P2S connection from a different client computer, you must

install a client certificate on that computer. When you install a client certificate, you'll need

the password that was created when the client certificate was exported." This directly

validates the proposed solution.

Source: Microsoft Learn, "Configure a Point-to-Site VPN connection to a VNet using native

Azure certificate authentication: Azure portal", Section: "Install an exported client

certificate".

URL: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-siteresource-manager-portal#install-an-exported-client-certificate

2. Microsoft Azure Documentation, "Generate and export certificates for Point-to-Site

connections": This document details the certificate management process. The step to

export a client certificate is a prerequisite for installing it on client computers, confirming that

the certificate is a portable credential intended for this purpose.

Source: Microsoft Learn, "Generate and export certificates for Point-to-Site connections

using PowerShell", Section: "Export the client certificate".

URL: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-pointto-site#clientexport

A. Modify the protocol of Rule4: Rule4 is for RDP (port 3389). Modifying it would not enable

HTTPS on port 443 and would likely break remote desktop access.

B. Delete Rule1: Rule1 allows traffic within the virtual network. Deleting it is unnecessary,

unrelated to allowing internet traffic, and could disrupt internal communications.

C. For Rule5, change the Action to Allow and change the priority to 401: Rule5 already

allows HTTP on port 80. Changing its priority does not enable the required HTTPS traffic on

port 443.

1. Microsoft Learn: Network security groups. This document explains how NSGs filter

network traffic. It states, "To filter traffic, you create security rules... For each rule, you can

specify a source and destination, port, and protocol." This supports the creation of a new

rule for a specific port and protocol.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groupsoverview

2. Microsoft Learn: Create, change, or delete a network security group. This guide details

the properties of a security rule, including Destination port ranges, Protocol (TCP, UDP,

etc.), Action (Allow or Deny), and Priority. This confirms that creating a new rule with these

specific properties is the correct procedure.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/manage-network-securitygroup?tabs=network-security-group-portal#create-a-security-rule

3. Microsoft Learn: Default security rules. This page lists the default inbound rules, including

DenyAllInbound with a priority of 65500, which blocks all inbound traffic unless a rule with a

lower priority number explicitly allows it. This explains why a new "Allow" rule is necessary.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groupsoverview#default-security-rules

1. Azure Resource Providers and Types: This document explains that Microsoft.Network is

the provider for ARM virtual networks and NSGs, while Microsoft.ClassicNetwork is for the

classic model. Unregistering the classic provider does not affect ARM resources.

Microsoft Learn. (2024). Azure resource providers and types. Retrieved from

https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resourceproviders-and-types

2. Network Security Groups - Default Security Rules: This official documentation lists the

default rules created with every NSG. None of these rules specifically block port 8080; in

fact, the AllowVNetInBound rule permits all traffic between virtual networks by default.

Microsoft Learn. (2023). Network security groups. Retrieved from

https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groupsoverview#default-security-rules

3. Azure Policy for NSGs: To automatically enforce rules on NSGs, Azure Policy is the

correct tool. This tutorial shows how to create policies to manage NSG rules, which is the

appropriate solution for the scenario.

Microsoft Learn. (2023). Tutorial: Create and manage policies to enforce compliance.

Retrieved from https://learn.microsoft.com/en-us/azure/governance/policy/tutorials/createand-manage (This tutorial covers the general mechanism applicable to NSGs).

Microsoft Learn: Azure Virtual Network peering overview. This document outlines the key

capabilities and constraints, stating, "You can peer virtual networks that exist in two different

regions (also known as Global VNet Peering)" and "You can peer virtual networks in the

same, or different subscriptions."

URL: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peeringoverview

Microsoft Learn: Create, change, or delete a virtual network peering. This guide details the

requirements, including the need for "non-overlapping IP address spaces."

URL: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-managepeering?tabs=peering-portal#requirements-and-constraints

1. Microsoft Learn: Network security groups. This document explains how Azure processes

security rules. It states, "Security rules in a network security group are processed by

priority... When traffic matches a rule, processing stops. If you add a new rule, you can

specify its priority to determine its place in the processing order." The proposed Deny rule

would stop processing and block the traffic.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groupsoverview#security-rules

2. Microsoft Learn: How network security groups filter network traffic. This page details the

rule evaluation process. To allow the traffic, a new rule with an "Allow" action and a higher

priority (a lower number) than any blocking rule is required. The proposed solution does the

opposite.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-itworks

1. Microsoft Azure Documentation: How network security groups filter network traffic. This

document explains that rules are processed in priority order. If no explicit allow or deny rule

matches, the default rules are applied.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-itworks

2. Microsoft Azure Documentation: Default security rules. This page lists the default inbound

security rules, including DenyAllInbound at priority 65500, which blocks any traffic not

expressly permitted by a preceding rule.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groupsoverview#default-security-rules

3. Microsoft Azure Documentation: Azure Load Balancer and Network Security Groups.

When using a load balancer, the source IP of the traffic arriving at the backend virtual

machine's NIC is the original client's IP address, not the load balancer's. Therefore, NSG

rules must allow the client's IP.

URL: https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-troubleshootbackend-traffic#cause-2-nsg-is-blocking-traffic

1. Microsoft Azure Documentation Network security groups: security rules

https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groupsoverview#security-rules

(Evaluation order and DenyAll rule at priority 65500)

2. Microsoft Azure Documentation Manage NSG rules

https://learn.microsoft.com/en-us/azure/virtual-network/manage-network-securitygroup#modify-nsg-rules

(Priority affects only ordering; rule must explicitly allow required port)

1. Microsoft Azure Documentation - Understand Azure Policy effects: This document

explains the different policy effects. The append effect is explicitly shown as a way to add

security rules to an NSG, which would be required here. This implies a custom definition is

needed.

URL: https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effects#append

2. Microsoft Azure Documentation - Tutorial: Create a custom policy definition: This tutorial

demonstrates that for specific organizational requirements not covered by built-in policies,

you must create your own custom policy definitions.

URL: https://learn.microsoft.com/en-us/azure/governance/policy/tutorials/create-custompolicy-definition

3. Microsoft Azure Documentation - Azure Policy built-in definitions for Azure Networking: A

review of the built-in policies for networking confirms that there is no policy to automatically

add a specific custom rule to an NSG.

URL: https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-inpolicies#network

A. kubenet: With kubenet, pods receive IPs from a logically separate address space and

use Network Address Translation (NAT) to communicate, hiding the pod's actual IP behind

the node's IP. This prevents direct connectivity.

C. Hybrid Connection endpoints: This is a feature of Azure App Service and Functions used

for connecting from Azure to on-premises resources. It is not a network model for an AKS

cluster.

D. Azure Private Link: This service provides private connectivity to an endpoint representing

a service (like an internal load balancer), not to individual pod IPs. It is a method to expose

a service, not a fundamental cluster network type.

1. Microsoft Azure Documentation: "Concepts - Networking in Azure Kubernetes Services

(AKS)". This document explicitly compares kubenet and Azure CNI. It states, "With Azure

CNI, every pod gets an IP address from the subnet and can be accessed directly. These IP

addresses must be unique across your network space... This network model allows for

more separation of control and management of resources."

URL: https://learn.microsoft.com/en-us/azure/aks/concepts-network#compare-networkmodels

2. Microsoft Azure Documentation: "Configure Azure CNI networking in Azure Kubernetes

Service (AKS)". This source details the functionality of Azure CNI. It confirms, "Each pod

receives an IP address in the virtual network subnet. Pods can communicate with other

pods in the virtual network and on-premises networks."

URL: https://learn.microsoft.com/en-us/azure/aks/configure-azure-cni

1. Microsoft Learn Load Balancer SKUs: For an internal Standard Load Balancer, backend

instances must be in the same virtual network as the load balancer.

https://learn.microsoft.com/azure/load-balancer/skus#feature-comparison

2. Microsoft Learn Add virtual machines to the backend pool: A VM may have a public IP or

none; backend pool membership depends on the NIC virtual-network location, not on

public-IP presence.

https://learn.microsoft.com/azure/load-balancer/quickstart-load-balancer-standard-internalportal#add-virtual-machines

These authoritative sources demonstrate that public-IP removal alone is insufficient to add

VM2 to LB1 backend pool.

1. Microsoft Learn - Tutorial: Manage network security groups by using Azure Policy: This

official tutorial demonstrates how to create a policy initiative that includes a policy to

"Append a network security group to each subnet." While the specific goal is different, it

validates the core concept of using Azure Policy with an append effect to modify network

resources like NSGs automatically.

URL: https://learn.microsoft.com/en-us/azure/governance/policy/tutorials/manage-networksecurity-groups

2. Microsoft Learn - Understand Azure Policy effects: This document details the modify and

append effects. The modify effect can "add, update, or remove properties or tags on a

resource during creation or update." This is precisely what is needed to add a security rule

to a new NSG.

URL: https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effects#modify

3. Microsoft Learn - Azure Policy built-in definitions for Azure Networking: This page lists

built-in policies, including ones that manage NSG rules. A custom policy can be modeled

after these to create the specific rule required by the scenario.

URL: https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-inpolicies#network

A. IP flow verify: This tool checks if traffic is allowed or denied by Network Security Group

(NSG) rules for a specific flow. It does not measure performance metrics like RTT.

B. Connection troubleshoot: This provides a point-in-time connectivity check and reports the

latency for that single attempt, not an average over time.

D. NSG flow logs: This feature records IP traffic flowing through an NSG for security

auditing and traffic analysis. It does not provide performance data like RTT.

Connection Monitor: Microsoft Learn. (2023). Connection monitor overview. "Connection

Monitor provides unified, end-to-end connection monitoring in Azure Network Watcher...

You can monitor network connectivity and configure alerts for virtual machines...

Connection Monitor can measure the round-trip time and packet loss for TCP, ICMP, and

HTTP connections."

URL: https://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor-overview

Connection Troubleshoot: Microsoft Learn. (2023). Tutorial: Diagnose a virtual machine

network routing problem using the Azure portal. "Connection troubleshoot... checks a direct

TCP connection from a virtual machine (VM) to a VM... It returns information about the

connection attempt, including the latency in milliseconds."

URL: https://learn.microsoft.com/en-us/azure/network-watcher/diagnose-vm-networkrouting-problem

IP Flow Verify: Microsoft Learn. (2023). Introduction to IP flow verify in Azure Network

Watcher. "IP flow verify indicates if a packet is allowed or denied to or from a virtual

machine."

URL: https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flowverify-overview

1. Microsoft Azure Official Documentation, "Azure Load Balancer SKUs":

This document directly compares the Basic and Standard SKUs. In the

"Backend pool endpoints" row, it specifies that for Basic Load Balancer, the

endpoints must be "Virtual machines in a single availability set or virtual

machine scale set." For Standard Load Balancer, it allows "Any virtual

machines or virtual machine scale sets in a single virtual network."

o URL: https://learn.microsoft.com/en-us/azure/load-balancer/skus

o Section: SKU comparison table.

2. Microsoft Azure Official Documentation, "Azure Load Balancer

components": This document details the components of a load balancer. It

reinforces that a load balancer rule cannot span two virtual networks,

establishing the virtual network as the boundary for all load balancer

operations, which is the baseline requirement for the more flexible Standard

SKU.

o URL: https://learn.microsoft.com/en-us/azure/loadbalancer/components

o Section: Limitations.

1. Microsoft Learn Configure active-active VPN gateway connections

https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-activeactive-config

An active-active VPN gateway has two gateway instances. Each instance has its own public

IP address.

For cross-premises connections, create two local network gatewaysone for each on-

premises VPN device.

2. Microsoft Learn About VPN Gateway redundancy

https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable

Describes single virtual network gateway object with multiple instances and SLA failover

behavior.

A. vm1.core.windows.net: This FQDN suffix (core.windows.net) is used for Azure Storage

services, not for virtual machine DNS names.

B. vm1.azure.com: This is a generic domain and not a standard FQDN format that Azure

automatically assigns to virtual machines.

C. vm1.westeurope.cloudapp.azure.com: This is the standard FQDN format for a VM's

public IP address. A reverse lookup on the private IP uses the internal DNS suffix, not the

public one.

Microsoft Azure Documentation: "Name resolution for resources in Azure virtual networks".

This document explicitly states the FQDN format for Azure-provided internal name

resolution. Under the "Azure-provided name resolution" section, it confirms the internal

FQDN format. The "Reverse DNS" section further clarifies that reverse queries for private

IPs within a VNet return this internal FQDN.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-nameresolution-for-vms-and-role-instances#azure-provided-name-resolution

Microsoft Azure Documentation: "DNS in Azure". This page provides an overview of DNS

features, including the distinction between public and private DNS zones and the automatic

registration of VMs in Azure's internal DNS.

URL: https://learn.microsoft.com/en-us/azure/dns/dns-overview

1. Network Security Groups - Rule Processing: Azure processes network security group

(NSG) rules in ascending order of priority. The first rule that matches the traffic is applied.

The existing deny rule at priority 200 will be evaluated before the default allow rules.

Microsoft Azure Documentation. (2023). Network security groups. Retrieved from

https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groupsoverview#security-rules

2. Azure Service Tags - AzureLoadBalancer: The AzureLoadBalancer service tag

represents the virtual IP address of the host node where Azure's health probes originate. It

is intended for health probe traffic, not for client data traffic forwarded by the load balancer.

Microsoft Azure Documentation. (2023). Virtual network service tags. Retrieved from

https://docs.microsoft.com/en-us/azure/virtual-network/service-tags-overview#availableservice-tags

3. Azure Load Balancer and NSGs: When using a load balancer, the source IP address of

the packet arriving at the backend virtual machine is the original client's IP address, not the

load balancer's IP. Therefore, NSG rules must allow traffic from the client's source IP.

Microsoft Azure Documentation. (2023). Filter network traffic with a network security group.

Retrieved from https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-filter-networktraffic#create-security-rules (This tutorial demonstrates creating rules for web traffic from the

Internet tag, not the AzureLoadBalancer tag).

A: Service endpoints are used to secure Azure service resources to a virtual network, which

is unrelated to P2S VPN gateway functionality.

B: Resetting a gateway is a troubleshooting action to restart the device; it does not change

its underlying type from policy-based to route-based.

D: A "connection" resource is created for Site-to-Site (S2S) or VNet-to-VNet tunnels, not for

configuring the P2S client pool on the gateway itself.

F: A virtual network is configured with a private IP address space. Public IP addresses are

assigned to specific resources like a gateway, not to the VNet's address space.

1. Microsoft Documentation: About VPN Gateway settings. This document includes a table

that explicitly states Point-to-Site connections are "Not supported" for PolicyBased VPN

gateways and "Supported" for RouteBased VPN gateways.

URL: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateway-settings#vpntype (Refer to the "Gateway types" and the comparison table under

the "VPN type" section).

2. Microsoft Documentation: Delete a virtual network gateway. This guide confirms that to

change the gateway type, the existing gateway must be deleted and a new one created.

URL: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-delete-vnetgateway-portal#delete-the-virtual-network-gateway (The "Delete the virtual network

gateway" section outlines the procedure).

3. Microsoft Documentation: About P2S VPN. This article provides an overview of P2S

VPNs and their requirements, reinforcing that a route-based gateway is necessary.

URL: https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about (The "What

VPN type is used for P2S?" section).

1. Microsoft Azure Documentation | What is an Azure Private DNS zone?:

o Content: This document explains the concepts of registration and

resolution virtual networks. It states, "If you designate a virtual network

as a registration network... DNS records for the virtual machines in that

virtual network are automatically registered in the zone." It also clarifies

that for resolution, a VNet must be linked to the zone.

o URL: https://learn.microsoft.com/en-us/azure/dns/private-dns-overview

o Specific Section: "Private DNS zones" and "Virtual network links".

2. Microsoft Azure Documentation | Azure Private DNS scenarios:

o Content: This source details the functionality of virtual network links for

name resolution. It specifies that "To resolve records in a private DNS

zone from your virtual network, you must link the virtual network with

the zone. A linked virtual network has full access and can resolve all

DNS records in the private zone."

o URL: https://learn.microsoft.com/en-us/azure/dns/private-dns-scenarios

o Specific Section: "Name resolution for VMs in one VNet".

3. Microsoft Azure Documentation | Autoregistration feature:

o Content: This page describes the autoregistration feature in detail. It

confirms that autoregistration works by creating a virtual network link

and enabling the "auto registration" setting on that link. This directly

supports the reason why VM1 (in the un-linked VNet1) is not

registered, while VMs in the linked VNet2 would be.

o URL: https://learn.microsoft.com/en-us/azure/dns/private-dnsautoregistration

o Specific Section: "How auto registration works with new and existing

VMs".

•

Azure DNS Private Zones Scenarios: Microsoft Learn. This document

outlines the capabilities and limitations of Azure Private DNS zones.

o URL: https://learn.microsoft.com/en-us/azure/dns/private-dns-scenarios

o Section: "Cross-region VNet linking support for private zones" - This

section details the limitation: "The private zone can only be linked to

one virtual network if they are in different regions."

•

What is an Azure Private DNS zone: Microsoft Learn. This official

documentation provides the fundamental concepts of private DNS zones and

virtual network links.

o URL: https://learn.microsoft.com/en-us/azure/dns/private-dnsoverview#virtual-network-links

o Section: "Virtual network links" - This section explains auto-registration

and the rule that "a virtual network can be linked to only one private

zone with autoregistration enabled." It also confirms that a virtual

network can be linked to multiple zones for resolution.

1. Azure Bastion Documentation - Subnet Settings: This official Microsoft

documentation specifies the requirements for the Azure Bastion subnet.

o Subnet Name: It explicitly states, "When you create this subnet, use

the name value AzureBastionSubnet."

o Subnet Size: It states, "The Azure Bastion subnet must be at least /26

or larger (/25, /24 etc.)." Although /26 is the current guidance, /27 was

the previous minimum and is the largest and only suitable option

provided in the question.

o URL: https://learn.microsoft.com/en-us/azure/bastion/bastionnsg#apply-nsgs-to-the-azurebastionsubnet (This section on NSGs

reiterates the naming and size requirements under the

"AzureBastionSubnet" heading.)

o URL: https://learn.microsoft.com/en-us/azure/bastion/configurationsettings#subnet (This section directly details the subnet configuration

settings.)

2. Azure Resource Manager - virtualNetworks/subnets Template

Reference: This documentation outlines the properties for defining subnets in

an ARM template, confirming name and addressPrefix as required properties.

o URL: https://learn.microsoft.com/enus/azure/templates/microsoft.network/virtualnetworks/subnets?pivots=d

eployment-language-bicep#subnetpropertiesformat-object

1. Microsoft Learn: Introduction to packet capture for virtual machines. This document

explicitly states, "Network Watcher packet capture allows you to create packet capture

sessions to track traffic to and from a virtual machine... You can start, stop, and download

packet captures in the Azure portal."

URL: https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-packetcapture-overview

2. Microsoft Learn: Manage packet captures with the Azure portal. This tutorial

demonstrates the configuration options, including setting a "Time limit (seconds)" and

adding filters based on source and destination IP addresses and ports, which directly

supports the solution's ability to target traffic between VM1 and VM2 for a specific duration.

URL: https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-packetcapture-manage-portal#create-a-packet-capture

1. Microsoft Learn - Connection Monitor Overview: "Connection Monitor provides unified

end-to-end connection monitoring in Azure Network Watcher... It helps you check the

reachability of an endpoint and measure latency and packet loss." This source confirms that

Connection Monitor is for health and performance monitoring, not traffic inspection.

URL: https://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor-overview

2. Microsoft Learn - Packet Capture Overview: "Network Watcher packet capture allows you

to create packet capture sessions to track traffic to and from an Azure virtual machine

(VM)... The captured data is stored in a .cap file... You can open the .cap file by using a

supported application, such as Wireshark." This source describes the exact functionality

required to "inspect all the network traffic."

URL: https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-packetcapture-overview

1. Azure Network Watcher - Packet Capture: Microsoft's official documentation describes

packet capture as the tool for tracking traffic to and from a virtual machine. It states,

"Network Watcher variable packet capture allows you to create packet capture sessions to

track traffic to and from a virtual machine... The captured data is stored in a .cap file... You

can open the capture file by using a supported application, such as Wireshark." This

confirms it is the correct tool for traffic inspection.

Source: Microsoft Learn, "Introduction to packet capture in Azure Network Watcher," URL:

https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-packet-captureoverview

2. Windows Performance Monitor: Microsoft's documentation on Performance Monitor

details its function as a tool for analyzing how programs affect a computer's performance,

both in real-time and by collecting log data for later analysis. Its capabilities are centered on

performance counters, event traces, and configuration information, not full packet content

capture.

Source: Microsoft Learn, "Windows Performance Monitor," URL:

https://learn.microsoft.com/en-us/windows-server/performance/performance-monitoringgetting-started

1. Microsoft Learn | Azure Monitor Metrics overview: "Azure Monitor Metrics is a feature of

Azure Monitor that collects numeric data from monitored resources into a time-series

database." This source confirms that metrics are numerical values, not packet data for

inspection.

URL: https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-platformmetrics

2. Microsoft Learn | Supported metrics for Microsoft.Compute/virtualMachines: This

document lists "Network In Total" (Network In) and "Network Out Total" (Network Out) with

the unit "Bytes," confirming they measure volume, not content.

URL: https://learn.microsoft.com/en-us/azure/azure-monitor/reference/supportedmetrics/microsoft-compute-virtualmachines-metrics

3. Microsoft Learn | Packet capture with Azure Network Watcher: "Network Watcher packet

capture allows you to create packet capture sessions to track traffic to and from a virtual

machine... Packet capture is a virtual machine extension that's remotely started through

Network Watcher." This source describes the correct tool for inspecting traffic.

URL: https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-packetcapture-overview

•

Remove nsg1: This is incorrect. The Network Security Group (NSG) is required to

allow incoming traffic on port 443 to reach the virtual machines' network interfaces.

The load balancer directs traffic, but the NSG permits it.

•

Create an availability set: This is incorrect. While best practice for high availability,

an availability set is a construct for the VMs themselves and is not a required step to

configure the load balancer to distribute traffic to existing VMs.

•

Backend Pool IP Configuration: Microsoft Learn documentation states that virtual

machines in the backend pool of a Standard Load Balancer cannot have instance-

level public IP addresses.

o Source: Microsoft Learn, "Azure Load Balancer SKUs". Under the "Standard

Load Balancer" section, it details backend pool constraints.

•

Load Balancer Configuration Steps: The official tutorials for creating a public load

balancer outline the necessary components and order of creation. The sequence

involves defining backend resources and health probes before creating the rules that

use them.

o Source: Microsoft Learn, "Quickstart: Create a public load balancer - Azure

portal", Section: "Create load balancer resources". This guide demonstrates

creating the backend pool, health probe, and then the load balancer rule.

•

Connect the virtual networks to the hub: This action is incorrect in this context

because the requirement is to connect on-premises sites, not Azure virtual networks.

Connecting virtual networks is a separate step for integrating VNet spokes into the

hub.

•

Microsoft Azure Documentation: The tutorial "Create a Site-to-Site connection

using Azure Virtual WAN" outlines these steps in sequence.

o URL: https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-site-tosite-portal

o Specific Sections: The article's main body walks through the steps: "1.

Create a virtual WAN", "2. Create a hub", "3. Create a site", and "4. Connect

the VPN site to the hub". This directly corresponds to the required sequence.

1. Microsoft Azure Documentation | How network security groups filter network traffic:

"Security rules in a network security group are processed by priority. To determine the rule

to apply to the traffic, Azure processes the rules in priority order (from the lowest number to

the highest number)... Once traffic matches a rule, processing stops." This explains why a

new Allow rule with a lower priority number is needed to override the existing

DenyAllInBound rule.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-itworks

2. Microsoft Azure Documentation | Network security groups: "A network security group

contains security rules that allow or deny inbound network traffic to, or outbound network

traffic from, several types of Azure resources." This document confirms that the action must

be 'Allow' to permit traffic.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groupsoverview

•

Azure Official Documentation | Name resolution for resources in Azure

virtual networks: This document details the order of precedence for DNS

settings (NIC over VNet) and how name resolution works with custom DNS

servers. It explains that when a custom DNS server is specified, all queries

from VMs in that VNet are directed to that server.

o URL: https://docs.microsoft.com/en-us/azure/virtual-network/virtualnetworks-name-resolution-for-vms-and-role-instances

o Specific Section: "Name resolution using your own DNS server".

•

Azure Official Documentation | Azure Private DNS zones scenarios: This

resource explains that for a VNet with a custom DNS server to resolve

records in a linked private zone, the custom server must have a conditional

forwarder pointing to Azure's DNS resolver (168.63.129.16). Since this is not

configured for Server1, clients using it cannot resolve records from the private

zone.

o URL: https://docs.microsoft.com/en-us/azure/dns/private-dns-scenarios

o Specific Section: "VNet with a custom DNS server".

B. Add a gateway subnet to VNet1: A gateway subnet is only required for gateway transit,

an optional feature of VNet peering, not a prerequisite for establishing the peering

connection itself.

C. Create a subnet on VNet1 and VNet2: VNet peering is configured at the virtual network

level. The existence of subnets is not required to create the peering link between the two

VNets.

D. Configure a service endpoint on VNet2: Service endpoints provide secure connectivity to

Azure PaaS services and are unrelated to the process of peering two virtual networks

together.

Microsoft Azure Documentation - Virtual network peering - Constraints: "The virtual

networks you peer must have non-overlapping IP address spaces." This is the primary

constraint that must be met before peering can be created.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peeringoverview#constraints

Microsoft Azure Documentation - Create, change, or delete a virtual network peering: The

portal and CLI/PowerShell steps for creating a peering assume that the non-overlapping

address space requirement has already been met. If not, the operation will fail with an error.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-managepeering