Microsoft Updated AZ-104 Exam Questions and Answers by ignacy

You can filter network traffic to and from Azure resources in an Azure virtual network with a network security group. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources.

You can use a site-to-site VPN to connect your on-premises network to an Azure virtual network. Users on your on-premises network connect by using the RDP or SSH protocol over the site-to-site VPN connection. You don ' t have to allow direct RDP or SSH access over the internet. And this can be achieved by configuring a deny rule in a network security group (NSG) that is linked to Subnet1 for RDP / SSH protocol coming from internet.

Modify the address space of Subnet1 : Incorrect choice

Modifying the address space of Subnet1 will have no impact on RDP traffic flow to the virtual network.

Modify the address space of the local network gateway : Incorrect choice

Modifying the address space of the local network gateway will have no impact on RDP traffic flow to the virtual network.

Remove the public IP addresses from the virtual machines : Incorrect choice

If you remove the public IP addresses from the virtual machines, none of the applications be accessible publicly by the Internet users.

This question tests your understanding of Azure RBAC (Role-Based Access Control) and the principle of least privilege when delegating permissions to manage specific load balancers.

???? Scenario Summary

You have:

Resource group: RG1

Two Load Balancers:

LB1 (Internal)

LB2 (Public)

You must allow Admin1 to manage configuration tasks on both load balancers individually:

Add a backend pool to LB1

Add a health probe to LB2

The goal is to assign the minimal required permissions (least privilege) needed for each operation.

???? Understanding the Role Requirements

1️⃣ Adding a Backend Pool to a Load Balancer

To add or modify a backend pool, you need permissions to:

Update the load balancer’s configuration

Modify the associated NIC or VM backend association

The Network Contributor role includes these permissions.

Microsoft Learn – Network Contributor role permissions:

“Grants full access to manage network resources, including virtual networks, load balancers, network interfaces, and public IP addresses. Does not grant access to manage virtual machines or storage accounts.”

This means Network Contributor on LB1 (the load balancer resource itself) is sufficient to:

Add or remove backend pools

Configure load-balancing rules

Update frontend or backend associations

✅ Correct Role: Network Contributor on LB1

No need for Contributor or Owner at the resource group level because that would grant more privileges than necessary (violates least privilege principle).

2️⃣ Adding a Health Probe to a Load Balancer

A health probe is a property of the load balancer resource itself.

To add or modify a health probe, you only need permissions to update the Load Balancer configuration.

Again, the Network Contributor role includes the required permissions to create or modify health probes.

✅ Correct Role: Network Contributor on LB2

No additional access to RG1 or global resources is required.

???? Why Not Other Roles?

Role

Description

Too much / Too little

Contributor on RG1

Full access to all resources in the group

❌ Too broad

Owner on LB1/LB2

Includes delete and permission management rights

❌ Overprivileged

Network Contributor on RG1

Manage all network resources in RG1

❌ Broader than needed

Network Contributor on LB1/LB2

Manage only the specified load balancer

✅ Least privilege, correct

✅ Final Verified Answers

Task

Role Assignment

To add a backend pool to LB1

✅ Network Contributor on LB1

To add a health probe to LB2

✅ Network Contributor on LB2

Microsoft Official Documentation Extracts (Azure RBAC & Load Balancer):

“The Network Contributor role can manage network resources but not grant access to others.”

“To configure backend pools, health probes, and load balancing rules, assign the Network Contributor role on the load balancer resource itself.”

“Follow the principle of least privilege by assigning resource-level roles instead of group- or subscription-level roles.”

✅ Final Verified Answer Summary:

Backend pool (LB1): Network Contributor on LB1

Health probe (LB2): Network Contributor on LB2

In Azure Virtual Networks (VNets), each subnet defines a range of IP addresses using CIDR (Classless Inter-Domain Routing) notation. The subnet mask determines how many IP addresses are available, but Azure reserves five addresses in every subnet for its internal operations.

Given the subnet range 172.16.10.0/25, the total number of IP addresses in the subnet can be calculated as follows:

A /25 subnet provides 128 IP addresses (2^(32-25) = 128).

Azure automatically reserves five IP addresses in each subnet:

The first address (172.16.10.0) is the network identifier.

The second through fourth addresses are reserved by Azure for default gateway and internal operations.

The last address (172.16.10.127) is the broadcast address.

That leaves 128 - 5 = 123 usable IP addresses for Azure virtual machines and other resources such as NICs, load balancers, or network interfaces.

This calculation and reservation rule are explicitly documented in the Microsoft Azure Virtual Network subnet documentation. Therefore, the maximum number of virtual machines (each using a single private IP address) that can connect to the subnet is 123.