Microsoft AZ-104 Practice Test - Questions Answers, Page 33

IP forwarding enables the virtual machine a network interface is attached to:

Receive network traffic not destined for one of the IP addresses assigned to any of the IP configurations assigned to the network interface.

Send network traffic with a different source IP address than the one assigned to one of a network interface's IP configurations.

The setting must be enabled for every network interface that is attached to the virtual machine that receives traffic that the virtual machine needs to forward. A virtual machine can forward traffic whether it has multiple network interfaces or a single network interface attached to it.

Box 1: Yes

The routing table allows connections from VM3 to VM1 and VM2. And as IP forwarding is enabled on

VM3, VM3 can connect to VM1.

Box 2: No

VM3, which has IP forwarding, must be turned on, in order for VM2 to connect to VM1.

Box 3: Yes

The routing table allows connections from VM1 and VM2 to VM3. IP forwarding on VM3 allows VM1 to connect to VM2 via VM3.

Reference:

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

https://www.quora.com/What-is-IP-forwarding

Box 1 : Set-AzureRmVirtualNetworkGatewayDefaultSite

The Set-AzureRmVirtualNetworkGatewayDefaultSite cmdlet assigns a forced tunneling default site to a virtual network gateway. Forced tunneling provides a way for you to redirect Internet-bound traffic from Azure virtual machines to your on-premises network; this enables you to inspect and audit traffic before releasing it. Forced tunneling is carried out by using a virtual private network (VPN) tunnel; this tunnel requires a default site, a local gateway where all the Azure Internet-bound traffic is redirected. Set-AzureRmVirtualNetworkGatewayDefaultSite provides a way to change the default site assigned to a gateway.

Box 2 : 0.0.0.0/0

Forced tunneling must be associated with a VNet that has a route-based VPN gateway. You need to set a "default site" among the cross-premises local sites connected to the virtual network. Also, the on-premises VPN device must be configured using 0.0.0.0/0 as traffic selectors.

Forced Tunneling:

The following diagram illustrates how forced tunneling works

Reference:

https://docs.microsoft.com/en-us/powershell/module/azurerm.network/setazurermvirtualnetworkgatewaydefaultsite?view=azurermps-6.13.0

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm

To create a new virtual machine named VM2 which is connected to VNET1 in RG1, you need to remove Microsoft.Network/virtualNetworks from the policy. This is because the Not allowed resource types Azure policy denies the deployment of the specified resource types in the scope of the assignment. In this case, the policy is assigned to RG1 and uses the parameters Microsoft.Network/virtualNetworks and Microsoft.Compute/virtualMachines. This means that you cannot create or update any virtual networks or virtual machines in RG1. Therefore, to create VM2 and connect it to VNET1, you need to remove Microsoft.Network/virtualNetworks from the policy parameters. This will allow you to create or update virtual networks in RG1, but still prevent you from creating or updating virtual machines. Alternatively, you can also exclude VNET1 from the policy assignment scope, but this will affect the compliance of the policy for the entire virtual network.

Not allowed resource types (Deny)

Create and manage policies to enforce compliance

Powershell command to create a load balancer rule (AzureRm module new version is AZ as given in below command):

$lbrule1v6 = New-AzLoadBalancerRuleConfig

-Name "HTTPv6"

-FrontendIpConfiguration $FEIPConfigv6

-BackendAddressPool $backendpoolipv6

-Probe $healthProbe

-Protocol Tcp

-FrontendPort 80

-BackendPort 8080

Powershell command to create the load balancer using the previously created objects :

New-AzLoadBalancer

-ResourceGroupName NRP-RG

-Name 'myNrpIPv6LB'

-Location 'West US'

-FrontendIpConfiguration $FEIPConfigv6

-InboundNatRule $inboundNATRule1v6

-BackendAddressPool $backendpoolipv6

-Probe $healthProbe

-LoadBalancingRule $lbrule1v6

Reference:

https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-ipv6-internet-ps

Modify the Name Server (NS) record.

A NS record would be created automatically and you cannot modify it (but you can add to it to support co-hosting domains). You can add additional name servers to this NS record set, to support co-hosting domains with more than one DNS provider. You can also modify the TTL and metadata for this record set. However, you cannot remove or modify the pre-populated Azure DNS name servers.

Reference:

https://docs.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns

Allow gateway transit: Check this box if you have a virtual network gateway attached to this virtual network and want to allow traffic from the peered virtual network to flow through the gateway.

The peered virtual network must have the Use remote gateways checkbox checked when setting up the peering from the other virtual network to this virtual network.

Reference:

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-managepeering#requirements-andconstraints

A PFX file contains the public key file (SSL Certificate) and its unique private key file. This is required for HTTPS access. The web app will distribute the public key (in a CER file) to clients that connect to the web app.

The CER file is an SSL Certificate which has the public key of the external service. The external service will have the private key associated with the public key contained in the CER file.

Conditional Access policies enforce registration, requiring unregistered users to complete registration at first sign-in, an important security consideration.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted

You need to change to Basic pricing Tier.

Note: The Free Tier provides 60 CPU minutes / day. This explains why App1 is stops. The Basic tier has no such cap.

Reference:

https://azure.microsoft.com/en-us/pricing/details/app-service/windows/