AZ-104 practice question 7 of 35

You need to ensure that VM1 can communicate with VM4. The solution must minimize administrative effort. What should you do?

Choose your answer, then check it against the explanation and the full breakdown below.

Domain Implement and manage virtual networking

You need to ensure that VM1 can communicate with VM4. The solution must minimize administrative effort. What should you do?

Answer options

Correct Answer:

D

Explanation

Virtual network (VNet) peering is the most direct and administratively simple method to

enable communication between virtual machines located in separate virtual networks. Once

VNet peering is established between VNET1 and VNET3, trafﬁc can ﬂow between them

over the Microsoft backbone network as if they were in the same VNet. This solution directly

addresses the connectivity requirement with minimal conﬁguration steps and no need for

gateways or complex routing tables, thus minimizing administrative effort.

Why Incorrect

A. Create a user-deﬁned route from VNET1 to VNET3: User-deﬁned routes (UDRs) are for

overriding default routing, typically to force trafﬁc through a network virtual appliance (NVA)

or gateway, not for establishing the initial connectivity path between VNets.

B. Create an NSG and associate the NSG to VM1 and VM4: Network Security Groups

(NSGs) act as a ﬁrewall to ﬁlter trafﬁc. They can permit or deny communication but do not

create the network connectivity path between different VNets.

C. Assign VM4 an IP address of 10.0.1.5/24: This would require moving VM4 to VNET1,

which involves signiﬁcant administrative effort (e.g., creating a new NIC, potentially

recreating the VM) and is a disruptive change.

References

Azure virtual network peering: Microsoft Learn. (2024). Azure virtual network peering.

"Azure virtual network peering enables you to seamlessly connect two or more Virtual

Networks in Azure... The trafﬁc between virtual machines in peered virtual networks uses

the Microsoft backbone infrastructure." https://learn.microsoft.com/en-us/azure/virtualnetwork/virtual-network-peering-overview

Virtual network trafﬁc routing (UDRs): Microsoft Learn. (2024). Virtual network trafﬁc routing.

"Azure creates a route table with system routes... You can create custom routes to override

Azure's default routes." https://learn.microsoft.com/en-us/azure/virtual-network/virtualnetworks-udr-overview

Network security groups: Microsoft Learn. (2024). Network security groups. "A network

security group contains security rules that allow or deny inbound network trafﬁc to, or

outbound network trafﬁc from, several types of Azure resources."

https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

Topic: 16

Question 7 of 35

Question breakdown

Tests: Configure and manage virtual network peering
Difficulty: Easy

Key idea: VMs in different Azure VNets cannot communicate by default, and VNet peering is the lowest-effort way to connect two non-overlapping VNets.

How to reach the answer

VM1 is in VNET1 and VM4 is in VNET3; separate VNets have no connectivity by default.
NSGs only filter traffic and UDRs only steer traffic along paths that already exist; neither creates a path between VNets.
Re-addressing VM4 into VNET1's range means moving the VM, which is disruptive and high effort.
Clue: 'minimize administrative effort' points to peering, assuming the address spaces do not overlap.

Each option

AIncorrect. A UDR cannot create connectivity between unconnected VNets; it only overrides next-hop routing.
BIncorrect. NSGs allow or deny traffic but do not provide a network path between separate VNets.
CIncorrect. Giving VM4 an address in VNET1's range would mean moving it to that VNet, which is a disruptive, high-effort change.
DCorrect. Peering VNET1 and VNET3 gives private connectivity over the Microsoft backbone with minimal configuration.

Common trap: A UDR looks like a routing fix, but custom routes cannot reach a VNet that has no peering or gateway connection.

In practice: Peering is the standard way to link workload VNets, often in hub-and-spoke designs. Planning non-overlapping address spaces up front avoids blockers later.

Remember: To connect VMs in different non-overlapping VNets with the least effort, peer the VNets.

Official documentation: Virtual network peering

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free AZ-104 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other AZ-104 practice questions