Microsoft AZ-104 Exam Dumps, Practice Test Questions

Actual cost reflects what was billed when the commitment was purchased or charged. It does not tell the analyst how many eligible VM usage hours benefited from the reservation each day. The reservation can be fully paid but underutilized when matching workloads are stopped. Use its utilization report to separate purchased capacity from realized coverage.

Amortized cost distributes reservation charges over the commitment term and resource usage for cost analysis, but it is not by itself the reservation’s utilization-percentage time series. It can reveal unused reservation cost and is valuable for allocation or chargeback. The question asks directly for historical utilization rate and potential stranded capacity, so the reservation usage detail is the more direct tool.

Purchasing additional capacity without measuring consumption could worsen the underutilization already suspected. Reservation coverage depends on eligible running resources and matching reservation attributes; deallocated or mismatched VMs can leave capacity idle. Check the utilization history and applicable usage first, then decide whether an eligible reservation change is economically justified.

For the described service-endpoint network-rule path, merely listing the subnet without its service endpoint does not establish the expected subnet identity that Storage uses for that rule.

A service endpoint is service-specific. Enabling the SQL endpoint would not configure the subnet for the Azure Storage Blob firewall path described.

Private Link requires a target storage service subresource and a dedicated private endpoint configuration. A generic VM NIC setting does not implement a subnet service endpoint.

An IP allow entry does not restrict other public sources if the storage account firewall default action is Allow. The requirement is to keep other source IPs denied, so preserve the account default Deny and explicitly allow only the office service public IPv4.

Data-plane role assignments govern authenticated Blob operations, not whether a source passes the storage account network firewall. A Contributor identity arriving from an unlisted public IP is still blocked when default Deny applies. Add the approved public source IP network rule separately.

The office firewall allowing outbound traffic does not make the Azure Storage account accept an otherwise unlisted public client IPv4. Both network paths may need permission, but the stated missing control is the Storage firewall rule while its default action remains Deny.

A DNS suffix or the name of a subnet is not a supported Storage firewall network identity for authorizing Azure VNet traffic. IP allowlist rules match public client IPv4 addresses, whereas a VNet rule references the subnet resource ID and its service endpoint. The proposed DNS suffix would neither appear as a valid IP range nor authorize traffic from tenant B's subnet.

Blob Data Contributor grants scoped data-plane access to an authenticated identity, but Storage enforces its network firewall independently before permitting a request. The tenant B subnet is missing a virtual-network allow rule, so a role assignment alone cannot bypass default Deny. The administrator must authorize the subnet resource through the supported cross-tenant CLI/PowerShell network-rule workflow.

Making the entire storage public endpoint reachable from all networks is unnecessary and violates the restrictive firewall requirement. It also does not change the fact that the portal selector cannot enumerate subnets in another Entra tenant. Keep default Deny, use an authorized fully qualified subnet ID with CLI/PowerShell, and admit only that selected VNet source.

With public network access disabled, public IP allow entries are not an active path for clients. Expanding the list cannot override that top-level network boundary.

Azure service endpoints are enabled for supported Azure VNet subnets, not arbitrary office Internet source addresses. The current public endpoint remains disabled.

A SAS may authorize a request after network admission, but it cannot enable a storage public endpoint explicitly configured as Disabled.

A storage virtual-network rule is not a persistent string match against the subnet name and address prefix. Microsoft documents that deleting an allowed subnet removes its rule and recreating a same-named subnet does not grant automatic access. Relying on the original rule therefore leaves the replacement network unapproved despite the restored name, CIDR and service endpoint.

Regenerating account access keys affects Shared Key authentication and SAS signatures signed with those keys, not the storage firewall's missing subnet network rule. It could interrupt unrelated clients without making the recreated subnet an authorized origin. The stem already says data-plane RBAC is unchanged, so repair the virtual-network allow rule rather than rotate credentials for an unrelated network admission failure.

Owner is a broad Azure management permission, not a valid bypass for a storage account firewall in default Deny mode. Elevated control-plane rights do not recreate the deleted subnet's network rule, and granting them would unnecessarily expand privilege. The correct recovery is to add the replacement subnet's resource ID explicitly while maintaining the existing identity permissions.

The CIDR length does not convert RFC1918 10.1.2.3 into a valid public IP network source rule for Azure Storage. Public IP firewall allowlists and VNet/private endpoint rules are separate mechanisms; private Azure subnet clients should use an appropriate supported network admission path.

A SAS supplies data-access authorization, not a public firewall exception. Even a correctly scoped SAS does not transform the VM’s private address into a supported Storage public IP allowlist entry or bypass disabled network access; the network rule must be designed separately.

Private address ranges are not universally trusted by a restricted storage account. Source network configuration still matters.

An extra allow rule may admit a client but does not deny unrelated public clients while the firewall's default remains Allow. A true allowlist needs an explicit default Deny with the intended subnet rule.

A service endpoint changes the subnet's path and identity to Storage, but does not by itself change a storage account's default public-access decision. The account would continue admitting other networks under Allow.

Private Link offers an additional private path, yet it does not automatically deny unapproved traffic on the storage account's public endpoint. The public firewall default still requires the intended Deny rule.

The trusted-services exception applies to specified service scenarios, not to every ordinary VM client in the region. Use the Storage service endpoint and a network rule for the actual source subnet when same-region VM traffic must be allowlisted.

A broader public CIDR is both overpermissive and does not solve the same-region Azure-source behavior that makes public IP rules unreliable for this VM traffic path. The case supplies a customer VNet, so the appropriate service-endpoint subnet and account VNet rule directly establish network admission.

Storage account public IP allowlists cannot identify a private VNet address as an Internet source. The public endpoint route will not present that address as a supported IP rule match.

VNet rules take Azure subnet identities, not arbitrary partner IPv6 literals. A public external address cannot be repurposed as a subnet reference.

The trusted-services bypass is limited to supported Azure service scenarios, not arbitrary partner offices reaching the public storage endpoint. It does not add IPv6 support to Storage IP network rules. The partner still needs a supported IPv4 egress address or a permitted private connectivity route.

Publishing or resolving an AAAA record cannot change Storage firewall IP rule validation: those rules accept supported public IPv4 addresses only. Name resolution and source-address authorization are separate controls, so the IPv6-only partner remains outside the permitted IP rule without an IPv4 egress or private access design.

That exception may authorize a broader set of eligible services than the one named resource instance. It does not meet the request for a narrow, resource-specific network allowance.

A permissive default would remove the account's intended network isolation. The design explicitly requires a narrow exception under an otherwise restrictive firewall.

Owner can authorize management operations but cannot replace a network rule permitting packets to the storage endpoint. Both layers must be satisfied.