Microsoft AZ-104 Exam Dumps, Practice Test Questions

Slots can have their own accessible endpoints. Requiring production traffic for testing would defeat the isolation of a preproduction slot.

A production-host CNAME routes users to the production app, not automatically to the isolated staging slot's code. QA should use the staging slot's own endpoint or an explicitly configured custom staging-slot hostname before any swap.

App Service abstracts the worker infrastructure; VM naming is not how slot endpoints are addressed. The slot hostname remains the correct target.

App Service authentication controls who can authenticate but does not itself satisfy the stated network-source restriction. Even with identity enforcement, other public IPs can reach the staging endpoint; slot-specific access restrictions are required for IP allowlisting.

A sticky setting affects swap behavior of configuration values, not which external client IPs can send requests to staging. It is the wrong security layer.

Azure RBAC management access does not restrict anonymous HTTP requests to a public staging endpoint. It also gives testers excessive platform control.

A DNS change would tend to move an uncontrolled portion or eventually all clients rather than enforce an App Service percentage split through slot routing.

Autoscale changes the number of worker instances available to an App Service plan or app; it is not a request-distribution rule between deployment slots. Even if CPU-driven autoscale triggers, it does not establish a 5% staging canary. The app’s deployment-slot Traffic % configuration is the control for a production-to-staging allocation.

A swap exchanges which app content serves the production slot; it does not inherently implement a 5% controlled canary allocation.

Stopping the shared App Service plan affects the compute supporting production and staging; it is not a per-slot control of background processing. The requirement is specifically to keep production processing while preventing staging from running its own WebJobs.

Auto swap is a promotion mechanism, not isolation for background worker execution. Publishing a WebJob to a slot does not imply Azure automatically suppresses that job until promotion; duplicate work can occur unless a slot-specific guard is configured.

A queue network ACL that blocks all Azure sources would also block the intended production WebJob. The scenario needs to suspend staging WebJobs only, not alter the queue to reject both production and staging activity.

Preview is a validation opportunity, not proof that dependencies work. Completing a known-broken deployment would expose production traffic to the problem.

Auto Swap automates promotion; it does not resolve a failed dependency discovered during the paused preview or protect production from that dependency. The controlled recovery is to cancel the current preview, repair staging configuration, validate it, and then deliberately retry.

Rollback is a possible incident recovery action but it exposes production to the already known failing dependency during the swap. Canceling preview prevents that unsafe promotion and preserves the current production configuration while the team corrects the source slot.

A slot swap moves the app content/configuration according to swap rules after both slots have been prepared; it is not the mechanism that initially publishes the planned release into staging. Swapping an empty or untested slot into production creates unnecessary release risk. The team should first deploy the candidate code into the new staging slot and test it before any promotion.

A new deployment slot can clone supported configuration values, but copying app code is not an asynchronous plan-scaling or warm-up operation. Waiting will not deploy the intended new build. The staging slot needs its own content deployment, which can use the same supported methods as a regular App Service app.

Standard supports deployment slots, and moving to Premium does not change the separation between configuration cloning and application content deployment. Hosting tier controls eligibility and some limits, not the automatic copying of code files as part of the Clone configuration operation. The proper fix is to deploy the intended build to the new slot.

Custom hostnames and TLS certificate bindings are slot-scoped platform properties, not ordinary sticky application-setting values that can be marked to swap. The pipeline must verify bindings on each intended slot rather than assuming the code swap moves them.

RBAC permissions do not make a custom hostname travel with a slot's code. Domain bindings must be configured and maintained explicitly.

Slots deliberately keep some settings and resources attached to their original slot. Blindly treating the entire app resource as swapped can cause access or certificate confusion.

A hostname change does not make the swap verify dependency readiness. The platform would still probe the default root path and could promote an instance whose required service is unavailable.

App Service slot warm-up uses application-level HTTP responses, not an NSG priority bypass mechanism. Skipping a readiness check would undermine the requirement to stop an unsafe promotion.

The general app-start warm-up path is not the same control as the specific swap warm-up ping path and status restrictions. The team must configure the swap-specific settings to enforce its readiness criterion.

HTTPS Only redirects or requires TLS, but does not supply a valid certificate matching portal.example.org. Clients would still fail trusted-hostname validation.

DNS resolves the name but cannot make the site present a trusted certificate for that hostname. The missing step remains the App Service TLS binding.

A certificate uploaded elsewhere is not the certificate served by this hostname. The target app requires a suitable binding for the custom name.

Scaling workers does not change the certificate subject alternative names that a browser validates. Additional capacity cannot correct a hostname identity mismatch.

DNS only determines where a hostname connects. Repeating the address mapping does not make the presented certificate valid for a hostname missing from its name coverage.

Diagnostics affect telemetry collection, not TLS certificate identity validation. Disabling them would remove useful incident evidence while leaving the mismatch unchanged.

A CNAME routes shop.example.com to the Azure app, and the scenario states it already resolves correctly. Recreating that same mapping does not publish the app-specific domain-verification token required by the security procedure. DNS resolution and evidence of ownership are distinct checks; leaving the asuid record absent preserves the reported validation gap.

The asuid TXT name is correct, but the value must match the Domain Verification ID shown for the App Service app being associated with this hostname. An ID taken from a different app does not prove authority to bind shop.example.com to this application, even if that other ID is otherwise valid. Use the current app’s token.

DNS TXT records are looked up by their complete owner name. A TXT record published at shop.example.com is not the same record as asuid.shop.example.com requested in this custom-domain validation flow. A correctly valued token at the wrong DNS owner name will not satisfy the stated missing-record check. Publish the token at the exact app-provided asuid location.