Microsoft AZ-104 Exam Dumps, Practice Test Questions

A CNAME routes shop.example.com to the Azure app, and the scenario states it already resolves correctly. Recreating that same mapping does not publish the app-specific domain-verification token required by the security procedure. DNS resolution and evidence of ownership are distinct checks; leaving the asuid record absent preserves the reported validation gap.

The asuid TXT name is correct, but the value must match the Domain Verification ID shown for the App Service app being associated with this hostname. An ID taken from a different app does not prove authority to bind shop.example.com to this application, even if that other ID is otherwise valid. Use the current app’s token.

DNS TXT records are looked up by their complete owner name. A TXT record published at shop.example.com is not the same record as asuid.shop.example.com requested in this custom-domain validation flow. A correctly valued token at the wrong DNS owner name will not satisfy the stated missing-record check. Publish the token at the exact app-provided asuid location.

The ordinary app endpoint already has the required minimum TLS version. Reapplying minTlsVersion controls browsers and clients reaching the app hostname, not the independent SCM/Kudu deployment endpoint setting. The deployment endpoint can retain its own older configured minimum until scmMinTlsVersion is updated.

HTTPS Only redirects plain HTTP to HTTPS where applicable. It does not force the negotiated TLS protocol version to a specified minimum and cannot replace the independent SCM Minimum Inbound TLS Version setting. Enforcing modern encrypted protocols for the Kudu deployment site requires updating scmMinTlsVersion itself.

Each App Service deployment slot has its own minTlsVersion and scmMinTlsVersion settings. Raising a different slot’s SCM minimum does not automatically harden production SCM. Apply the setting to the exact production app or slot being audited, and verify deployment tooling can negotiate the required protocol.

Certificate validation still requires SAN or wildcard coverage of the second name; hostname-based SNI does not waive certificate name matching.

HTTPS Only redirects HTTP traffic but does not automatically establish a valid certificate and binding for each custom hostname.

IP binding may be valid in other designs, but it adds dedicated-address requirements the scenario explicitly seeks to avoid.

Apex CNAME use conflicts with common DNS zone requirements and may not be supported by the registrar. The stated limitation rules it out.

The TXT record confirms domain ownership for App Service, but it doesn't resolve the apex hostname to the app. The root domain still needs the documented public A record targeting the App Service IP address to direct browser traffic.

A wildcard CNAME covers eligible subdomains, not the zone apex itself. It cannot substitute for the apex A record and App Service TXT verification record that the scenario requires.

The free App Service-managed certificate feature does not issue wildcard certificates. Its normal automatic management for supported individual custom domains does not expand to an arbitrary *.example.com wildcard. The requirement is one certificate for changing first-level hosts, so the team needs a wildcard-capable private-certificate option with the required custom-domain mappings and bindings.

Free managed certificates are issued and bound to supported specific custom hostnames. Two such certificates do not become a single reusable wildcard certificate and do not automatically cover a future third hostname. Issuing certificates for fixed names can work for those names individually, but it fails the stated one-certificate, arbitrary-subdomain requirement.

An App Service public .cer upload is not a TLS server certificate with an available private key for custom-domain binding. HTTPS hosting requires a private certificate and matching key, typically uploaded or imported as a supported PFX source. A certificate whose subject includes *.example.com but has no usable private key does not satisfy the binding requirement.

MX records route email delivery rather than web HTTP requests. They will not provide the browser hostname mapping.

A TXT record may satisfy an App Service custom-domain ownership verification step, but it does not alias shop.example.com to the web app endpoint. The requested browser name still lacks the CNAME mapping needed for routing.

A TLS binding secures a hostname after it reaches the intended app; it does not make the hostname resolve to that app. Name resolution must be configured separately from the certificate for clients to reach the site.

SNI SSL and IP-based SSL change how the server selects or presents a certificate, not which hostnames the certificate cryptographically covers. A client connecting to v2.api.example.com still sees a wildcard for only *.example.com, which does not match that deeper host. The service needs a correctly named certificate rather than a different binding type.

A CNAME can direct v2.api.example.com traffic to the existing App Service application, but DNS resolution does not change the certificate SAN contents or browser hostname validation. The scenario explicitly says DNS mapping already works. Retaining the old one-level *.example.com wildcard leaves the deeper v2.api.example.com name unmatched and the TLS warning unresolved.

Including the bare example.com name in the SAN covers that apex only; it does not extend an existing *.example.com wildcard to deeper names. Wildcard label matching is not additive across the apex and a separate wildcard entry. v2.api.example.com must be named explicitly or matched by a wildcard scoped to *.api.example.com.

Minimum inbound TLS version governs protocol negotiation for HTTPS connections; it does not stop a client from using cleartext HTTP when that endpoint remains enabled. HTTPS Only is the separate App Service configuration that redirects HTTP to HTTPS.

Removing the binding disables proper HTTPS for the custom name. It cannot make HTTP requests encrypted or enforce a secure redirect.

A valid certificate binding allows encrypted HTTPS handshakes but does not itself force requests arriving over plain HTTP to redirect. The stem already says the binding is valid; App Service HTTPS Only is the separate application setting that enforces HTTPS redirection.

DNS hostname mapping sends clients to the app; it does not upload a renewed manually managed .pfx or change the certificate selected in the existing TLS binding.

Automatic renewal applies to the supported managed or imported certificate workflows, not an externally renewed manually uploaded private certificate. The updated certificate must be uploaded and its binding updated.

Deleting a binding before provisioning its replacement can cause HTTPS errors or an unwanted IP-based binding change. Upload the replacement first, update the custom-hostname binding, then retire the old certificate when safe.

A private endpoint for the web app is an inbound access solution. By itself it does not route application-originated requests toward a private backend database.

Inbound access restrictions control who calls the web app. They do not route calls originating from the app toward the database’s private address.

A public inbound rule changes access to the web frontend. The backend connection is outbound from App Service and still lacks a VNet route.

VNet integration enables outbound network access to resources on connected networks but does not independently create scheduled App Service backups.

A backup-over-VNet option affects transport for a configured backup workflow; it does not create periodic app-content recovery points. The operator still must configure supported scheduled backups and an authorized destination storage account.

Audit-only governance can report properties but does not produce App Service backup copies in the absence of the backup feature configuration.