Microsoft AZ-104 Exam Dumps, Practice Test Questions

VNet integration enables outbound network access to resources on connected networks but does not independently create scheduled App Service backups.

A backup-over-VNet option affects transport for a configured backup workflow; it does not create periodic app-content recovery points. The operator still must configure supported scheduled backups and an authorized destination storage account.

Audit-only governance can report properties but does not produce App Service backup copies in the absence of the backup feature configuration.

An inbound private endpoint changes how clients reach the web app privately; it does not route the app’s outgoing payment-provider calls through NAT Gateway.

A private DNS record cannot force outbound traffic through the NAT device, and overriding a public API address can break service resolution.

Routing Internet egress through the VNet is necessary, but it does not by itself assign the one stable NAT Gateway public IP requested by the payment processor. The integration subnet must also have a NAT Gateway with the chosen public address; otherwise the observed Internet SNAT path can differ from the approved allowlist address.

VNet integration is for outbound access from the application. It does not automatically supply an inbound private IP for corporate clients.

App Service access restrictions can filter allowed inbound callers, but an allow rule does not give the multitenant app a private IP address in the VNet. Permitted clients would still reach its public front end. The requirement is private-address inbound access combined with controlled shutdown of the public path; an App Service private endpoint, with appropriate DNS and access configuration, provides that path.

A DNS record pointing to the existing public front-end address does not provision a private endpoint or a VNet-local IP. Once public network access is disabled, a renamed public destination also fails the private-access requirement. Configure the real App Service private endpoint and direct private DNS resolution to its assigned private address.

App Service VNet integration is an outbound path; an inbound rule on the integration subnet does not clear the explicit outbound NSG denial to the SQL private endpoint.

Route All affects which egress traffic traverses the integration VNet; it cannot bypass an NSG deny on that path. With DNS already resolving privately, the effective outbound subnet NSG rule must permit the required SQL endpoint and port.

An app private endpoint affects how clients reach the web app; it does not authorize the app to initiate SQL connections through a denied outbound subnet rule.

Authentication identifies users, while access restrictions are the supported source-network filter for this requirement.

VNet integration primarily affects outbound traffic from the app and does not itself restrict which public clients may access the inbound endpoint.

TLS policy restricts protocol versions, not which caller IPs can send requests to the app's public ingress.

Broad RBAC rights do not create an allowed network route through the storage firewall. Backup connectivity must be configured for the protected endpoint.

Public anonymous access would weaken backup confidentiality and does not configure the required supported VNet backup route.

Regional VNet integration alone does not necessarily route custom App Service backup/restore traffic over the integrated VNet. With a firewall-protected destination, enable the supported Backup/restore-over-VNet option as well.

A /25 has 128 addresses before Azure reserves five, leaving only 123 usable. It cannot support 240 allocated addresses.

A /26 offers 64 total addresses and only 59 usable after Azure reservations. Its small address range would exhaust far below the application target.

A /27 contains just 32 total addresses and 27 usable. It is intended for much smaller subnets and cannot meet the required instance count.

Gateway transit allows a peered VNet to use a virtual network gateway in another VNet when prerequisites are met. It does not translate overlapping CIDR prefixes or waive the peering address-space rule. The conflicting 10.50.20.0/24 range remains nested within 10.50.0.0/16 and requires a nonoverlapping network plan.

Use remote gateways controls access to a remote VNet gateway, not automatic network address translation. It cannot convert the overlapping 10.50.0.0/16 and 10.50.20.0/24 spaces into unique peering routes. Selecting this property does not remove the need to renumber one VNet before establishing ordinary peering.

The Allow forwarded traffic peering setting controls whether traffic forwarded by an appliance can traverse a peering connection. It does not make overlapping virtual-network prefixes routable or satisfy the nonoverlapping address-space prerequisite. The /24 is contained in the other VNet’s /16, so one VNet must be renumbered before ordinary peering can be established.

NICs on a subnet require distinct private IP allocations for normal routing. Duplicating one address creates conflicts rather than additional capacity.

Secondary NIC IP configurations consume additional private addresses; they do not increase the number available in the subnet. An Azure /29 has eight total addresses with five reserved by the platform, leaving only three usable. Eight VMs each needing at least one address require a larger subnet, not more IP configurations on the same insufficient prefix.

The network address is part of Azure’s reserved set and cannot be allocated to the first VM. It does not increase usable capacity.

Peering cannot make two overlapping subnets within a single VNet valid; overlap is a subnet-addressing conflict, not a peering setting.

NSGs filter packets after an address range is validly assigned; they cannot permit overlapping CIDR subnet definitions in one VNet.

Subnet delegation affects hosted Azure service integration and does not change the IP containment relationship between the two prefixes.

NIC recreation does not update the remote peering’s advertised address prefixes. The new VMs already communicate within the hub, so the failure is not their local NIC allocation.

Allow forwarded traffic controls transit of packets forwarded through appliances across peering. It does not refresh the peering configuration’s stale address-space list, which is the observable problem in this case.

Overlapping address spaces prevent valid subnet design and can break peering. Deleting the valid new nonoverlapping range avoids the symptom rather than updating the remote routing information needed by the spoke.