Microsoft AZ-104 Exam Dumps, Practice Test Questions

Traffic filtering does not override delegation-specific subnet eligibility. An unsupported resource deployment can fail even if a network security group would isolate it.

Routes influence packet forwarding, not which Azure resource types a delegation permits. Clearing routes would not establish general-purpose eligibility and could harm connectivity.

Whether a VM has a public IP does not change the delegated subnet's resource-type restrictions. Azure validates subnet placement independently of public reachability.

Routing resources do not own the endpoint's NIC. Replacing routing associations would not free the private endpoint IP that blocks subnet removal.

An NSG may be associated but removing it does not destroy the private endpoint NIC. The occupying resource still prevents subnet deletion regardless of filtering configuration.

Zone groups manage DNS record integration, not allocation of the endpoint's private IP and NIC. Removing DNS associations leaves the subnet dependency in place.

Azure Private DNS permits a VNet to resolve records from multiple linked private DNS zones, but only one linked zone can be the automatic VM-registration zone for a particular VNet. Different suffix names do not make two registration-enabled links valid for that same network. The attempted second registration link fails even though records in the new zone could be resolved with a normal resolution-only link.

Switching the single permitted registration zone to apps.corp.internal would allow that zone to register VM names, but it removes the automatic VM record maintenance required for the existing corp.internal zone. The scenario requires both ongoing corp.internal auto-registration and the second zone’s manual-record resolution, so this changes the wrong link configuration.

The limit is per virtual network, not per link-resource name. Creating a differently named link for the same VNet does not create a second automatic registration zone. The appropriate second relationship is resolution-only; Azure will answer its linked zone records without having to duplicate VM registration.

IPv4 and IPv6 are separate protocol address spaces. Provisioning an IPv6 prefix does not extend the subnet's IPv4 CIDR range for an IPv4-only application.

Additional NIC IP configurations consume addresses from the same fixed IPv4 subnet pool; they do not create new usable addresses. For IPv4-only capacity, allocate an appropriately sized IPv4 prefix or subnet.

A /27 provides fewer IPv4 addresses than a /24 because the prefix reserves more address bits for the network. Increasing the numerical CIDR prefix length would shrink, not expand, the usable IPv4 pool; IPv6 cannot compensate for an IPv4-only workload.

A directly peered VNet receives routes to the peered hub itself, but peering does not act as a transitive router for the second spoke. B remains unreachable through this assumption.

An NSG can permit traffic if a route exists, but it cannot create the absent spoke-to-spoke forwarding path. Routing and security are separate.

DNS can resolve a workload hostname to an address, but the resolved address still needs a valid route. Nontransitive peering remains the obstacle.

The forwarded-traffic flag affects permitted forwarding in peering, but does not by itself make the spoke use the hub’s VPN gateway or learn its remote routes.

A direct internet default route does not establish a private tunnel to the branch-office address space. The remote VPN gateway relationship is still missing.

Gateway transit is offered by the hub containing the gateway; the spoke must be configured to use that remote gateway. A one-sided reversed setting is insufficient.

Gateway transit is intended to let a peered network use another network's VPN or ExpressRoute gateway. The stem instead identifies a network virtual appliance that forwards third-party packets between spokes. Turning on gateway sharing isn't the missing forwarding permission and doesn't make those NVA-relayed packets acceptable across the peering boundary.

Allow virtual network access supports communication between addresses in directly peered VNets. The traffic here originates in one spoke and is forwarded by an intermediate appliance, so a separate forwarded-traffic permission is relevant. Basic direct-peer access alone does not authorize the relayed packets in this topology.

Network security groups filter packets at subnet or interface enforcement points. Even an explicit allow rule can't replace peering's separate forwarded-traffic permission. The NVA can still receive or forward locally while Azure refuses the transmitted traffic at the peering boundary, so routing and peering flags must be checked too.

Private endpoints give clients private connectivity to a particular Private Link-capable service. Creating them in both VNets doesn't establish general IP routing between two independent VM subnets. It could be appropriate for Azure Storage or a supported private application service, but the scenario asks for network-to-network private addresses for general workloads.

A VNet-to-VNet VPN can connect two Azure networks using gateway endpoints and an IPsec tunnel. It is a feasible different architecture, but it explicitly requires VPN gateway infrastructure that the question forbids. Global peering reaches the desired private-address connectivity without installing or operating those gateways.

A public load balancer distributes client traffic to public service frontends, rather than joining private VNet address spaces. Applications may be reachable through public IPs with added authentication and filtering, but the question specifically excludes Internet-facing gateways and requires private-IP communication over Azure's backbone.

Gateway transit affects remote gateway use and does not replace basic virtual network access between peered prefixes.

A custom route cannot authorize a peering flow that its own virtual network access setting disallows.

Forwarded-traffic permission addresses transit through network virtual appliances, not the basic VNet-to-VNet access control currently disabled.

Gateway transit requires paired configuration and eligibility. Turning on a partial flag cannot make a spoke that already has its own gateway consume another gateway.

Peering supports the hub gateway transit pattern through paired settings. It is valid when prerequisites are satisfied.

The paired flags would be reversed, and the spoke still has a local gateway. Correct flag direction alone does not resolve the local-gateway restriction.

Allow gateway transit advertises gateway availability on each hub, but the consuming spoke can select only one remote-gateway peering. Two eligible hubs do not remove that limit.

The receiving VNet cannot consume a remote gateway and use its own gateway together under this peering pattern. Adding a local gateway makes the design invalid.

UDRs influence forwarding paths but cannot alter the Azure peering validation constraint that limits the spoke to one remote gateway association.