Microsoft AZ-104 Exam Dumps, Practice Test Questions

Allow gateway transit advertises gateway availability on each hub, but the consuming spoke can select only one remote-gateway peering. Two eligible hubs do not remove that limit.

The receiving VNet cannot consume a remote gateway and use its own gateway together under this peering pattern. Adding a local gateway makes the design invalid.

UDRs influence forwarding paths but cannot alter the Azure peering validation constraint that limits the spoke to one remote gateway association.

Microsoft Azure VNet peering supports networks in separate subscriptions and Microsoft Entra tenants when the required cross-tenant identities and resource permissions are established. A local-tenant Network Contributor role alone does not provide write access to the foreign-tenant VNet, so leaving permissions unchanged does not resolve the authorization failure. The directory boundary requires delegated access rather than a blanket peering prohibition.

Gateway transit determines whether a peered network can use a remote virtual network gateway; it does not authenticate an operator to another tenant or grant permission to create peering resource associations. Enabling a network transit option cannot overcome a Microsoft Entra tenant/RBAC authorization failure. Establish resource-level permissions on the target VNets instead.

Private DNS zone links control name resolution for clients in participating virtual networks. They neither create remote-tenant guest identities nor grant Microsoft.Network/virtualNetworks/virtualNetworkPeerings write permissions. Matching DNS configuration may help workloads after peering exists, but cannot authorize the administrator to change the remote VNet resource.

A hub-only set of peerings attaches each spoke to the hub; it does not inherently create a governed direct mesh between spoke pairs. Additional manual links or explicit transit architecture would still need maintenance as VNets are added. This approach fails the stated requirement for centrally managed, direct many-to-many connectivity.

A hub-and-spoke topology forwards eligible traffic via its hub and is not equivalent to direct many-to-many mesh connectivity. Choose a mesh connectivity configuration for the network group.

Security admin rules govern filtering but do not create direct VNet connectivity. The question needs topology-wide mesh connections in addition to appropriate security controls.

Tags can help organization and policy selection but do not supply RBAC permissions to create cross-subscription peerings.

VNet peering is configured against the participating virtual network resources. Rights on the initiating VNet do not automatically confer the remote VNet's Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write authorization; check both sides.

Allow forwarded traffic governs network packet transit after a peering exists; it does not confer ARM control-plane permissions to create peerings. The configuring identities need peering write authorization on the relevant VNets.

VNet peering provides private network connectivity directly over the Azure backbone without requiring VPN gateways on each side. Installing gateways wouldn't create the missing reciprocal peering configuration. It also adds unnecessary cost and security complexity when the existing request is a straightforward same-or-cross-region peering.

Azure resource permissions determine whether an operator can create the reciprocal peering, but granting every VM NIC subscription Owner doesn't supply the missing peering link. It would seriously overgrant privileges to compute resources while leaving the incomplete configuration untouched.

DNS TXT records convey name-domain metadata and don't modify Azure VNet peering resource state. The issue is an Initiated control-plane link with no reverse peer, not failure to resolve an application hostname. Establish the reciprocal peering in Azure Network settings.

The successful VM-to-VM private-IP test directly contradicts this claim. Global VNet peering supports routed private VM address communication between different Azure regions without public IPs on those VMs. A Basic Load Balancer frontend restriction does not imply that the remote backend VM's own private NIC address is unreachable.

Use remote gateways is a gateway-transit control for sharing a peer's VPN or ExpressRoute gateway, not a compatibility switch for an internal load balancer frontend. The stem says both VNets are already connected and private-IP backend tests succeed, so changing gateway settings wouldn't remove the documented Basic Load Balancer frontend limitation.

DNS lets clients translate application names into an IP address, but the test explicitly connects to an already known internal frontend IP. A public DNS zone isn't required for IP-based reachability to an internal load balancer. The unsupported Basic load-balancer frontend over global peering remains the cause even if a hostname resolves correctly.

That peering flag permits forwarded traffic where relevant but cannot by itself redirect packets to the hub firewall. Without a matching route the subnet still follows another selected next hop.

NSG rules determine whether packets may pass, not which hop carries them. An allowed packet can still bypass the NVA if the route table directs it elsewhere.

Public IP association changes ingress/egress addressing but cannot enforce the selected inter-VNet inspection path. It may add exposure while avoiding the intended centralized firewall.

Sync can update certain peering configuration state, but it does not recreate a peering resource deleted on the opposite VNet. The stale Disconnected link must be removed and the reciprocal peering pair established again.

Use remote gateways is for gateway transit across a valid peering where appropriate hub and spoke gateway configuration exists. It does not repair a Disconnected relationship, and this scenario has no VPN gateway to share. Changing gateway flags would introduce an irrelevant routing configuration.

A UDR cannot repair a missing reciprocal peering object or force a Disconnected VNet link to become Connected. Restore both peering resources first.

A route may change the next hop but cannot override an effective NSG deny on the matching packets. First inspect the relevant source/destination NSG direction and priority, then adjust filtering if required.

The peering forwarded-traffic option does not override NSG security rules on VM subnets. Since B-to-A packets already reach a matching Deny, inspect rule direction, priority and applicable path rules instead of changing the transport.

ExpressRoute connects private networks through a service-provider circuit and does not automatically override a subnet NSG deny. The stated cause remains a security rule.

Peering resource names are not consulted as implicit Private DNS zone links. Renaming or recreating a peering without DNS configuration leaves the lookup failure.

VNet peering supplies private IP connectivity, not automatic Private DNS zone linking for each peer. The second VNet must be linked to the zone or use deliberately configured DNS forwarding to resolve its private names.

Service endpoints target supported Azure platform services for network access restrictions. They are not the mechanism for linking a Private DNS zone to a VNet.

Azure Virtual Network encryption can protect traffic at a lower network layer where supported, but it doesn't identify the client and server to each other using the workload's own TLS certificates. The requirement is specifically end-to-end application mutual authentication, so lower-layer encryption alone cannot satisfy the trust-policy and certificate-handshake controls.

ExpressRoute private peering supplies a private network connection through a connectivity provider. It is not a replacement for an application mTLS handshake and does not automatically validate service identities or application certificates. This would also introduce new circuit infrastructure unrelated to the specific connected global VNet peering route already available.

TLS operates over TCP/IP independently of whether the IP addresses are public or private. Adding public frontends is not necessary for mTLS and may increase exposure. The right design configures application certificates, server authentication, and client authentication directly on the communicating services using the existing private route.