Microsoft AZ-104 Exam Dumps, Practice Test Questions

Azure Virtual Network encryption can protect traffic at a lower network layer where supported, but it doesn't identify the client and server to each other using the workload's own TLS certificates. The requirement is specifically end-to-end application mutual authentication, so lower-layer encryption alone cannot satisfy the trust-policy and certificate-handshake controls.

ExpressRoute private peering supplies a private network connection through a connectivity provider. It is not a replacement for an application mTLS handshake and does not automatically validate service identities or application certificates. This would also introduce new circuit infrastructure unrelated to the specific connected global VNet peering route already available.

TLS operates over TCP/IP independently of whether the IP addresses are public or private. Adding public frontends is not necessary for mTLS and may increase exposure. The right design configures application certificates, server authentication, and client authentication directly on the communicating services using the existing private route.

Resynchronizing already-existing peerings is a separate response to later VNet address-space edits. Here the desired managed connectivity was never deployed, so there are no resulting network-manager-managed connections to resynchronize.

Network-group membership identifies intended VNets, but it does not commit a saved mesh configuration to the target regions. Use Azure Virtual Network Manager's deploy action for those regions so connectivity is actually provisioned.

Managed mesh connectivity is not achieved by replacing the group with public addresses. The requirement is private managed VNet connectivity; deleting the group destroys the configuration target and does not supply the regional deployment action.

IP forwarding permits a correctly configured appliance to relay packets, but it does not install spoke route tables or make separate VNet peerings transitive. A complete forwarding/NVA design needs deliberate UDRs and supported peering settings.

Gateway transit shares a supported virtual network gateway; it does not by itself provide arbitrary spoke-to-spoke packet forwarding through a security appliance. The hub requires an explicit transit design and forwarding route configuration.

The hub does not automatically relay packets between spokes. Without intentional transit, each peering only connects the directly paired VNet address spaces.

A dynamic public IP can be released after stopping/deallocating the VM and should not be trusted for a durable partner allowlist.

RFC1918 private addresses do not provide a public internet-reachable endpoint without an additional public-facing connection mechanism.

An Azure public IP is assigned from a managed regional pool, not simply an arbitrary externally chosen address. The operator should provision a supported static resource.

Dynamic assignment would undermine the static public-IP requirement and does not open a blocked inbound traffic path.

Guest firewall policy may also matter, but a Standard Azure public IP does not bypass applicable subnet or NIC NSG rules. Inspect the effective Azure NSG and other inbound controls before attributing the failed HTTP request solely to the VM operating system.

IP forwarding is for workloads that forward traffic on behalf of other destinations. It is not an inbound TCP 80 allow rule and cannot override an effective NSG deny for this VM. Check the inbound security path instead.

Standard SKU public IPs use static allocation, and assigning one does not make the VM reachable through an otherwise blocked inbound path. The secure-by-default model still requires effective NSG authorization and a reachable guest listener. An allocation-mode change is neither available for this SKU nor a substitute for end-to-end connectivity checks.

A public IP DNS label only supplies a resolvable Azure-managed hostname for that address. It does not write NSG rules, open guest firewall ports, or ensure the service is listening. Even correct DNS resolution can lead to a connection failure when the effective security policy blocks the port or the VM has no active listener.

Static controls address persistence, not the security policy or guest application state. Connections can still be blocked.

A separately managed Standard Public IP can outlive NIC deletion and remain allocated and billable until the IP resource itself is released.

Deallocating another compute resource does not change ownership or billing of this remaining allocated public IP resource.

DNS records reference addresses but do not delete or release a billed Azure public IP allocation.

Individually provisioned public IP resources can be static, but adjacency is not guaranteed across separate allocations. The partner requirement specifically calls for a reserved contiguous block.

One shared address can be reused in some routing architectures, but it is not six distinct addresses from an allocatable contiguous block as specified.

A load balancer can use multiple frontend public IP configurations, but unrelated public IP allocations do not promise contiguous addresses. It also does not itself reserve a fixed six-address CIDR block for independent application entry points. Reserve a sufficiently sized Azure Public IP Prefix, then allocate eligible Standard public IPs from that range.

Static allocation makes the public IP stable, not absent. The VM would still have a direct public endpoint subject to its other network controls.

Blocking RDP reduces one exposure, but the NIC retains its public IP and other allowed ports could remain accessible. The request is to remove all direct public reachability.

Changing a different load balancer cannot remove the public IP bound to this VM NIC. Direct public association remains until its own configuration is changed.

Inbound NAT targets external-initiated connections to backends and is not the desired dedicated subnet outbound service.

NSGs allow or deny network flows; they don't allocate public SNAT addresses or guarantee stable egress identity. A subnet-associated NAT Gateway with a chosen public IP provides the requested managed outbound translation.

That can create inbound exposure and complicate stable centralized egress management, contrary to the no-public-VM requirement.

A zonal public IP is still tied to its selected availability zone. Even if the application instances survive in other zones, loss of the frontend IP’s zone can prevent clients reaching them. The scenario requires a zone-redundant Standard public IP to avoid the single-zone frontend dependency.

A dynamic Basic address is not a substitute for the zone-resilient Standard IP capability. It introduces other availability and security limitations.

A zone-specific frontend address remains tied to its selected zone. Zone-resilient application instances cannot preserve that frontend during its zone outage; a zone-redundant Standard public IP is required where supported.