Microsoft AZ-104 Exam Dumps, Practice Test Questions

A zonal public IP is still tied to its selected availability zone. Even if the application instances survive in other zones, loss of the frontend IP’s zone can prevent clients reaching them. The scenario requires a zone-redundant Standard public IP to avoid the single-zone frontend dependency.

A dynamic Basic address is not a substitute for the zone-resilient Standard IP capability. It introduces other availability and security limitations.

A zone-specific frontend address remains tied to its selected zone. Zone-resilient application instances cannot preserve that frontend during its zone outage; a zone-redundant Standard public IP is required where supported.

A load-balancer health probe checks whether a backend is available; its packets are not application traffic on an individual client TCP connection. Changing probe frequency does not renew the public frontend’s per-flow idle state. Investigate the relevant inbound idle timeout and client/application keepalive behavior instead.

Outbound SNAT capacity determines availability of translated outbound flows; it does not prevent an otherwise idle inbound client connection from reaching the public endpoint’s idle timer. The described connection succeeds initially and fails only after inactivity, indicating idle-flow tracking or keepalive rather than outbound port exhaustion.

A TCP reset-on-idle feature controls how a timed-out connection is terminated and communicated to endpoints; it does not keep the session alive indefinitely. An idle reset still ends the connection. To preserve long-lived sessions, evaluate supported inbound idle-timeout settings and application TCP keepalives.

Adding public IP capacity increases available outbound SNAT ports for concurrent flows, but the scenario explicitly reports low port pressure. More addresses do not alter the configured timeout that expires an otherwise idle TCP mapping, so the disconnect pattern would continue.

Additional outbound public IPs can expand SNAT port capacity but do not change the idle timeout of an existing TCP flow. Tune the supported TCP idle-timeout setting or implement application reconnects for eight-minute gaps.

NAT Gateway is intended for subnet outbound connectivity, not inbound port forwarding to private VMs. Introducing an Internet-reachable endpoint violates the private-subnet requirement and does not fix time-based expiry of the existing outbound SNAT flow.

NSG rules control packet admission, not the availability-zone allocation of a public IP. Another security rule cannot provide zone redundancy for the same IP address.

The zone is selected at creation and cannot be reassigned afterward. A portal edit cannot turn an existing zonal IP resource into a zone-redundant resource.

Resource tags are metadata; they cannot modify platform zone placement or change the address's availability properties. The public IP would retain its original zonal behavior.

domainNameLabel creates an Azure-hosted forward A record for a public IP, not the PTR record used for reverse queries. Substituting a private address would also be invalid for a public IP DNS label and cannot satisfy partner internet checks.

Changing SKU is not the reverse-DNS control and is not an appropriate way to solve an existing PTR issue. Standard public IP supports the relevant DNS settings without downgrading the address resource.

VNet custom DNS servers affect name resolution for clients using that VNet, not public reverse DNS zones for the allocated public IPv4 address. The partner operates outside the VNet and queries a PTR record tied to the public address.

The default route matches every address but loses when a longer prefix applies. Both the /16 and /24 entries are more specific for this destination.

The /16 entry also matches 10.20.8.45, but routing chooses the longest matching prefix, not an arbitrary preference for a virtual appliance.

User-defined routes win over system routes for the same address prefix, but Azure selects the longest matching prefix first. The /24 is more specific than /16.

An Internet next hop uses the platform’s direct internet routing rather than the inspection appliance, contradicting the mandatory centralized egress path.

A /32 target of the appliance IP applies only to packets destined to that address, and next hop None drops them. It would not redirect general outbound traffic for inspection.

A host-specific /32 only captures traffic addressed to the appliance IP itself. It does not match arbitrary outbound destinations as required for centralized egress inspection.

A NAT Gateway provides outbound SNAT, not the Virtual network gateway next-hop target of an Azure UDR. Confusing these different gateway services would not make the proposed ExpressRoute routing valid.

Azure differentiates VPN gateways from ExpressRoute gateways, Route Server and Virtual WAN hubs for explicit UDR Virtual network gateway next-hop support. A gateway resource existing in the VNet does not make every gateway type an eligible UDR next hop.

The address prefix affects which destination traffic matches a route, not which Azure gateway types support a selected next-hop setting. Broadening the route to a default route could worsen unintended routing without resolving next-hop validity.

Firewall adjacency or NVA IP placement does not explain this service-specific routing change. The broad UDR may remain functional for unrelated internet traffic while routes inserted by an enabled service endpoint take precedence for Azure service address ranges.

Service endpoints do not create customer-subnet private endpoint NICs or change a Storage service into a private-link endpoint. That mechanism belongs to Azure Private Link, and confuses the reason traffic bypassed the existing default route.

User-defined routes govern outbound packets originating on a subnet and demonstrably still influence other internet traffic here. The exception arises from preferred service-endpoint system routes, not from a general restriction against routing VM-originated packets.

Internet next hop does not express an intentional drop and may attempt a route inappropriate to the private destination.

A forwarding appliance is for inspection/routing, not guaranteed discard. Without separate NVA firewall policy it does not implement the explicit blackhole behavior.

The Virtual network next-hop type forwards traffic along the virtual network routing path; it does not express an explicit drop policy for the specified internal prefix. To deliberately blackhole that destination range, use a user-defined route for the prefix with next hop type None, which tells Azure to discard packets rather than attempt delivery.

NSG allows decide packet admission and do not rank route sources or choose the next hop in a tie.

DNS proxy might affect name resolution but not the selected route source for a given destination prefix.

User-defined route precedence can override a matching system route; removing it would change the intended appliance forwarding.