Microsoft AZ-104 Exam Dumps, Practice Test Questions

NSG allows decide packet admission and do not rank route sources or choose the next hop in a tie.

DNS proxy might affect name resolution but not the selected route source for a given destination prefix.

User-defined route precedence can override a matching system route; removing it would change the intended appliance forwarding.

Azure UDR tables are associated with subnets, not directly with individual NIC IP configurations in that way.

UDR association targets a subnet. A virtual-network-level binding is not the supported Azure route table attachment model.

Policy may enforce resource configuration, but a route table takes effect for VMs only after the appropriate subnet is actually associated.

A private address route affects internal destinations and does not ensure that unmatched internet-bound traffic traverses the inspection appliance.

Internet next hop directs eligible traffic toward Azure internet routing, not to the configured virtual appliance. It would undermine the intended firewall traversal.

Route names are descriptive; the next-hop type determines packet forwarding. Retaining Internet leaves the inspection bypass intact.

IP flow verify reports whether a packet matches an NSG allow or deny rule. It does not identify the selected route and next-hop network virtual appliance.

IP flow verify diagnoses whether an NSG permits the chosen traffic flow, not which effective route or next-hop type the VM selects. Network Watcher Next hop and effective routes identify the forwarding decision for the destination address.

DNS can resolve a destination name, but the VM already has the destination IP. Route selection depends on effective prefixes and next-hop types, not the VM’s public label.

A single destination route would abandon the required forced-tunnel default and does not correct the appliance forwarding failure.

Guest forwarding is necessary for a router but insufficient when Azure fabric still blocks forwarding of packets not addressed to the NIC.

Peering permission may be needed for hub traffic, but it does not turn on forwarding for the appliance NIC itself.

Azure route evaluation uses longest-prefix matching. A more-specific gateway-propagated route may continue to win over a 0.0.0.0/0 user route; that default route does not turn off or remove BGP-learned prefixes. When the design must exclude gateway-propagated routes on a subnet, configure route-propagation behavior on its associated route table while preserving needed on-premises paths.

The default UDR next-hop choice determines how traffic matching that route is forwarded; it does not disable publication of VPN gateway-learned prefixes into the effective route table. Setting the next hop to Internet would also undermine the intended firewall path. The propagation control resides on the associated route table, separate from individual next-hop choices.

A BGP ASN identifies an autonomous system in a gateway routing relationship; it is not a per-subnet selector for enabling or disabling learned routes. Changing peer ASN parameters can disrupt routing globally and does not provide the requested isolation for one subnet. Use the route table’s virtual-network-gateway propagation setting for targeted control.

IP forwarding permits an NVA to receive and forward traffic not destined to its own NIC, but it does not rewrite other subnets’ effective routes or enforce return-path symmetry. A reply that bypasses the firewall still breaks stateful flow tracking. Diagnose and configure the forward and return UDR, gateway, and transit routes so both directions traverse the appliance.

Accelerated Networking can reduce VM network processing overhead, but it does not program return UDRs or make a stateful appliance receive packets routed around it. Even a faster NIC cannot inspect replies that never reach the firewall. The failure is a path-symmetry defect, not a packet-processing performance bottleneck.

A load-balancer health probe checks backend health for load-balancing decisions, not arbitrary effective routes on remote reply subnets. It cannot force reply packets to re-enter the same firewall for stateful session tracking. Routing symmetry requires explicit compatible forwarding and return-path configuration.

Azure user-defined route tables are associated with subnets rather than arbitrary NICs. NIC attachment does not bypass the one-route-table-per-subnet model.

Azure route tables do not support an NSG-like priority to allow two simultaneous table associations. Effective routes select based on prefixes and origin, not multiple RT ranking.

DNS zone selection does not attach route tables to a subnet or control route-table concurrency. It can resolve names but not provide separate subnet route policies.

Removing the workload UDR would allow other effective routes, often a direct system Internet default, to carry traffic without the required stateful firewall inspection. It might avoid the observed loop by eliminating the inspection path rather than correcting its topology. The scenario requires retaining inspection and safely forwarding to a next hop.

Applying the default-to-appliance UDR to the appliance subnet can direct the appliance’s own egress back through the same next hop, creating or perpetuating a routing loop. Azure recommends a separate subnet for a forwarding NVA and careful routing of its return traffic, not an identical catch-all route for both workload and appliance networks.

A UDR with next hop Internet can deliberately bypass a virtual appliance for the matching destination. Although changing away from a same-subnet appliance might stop that specific loop, it defeats the stated requirement to inspect Internet-bound workloads through the stateful NVA. The placement and route association must be corrected while retaining the firewall path.

The documented NAT Gateway precedence applies to outbound connectivity configurations, not to a custom UDR that deliberately diverts traffic to an appliance. Treating NAT Gateway as an override for forced inspection could bypass the intended security architecture. The route to the firewall is selected for matching destinations and must be evaluated independently of outbound SNAT precedence.

Load Balancer probes determine backend health and forwarding for an associated load-balancing service. They do not select a subnet’s default user-defined route, and no Load Balancer is stated in the design. The routing choice follows the configured prefix and next-hop type, not an HTTP health probe.

Azure routing does not arbitrarily balance one flow between an explicit UDR next hop and the subnet NAT Gateway. The stated default route gives a concrete next hop for matching traffic. If a firewall inspection path is required, configure and validate appliance forwarding and return flows rather than assuming unconfigured ECMP between dissimilar services.

A resource group's name or location in the management hierarchy does not change the subnet's associated routing configuration. Both subnets would still share policy.

Network security group rules allow or deny traffic; they do not select a next-hop route to an appliance. Replacing a route decision with a firewall allow rule would not meet the routing-isolation requirement.

The shared route table is evaluated by each associated subnet, so the added rule would not be subnet-specific. Name differences cannot isolate route semantics for a single member subnet.