Microsoft AZ-104 Exam Dumps, Practice Test Questions

A resource group's name or location in the management hierarchy does not change the subnet's associated routing configuration. Both subnets would still share policy.

Network security group rules allow or deny traffic; they do not select a next-hop route to an appliance. Replacing a route decision with a firewall allow rule would not meet the routing-isolation requirement.

The shared route table is evaluated by each associated subnet, so the added rule would not be subnet-specific. Name differences cannot isolate route semantics for a single member subnet.

The /0 Internet route is less specific than Azure’s built-in RFC1918 172.16.0.0/12 None route. The router evaluates the matching private prefix instead, so the presence of the default route does not make the isolated private destination reachable.

RFC1918 addressing does not create any automatic VNet peering relationship or on-premises connection. Remote private networks require explicit supported connectivity and route propagation or custom routing; identical private address ranges can exist in separate networks.

An NSG can block packets but does not normally remove the Internet default system route. The stated environment can drop the private destination due to route selection alone, before an NSG explanation is needed.

Azure NIC IP forwarding is needed when an appliance forwards packets whose destination is not its own address. This VM is the endpoint originating application traffic rather than acting as a router for other VMs, so forwarding alone doesn't select the correct guest interface for the remote data prefix.

Indiscriminately adding competing default gateways can make outbound path selection unpredictable and impair the primary management path. The requirement is destination-specific routing through a secondary interface, not a second universal default route applied without considering metrics or subnet reachability.

A public IP affects inbound or Internet-facing accessibility, not the necessary guest OS route to a private data network. Assigning one creates unnecessary exposure and leaves the multi-NIC routing decision unresolved in Windows.

Routing compares destination IP prefixes, not DNS record names or protocol-specific traffic. Matching packets of supported protocols follow the route.

The new route matches only its destination prefix. Creation order does not make a /16 gateway next hop apply to unrelated Internet destinations.

A default route is the least-specific catch-all. A matching /16 takes precedence in the standard longest-prefix selection process.

A user-defined route table is one routing input. The NIC effective routes incorporate UDRs, system routes and propagated routes and reveal what the VM actually evaluates.

NSG evaluation concerns whether packets are filtered, not which route is selected. Effective routes are needed to analyze route source, specificity and next-hop selection.

Advertised BGP prefixes are one potential input, not the final union of user-defined, BGP and system routes after Azure's route selection. Examine the destination VM NIC's effective routes and prefix specificity.

Next hop identifies Azure's selected forwarding route from a VM to a destination IP. It can help with routing questions but does not run the specific VPN gateway and tunnel diagnostics requested here, including investigation of the connection's configuration and status.

IP flow verify checks NSG permit/deny behavior for a concrete VM flow, not the VPN connection's gateway health or tunnel parameters. Even a permitted packet does not establish that the site-to-site VPN tunnel can negotiate and carry traffic.

Metric alerts notify when a monitored threshold is met but don't replace the specific on-demand VPN troubleshoot execution and diagnostic logs. An alert alone doesn't establish the reason for a tunnel disconnect and cannot automatically prove its configuration is valid.

Effective routes identify chosen network next hops but do not by themselves determine whether a specific NSG rule blocks the packet.

An effective security-rule inventory is useful for review, but IP flow verify supplies a direct allow/deny verdict and matching rule for the concrete packet being investigated.

Next hop diagnoses routing, not NSG authorization. A packet may have a valid route yet be blocked by an applicable security-group rule.

IP flow verify evaluates a specified packet direction, endpoint addresses and port against effective NSG policy and reports a verdict and matching rule. It does not display the complete combined subnet/NIC rule set needed for broader inspection. The VM NIC Effective security rules view provides the requested rule inventory.

When both subnet and NIC NSGs are associated, traffic is evaluated through the applicable combined path. A subnet-only rule list omits NIC-specific allows or denies and therefore does not provide the requested effective set. The NIC Effective security rules view aggregates the relevant security rules for troubleshooting this VM's traffic.

Next hop is a routing diagnostic that identifies the route selected for a destination; route selection does not enumerate NSG filtering at both subnet and NIC. The inability to receive HTTPS can result from security rules even when the route is valid. Effective security rules is the appropriate rule inventory for this question.

IP flow verify identifies which NSG rule allows or denies a specified packet at a VM network interface. That can narrow an NSG issue, but it does not perform a complete source-to-destination connection test or prove a service port is accepting connections. Use connection troubleshoot for the requested end-to-end investigation.

Next hop helps identify an Azure routing decision for a destination but does not necessarily connect to the target TCP port or establish a usable end-to-end path. Connection troubleshoot checks the requested source, destination and port and reports possible connectivity failures.

Effective security rules can expose local network filtering, but a permitted local NSG does not guarantee routes, intermediate firewalls or the remote service listener work. The scenario calls for a targeted source-to-destination reachability test, which connection troubleshoot provides.

Effective routes show route sources and next hops; they cannot demonstrate TCP loss or sequence behavior at packet level.

Flow summaries can show traffic metadata but not the packet-by-packet sequence and retransmit evidence requested.

IP flow verify returns rule allow/deny outcomes for a sample packet, not a captured sequence of retransmissions or resets.

Packet capture can help inspect observed traffic but does not directly return the named NSG rule permitting or denying a hypothetical five-tuple. NSG diagnostics simulates the flow and reports the evaluated rule and verdict for the VMSS target.

Effective routes explain the selected next hop, not which NSG rule would allow or deny a given packet. The desired output is a security decision.

Connection Monitor can report reachability failures over time, but an NSG diagnostic evaluation is more direct for identifying the precise security rule responsible for a packet tuple.