Microsoft AZ-104 Exam Dumps, Practice Test Questions

Azure ASG membership is not limited to a single group per network interface. Splitting the workload into public IP addresses would also introduce unnecessary exposure and not solve role-based NSG selection appropriately.

ASG member NICs must satisfy same-VNet membership constraints; placing the two groups in different VNets is not how a single interface gains multiple application roles. VNet peering also does not change its actual network membership.

ASG membership belongs to network-interface IP configurations, not to a resource group abstraction. A resource group can hold many unrelated resources and is not a selector for traffic at a specific NIC IP.

An NSG references ASGs but does not convert unrelated PaaS resources into ASG members. The required membership remains unsupported.

The Storage service tag matches published service address prefixes in a supported network security rule. It does not register a Storage account as a NIC IP configuration in an application security group. Service tags can aid separate traffic rules, but ASG membership remains limited to eligible network interfaces.

Private DNS zone links configure name resolution, not ASG member IP configurations. The account still is not an eligible ASG member object.

An ASG's name is merely a label for eligible Azure NIC IP configurations; it isn't parsed as an IP prefix or joined with a partner network. Renaming the group cannot make an unsupported mixed source selector valid or preserve the desired two different traffic sources.

An external partner's IP range is not membership of a locally managed Azure NIC. Falsely assigning or imitating that address on an Azure VM would create address conflicts and incorrect source trust rather than defining the external partner's reachability.

Protocol selection controls matching TCP, UDP or other IP protocols and does not relax the source-selector limitations. A broader protocol value would potentially permit more traffic and still wouldn't make a mixed ASG/IP-prefix source valid in the same rule.

VM tags are not equivalent to ASG IP configuration membership. They do not automatically attach every NIC or provide the requested interface-specific choice.

An IP configuration added to an ASG remains an ASG member, regardless of the port selected by an NSG rule. Only the frontend IP configuration should join the application ASG.

Application security group membership is bound to NIC IP configurations; an ASG is not selected by a whole subnet association. The targeted frontend NIC IP configuration must be added explicitly.

Internet represents a broad IP address range and would no longer restrict access to the 12 intended application roles. Replacing role-specific ASGs with that tag changes the security meaning and may permit unauthorized sources.

NSGs attach to subnets or NICs, while ASGs are traffic selectors referenced by NSG rules. An ASG is not an NSG attachment target, so trying to bind the NSG to the group resources misunderstands their roles.

Custom NSG priorities range from 100 to 4096; zero is invalid. Priorities influence ordering and do not override the platform’s maximum number of ASG references in one rule.

A public load balancer with an open management port would expose the administrative service externally, which is the risk the security team wants to eliminate.

Time-limited NSG rules can reduce exposure, but this path still depends on VM public addresses, which the policy deliberately removed.

Inbound NAT can route administrative connections but would expose a public management endpoint. Bastion preserves private VM management access without that exposure.

The Developer SKU itself does not support reaching VMs through VNet peering, so loosening an NSG cannot add that missing Bastion capability. Opening Internet access to a private administration port also violates the stated private-only VM policy. The remedy is a supported dedicated Bastion tier, not an exposure workaround.

Publishing a public name for an RFC1918 private address neither makes that address routable from a user’s browser nor changes Azure Bastion Developer SKU feature limitations. DNS names can help identify services, but they do not supply missing Bastion peering support or a secure management transport.

Storage Blob Data Reader grants blob-object read permissions and is unrelated to Azure Bastion network peering. The operator might need relevant VM access permissions, but a storage data role does not upgrade the Bastion feature tier or establish the supported peered-VNet SSH connection.

For Standard Bastion, the required AzureBastionSubnet is reserved for Bastion deployment and cannot continue to host ordinary workload VMs. Renaming or otherwise relabeling the occupied JumpHosts subnet would not supply a dedicated empty subnet. The reserved name is only one requirement; the subnet must also be exclusively usable by the Bastion service.

GatewaySubnet is reserved for virtual network gateways such as VPN gateways, not for Azure Bastion Standard. Sharing the gateway subnet would mix incompatible managed networking resources and would not meet the AzureBastionSubnet identity requirement. The administrator needs a separate dedicated Bastion subnet in the intended VNet.

Standard Bastion does not deploy by delegating an arbitrary existing workload subnet to Microsoft.Network/bastionHosts. The service expects the specially named dedicated AzureBastionSubnet rather than an ordinary subnet selected through a generic subnet delegation. Retaining workload VMs in JumpHosts would continue to violate its placement requirement.

Overly broad source ranges violate the stated private-access design and needlessly enlarge the allowed origin set. The necessary path is from Bastion to the private NIC.

Bastion uses its HTTPS frontend for the browser, but the VM connection itself still needs RDP/SSH from the Bastion subnet. Allowing port 443 to the guest does not solve the reported drop.

Port 443 reaches the Bastion gateway externally; a Windows VM RDP session ordinarily uses port 3389 from Bastion to the VM. The allowed port would still mismatch the guest connection.

That removes the private-management boundary and creates unnecessary Internet exposure rather than enabling the requested Bastion capability.

Opening an NSG port cannot enable a feature absent from the Bastion Basic SKU. Native client support requires Standard or Premium and the correct Bastion feature settings and permissions; do not substitute VM public RDP exposure.

Bastion Developer lacks the dedicated native-client feature available in Standard and Premium. Changing DNS naming does not upgrade the service capabilities or supply the configuration needed for native RDP/SSH use.

Virtual Network flow logs can capture packet-flow metadata such as IPs, ports and direction, but not screen frames or interactive RDP/SSH session content. For portal graphical recordings, Azure Bastion Premium Session Recording must be enabled with the appropriate recording destination. New NSG flow logs also cannot be created after June 2025.

Azure Monitor diagnostics may collect resource logs and operational events, but they do not turn the Standard Bastion tier into graphical session recording. A log of connection attempts is not a screen recording of a completed session. This feature has a specific Bastion SKU and storage configuration requirement.

Native-client connectivity is available at Standard or higher, but Bastion session recording is not supported for native-client sessions. Enabling the native feature does not add the Premium-only recording capability and would not capture the requested portal-session visual evidence for compliance.