Microsoft AZ-104 Exam Dumps, Practice Test Questions

Virtual Network flow logs can capture packet-flow metadata such as IPs, ports and direction, but not screen frames or interactive RDP/SSH session content. For portal graphical recordings, Azure Bastion Premium Session Recording must be enabled with the appropriate recording destination. New NSG flow logs also cannot be created after June 2025.

Azure Monitor diagnostics may collect resource logs and operational events, but they do not turn the Standard Bastion tier into graphical session recording. A log of connection attempts is not a screen recording of a completed session. This feature has a specific Bastion SKU and storage configuration requirement.

Native-client connectivity is available at Standard or higher, but Bastion session recording is not supported for native-client sessions. Enabling the native feature does not add the Premium-only recording capability and would not capture the requested portal-session visual evidence for compliance.

A public-Internet deny rule does not address the relevant private flow: Azure Bastion originates sessions from AzureBastionSubnet toward the protected VM. The policy must block the TCP 3389 path from Bastion itself, not only prevent direct Internet RDP. In many Bastion architectures the VM has no public IP in the first place.

Azure RBAC governs who can manage or initiate operations in Azure, but it is not itself a protocol-level packet filter that selectively closes TCP 3389 while permitting TCP 22. An engineer with authorized Bastion access could still reach an enabled RDP service if the network and guest permit it. Use targeted network/guest restrictions for the protocol requirement.

A blanket deny at AzureBastionSubnet blocks the required SSH path as well as Bastion management/data-plane ports such as 443, 8080 and 5701. It disrupts the managed host rather than enforcing SSH-only access to the protected workload. Preserve Microsoft's mandatory Bastion service rules and tailor only the relevant target-VM management traffic.

The required subnet is already correctly named; the insufficient address capacity causes validation. A shorter label would also violate the reserved AzureBastionSubnet name.

Resource group placement of a route table does not increase available subnet IP addresses. The deployment still sees a subnet smaller than the required /26.

The public IP address is separate from the private subnet's allocated address range. Assigning a public endpoint cannot satisfy the private AzureBastionSubnet size prerequisite.

A Bastion shareable link provides approved administrative connectivity rather than forwarding arbitrary public HTTP requests to a site. Publish websites through an HTTP-aware ingress service.

An NSG rule permits packets but does not add application proxy behavior to Bastion. The service is not a website HTTP frontend.

Bastion native-client tunneling is a supported administrative transport pattern, not a managed public web proxy for arbitrary Internet clients. Public application ingress must be configured separately.

The Storage service tag represents broad Azure Storage address ranges; permitting it in an NSG does not select individual approved storage accounts.

Restricting inbound access to the two trusted accounts does not stop this subnet from reaching a third account whose firewall permits it. The requirement is an outbound restriction from the subnet.

DNS aliasing affects name resolution but does not enforce the destination-account restriction on service endpoint traffic. The subnet needs a service endpoint policy.

That behavior describes private endpoints, not service endpoints. No storage private NIC is created merely by enabling a service endpoint.

Network source restrictions do not assign Azure RBAC permissions. Identity/data authorization remains separate.

Service endpoint routing is not a transport encryption bypass. HTTPS or secure-transfer policies still apply to storage clients.

RBAC management rights do not bypass network firewall restrictions on data requests, and subscription Owner would grant excessive privileges.

Removing the endpoint would not add the subnet to the storage network allowlist. It could make the intended network path less secure.

Replication durability has no relationship to the account’s permitted subnet network rules.

Azure Resource Manager Reader permits management-plane inspection of the storage account resource; it does not itself authorize reading its protected Blob contents. Portal navigation can need Reader as well as a Blob data role, which makes the distinction tempting. The missing authorization is specifically a Blob data-plane permission, not another management-plane read assignment.

A private endpoint is an alternative private network path but does not supply an identity or signed permission to read blob data. The current service endpoint already satisfies the stated firewall restriction, so changing how packets arrive cannot resolve an authorization failure. Data access must be granted through Blob authorization mechanisms.

The trusted-services exception is a storage firewall networking allowance for qualifying Azure services, not a blanket identity privilege for any caller on the permitted VM subnet. Even if a different network exception were applicable, each protected Blob request still requires a valid data-plane authorization; the question explicitly states that credential/permission is absent.

A service endpoint and an account VNet rule determine whether the network origin may reach the storage endpoint. They do not grant the authenticated identity data-plane write privileges. The error explicitly identifies an authorization permission mismatch after the request reaches Blob; changing an already-valid subnet allow rule leaves that mismatch.

The ordinary Reader role enables ARM control-plane resource inspection but does not include the Blob data-plane write action. The caller can pass the subnet network boundary while lacking the necessary storage data-role or SAS operation permission. An appropriate data-plane grant is still needed at the correct resource scope.

Storage Blob Data Reader allows reading blob content, not creating or overwriting blobs. A VM connected through a permitted service endpoint still needs the specific storage data-plane permissions for the write. The endpoint and firewall do not upgrade a read-only identity to a writer.

Service endpoints apply to supported Azure subnet-originated flows. On-premises clients do not become members of that subnet merely because a VPN connects the networks.

A UDR cannot convert the public PaaS endpoint into a private address or change how Storage authorizes network origins. It is not equivalent to Private Link.

DNS data without a valid private endpoint and routing cannot establish private service connectivity. It may instead direct clients to an IP with no Storage listener.

Permitting broad Azure datacenter public IP space unnecessarily authorizes other network origins and does not narrowly express the documented trusted-service exception. Use the specific exception with strong service authorization.

Azure services are not automatically all treated as trusted by the Storage firewall. Azure-hosted application VMs and arbitrary third-party workloads may still need explicit IP/VNet rules or private endpoints. Treating every Azure origin as exempt would ignore the documented trusted-service list and weaken the intent of a default-deny design.

A storage VNet rule applies to traffic from the specified subnet. Azure Monitor diagnostic export runs from supported service infrastructure outside the VNet, so the unrelated subnet rule does not create the missing network exception.