Microsoft AZ-104 Exam Dumps, Practice Test Questions

Blob tiering changes object access costs and latency. It does not determine whether private endpoint NIC traffic is evaluated by subnet network policy.

Private endpoint NIC traffic is governed by the subnet’s private endpoint network-policy setting for NSG enforcement. Creating desired rules without enabling the relevant policy does not make those rules apply to private endpoint traffic.

Private DNS resolves service hostnames to the endpoint’s private address, but the setting that permits subnet NSG policies on private endpoint traffic is separate. DNS success does not imply enabled private endpoint network policies.

A virtual network link enables that VNet to resolve records that exist in a private DNS zone; it is not the endpoint lifecycle integration that creates and maintains the private endpoint A record. A private DNS zone group associates the endpoint with the relevant zone and supports the expected record lifecycle, while the VNet link solves a different part of resolution.

Private DNS virtual-network auto-registration relates to registration of virtual-machine records; it is not the integration mechanism that updates the private endpoint's privatelink A record. The DNS zone group associates the actual endpoint with its private DNS zone and maintains the record lifecycle. The VNet link provides name resolution to participating clients.

A static A record can point at the current private IP, but it is not automatically bound to the private endpoint lifecycle. When the endpoint is recreated or its address changes, the record may become stale without a management process. A private DNS zone group supplies the requested endpoint-to-zone record integration rather than a fixed manual mapping.

Azure Files is another storage service and cannot substitute for an HTTPS Blob private endpoint. The client is calling a different subresource.

Public aliases do not provide the missing private Blob subresource path while public network access is disabled.

Replication settings do not configure private endpoint subresource coverage. The tool would still lack the Blob private network path.

Removing the private endpoint eliminates the intended private path and does not solve invalid SQL credentials. A network allow rule cannot replace database authentication.

Changing DNS changes which network endpoint is reached, not the SQL principal's rights. It would also reintroduce the public route contrary to the private-access requirement.

Azure RBAC Reader can view management properties but does not by itself create a SQL login or authorize table queries. Management-plane visibility is not database data-plane permission.

A Storage Blob private endpoint gives a consumer network private access to a supported Storage Blob service. The publisher is offering its own custom HTTPS application behind a load balancer, so a Storage subresource endpoint has no relationship to its backend pool or producer identity. The scenario needs a producer-side Private Link service.

Private Link service supports the Standard Load Balancer frontend, not Basic Load Balancer. Downgrading the producer load balancer would remove the very supported prerequisite. A private consumer access path is not created by changing SKU alone; the publisher must configure a Private Link service anchored to the supported frontend.

A public HTTPS frontend could make the workload reachable from the Internet, but the owner specifically prohibits exposing the service publicly. This approach removes the private-consumer access boundary and is not a Private Link producer configuration. Traffic would also need conventional public firewalling rather than the requested private endpoints.

Azure Storage can support multiple private endpoints; the risk here is shared DNS interpretation of the same service FQDN, not a global single-endpoint quota. Public-address changes would defeat the intended private path and not fix conflicting private A records. Multiple endpoints need deliberate DNS scoping.

A DNS record containing an endpoint address doesn't provide automatic client-aware steering to whichever endpoint a VM intended. Two separate private endpoints with one shared zone can cause accidental record replacement or ambiguity. The network design must explicitly select how clients resolve that service name.

Multiple zone groups pointing into the same shared zone do not provide client-aware resolution or prevent record replacement for one FQDN. Design distinct DNS contexts or a common endpoint instead.

Disconnected indicates the service provider removed the connection; it is not an active Approved relationship. Private DNS cleanup can be needed as part of removing abandoned resources, but deleting only a DNS record leaves the disconnected private endpoint object. The provider’s approval decision is a separate control from DNS resolution.

A consumer has no implied administrative rights to alter the partner-owned target service by owning its private endpoint. Provider-side approval is a deliberate boundary, and changing a firewall would neither restore the removed connection nor be an authorized workaround. Request a new approved private connection when access is needed.

A VNet address-space modification does not change a connection that the service provider has removed. The status reflects the partner’s private endpoint connection lifecycle, not a subnet CIDR mismatch. Adjusting unrelated VNet properties risks network disruption and cannot transform Disconnected to Approved without a new accepted connection.

A private endpoint's own managed network interface determines its allocated IP. Reserving an address on a separate VM NIC cannot convert an existing endpoint to static IP in place. Recreate the endpoint with supported static IP settings and update dependent DNS/network rules.

A private endpoint owns and manages its network interface; treating it like a normal VM NIC does not expose a supported in-place static-IP conversion. The existing endpoint configuration must be replaced.

A DNS record can point to a different address but it cannot move the endpoint NIC to that address. Clients would resolve an IP at which the expected private service endpoint may not exist.

Private endpoints are not limited to clients on the NIC subnet alone; Azure supports consumption from regionally or globally peered virtual networks when routes and name resolution work. Requiring a duplicate endpoint per spoke is unnecessary here and may introduce conflicting DNS records. The existing approved endpoint already supplies the path.

Changing to public address resolution would defeat the explicit private-only network path and could fail if public access is disabled. The setup already resolves SQL to the approved private endpoint IP from VNet-B, which is the necessary DNS direction. Public DNS is not a prerequisite for peered VNet access to that endpoint.

VNet peering and Private Link influence reachability, not database-level identities or SQL privileges. A successful private TCP path does not grant permission to authenticate to or query the SQL database. The scenario’s network preconditions answer the reachability question, while database authorization remains independently enforced.

A private endpoint uses a private address taken from its VNet subnet, not a mandatory public IP. Microsoft documents that the assigned private IP normally remains stable for the endpoint’s lifecycle, so assuming it must rotate is unfounded. Adding a public IP would also undermine the private connectivity objective and does not enable NIC edits.

The NIC is bound to the private endpoint connection and is not an independent user-managed network adapter that can be retargeted to another Private Link service. Changing the service requires supported endpoint connection configuration or a replacement endpoint as applicable. A direct NIC reassignment would not create a valid approved service connection.

Private DNS zones and zone groups govern name-to-address records, not permissions to mutate every network interface. DNS Zone Contributor does not override the private endpoint NIC’s managed, read-only lifecycle. A correct DNS record cannot turn an unsupported NIC edit into an approved private endpoint configuration change.

DNS changes destination selection but does not grant file authorization. It may also violate the private-access security requirement while leaving the same identity permission failure.

Management-plane Reader can inspect resource metadata but does not itself grant Blob data reads or traverse permissions on hierarchical file paths. Data-plane access requires the appropriate grants.

Revoking the endpoint would break network connectivity and would not correct the caller's missing data permissions. Endpoint approval is not a substitute for RBAC and filesystem access control.