Microsoft AZ-104 Exam Dumps, Practice Test Questions

DNS changes destination selection but does not grant file authorization. It may also violate the private-access security requirement while leaving the same identity permission failure.

Management-plane Reader can inspect resource metadata but does not itself grant Blob data reads or traverse permissions on hierarchical file paths. Data-plane access requires the appropriate grants.

Revoking the endpoint would break network connectivity and would not correct the caller's missing data permissions. Endpoint approval is not a substitute for RBAC and filesystem access control.

Private endpoints use private VNet addresses. Requiring public IPs would contradict their purpose and does not explain the desired reverse connection.

Private endpoint approval is not VNet peering. It does not create arbitrary bidirectional VM-to-VM routing between producer and consumer networks.

Private DNS resolves names and does not establish reverse transport permissions or network routes from the service into a consumer subnet.

A public DNS zone distributes records through public authoritative name servers, which violates the internal-only name-resolution requirement.

A private endpoint creates access to a private service but does not automatically define this arbitrary internal application hostname in a linked DNS zone.

A resolver attached to one machine does not automatically serve both subnets or create a linked Azure-managed zone. Clients still lack consistent internal name resolution.

The subscriptions or tenants do not have to be merged to link a VNet to Azure Private DNS. Migrating the partner network and its workloads would introduce unrelated identity, resource ownership, and operational changes. The relevant prerequisite is the right to write both the zone and the VNet, followed by creating the private-zone virtual network link.

VNet peering supplies network reachability, not automatic registration of private DNS zone links. Two independently administered networks can be peered without sharing Azure-provided private DNS zone resolution. A cross-tenant zone link with appropriate resource permissions is the direct action in this case; peering by itself cannot create that link.

Public DNS delegation concerns internet-facing authoritative DNS zones and does not grant Azure Private DNS visibility to an Azure VNet. Publishing private-only DNS names publicly could also violate the intended isolation boundary. Keep the zone private and authorize a virtual network link to the partner VNet with the required permissions.

Manually authored A records may resolve the present address but do not activate VNet-linked auto-registration. When a VM is added, removed, or its IP changes, the records can become stale; automatic registration is a property of the appropriate private-zone VNet link.

Resolution-only links allow the VNet to query private DNS records but do not create those records for its VMs. Azure creates and updates supported VM records only when auto-registration is enabled on the appropriate link.

Registration applies to eligible VMs in the VNet associated with the registration-enabled link. Enabling it on an unrelated VNet cannot create or maintain the requested host records for the source VNet.

The public recursive lookup uses the parent zone's delegation first. Editing records only inside Azure's child zone does not redirect the parent NS delegation to Azure DNS.

Private DNS links affect resolution inside linked VNets and do not make Azure the authoritative public DNS provider for the Internet domain.

The SOA record within the new zone is not the parent zone's authoritative NS referral. External resolvers will still follow the registrar or parent delegation until it is updated.

Azure public DNS serves publicly delegated zones, not private DNS zones linked to the Azure hub VNet. The forwarded query would not reach the linked private resolver view.

An outbound endpoint forwards Azure-originated queries toward external servers; it is not the managed inbound listener that on-premises DNS should query for Azure private zones.

A VNet link enables Azure network clients to resolve private names but does not, by itself, tell an external on-premises resolver where to send its conditional queries.

Public DNS makes names visible externally and does not preserve the hybrid private namespace or conditional forwarding model the organization needs.

An inbound endpoint accepts queries arriving into Azure; this case requires Azure-originated queries forwarded out to external servers.

An inbound endpoint receives queries from elsewhere. Azure-originated conditional forwarding to on-prem DNS requires the outbound path and matching ruleset.

A fixed address record can become stale if the public IP resource changes. It does not create the requested resource-level binding.

A CNAME target is a DNS name rather than a numeric IPv4 literal. Even an ordinary A record with a fixed address would not automatically track Azure Public IP resource changes.

PTR records map an IP to a name in reverse DNS. They do not create a forward public A alias that follows Azure resource configuration.

Publishing private internal computer names in public DNS bypasses the intended hybrid conditional forwarding boundary and may disclose internal records.

Peering may connect VNets, but a DNS forwarding ruleset does not automatically become active for the querying spoke without its link.

An inbound endpoint allows external DNS servers to send queries into Azure; the case concerns Azure VM queries being forwarded outbound to on-premises servers.

Each Private DNS Resolver endpoint needs a correctly delegated dedicated subnet. Delegating some other endpoint subnet does not make the app NIC subnet a valid place for the outbound endpoint.

Changing upstream resolvers could break private or hybrid name resolution, but would not make an occupied subnet valid for the endpoint.

A forwarding ruleset controls name forwarding behavior, but the resolver outbound endpoint still requires its own dedicated subnet delegation. Linking a ruleset does not repair the rejected endpoint placement.