Microsoft AZ-104 Exam Dumps, Practice Test Questions

Each Private DNS Resolver endpoint needs a correctly delegated dedicated subnet. Delegating some other endpoint subnet does not make the app NIC subnet a valid place for the outbound endpoint.

Changing upstream resolvers could break private or hybrid name resolution, but would not make an occupied subnet valid for the endpoint.

A forwarding ruleset controls name forwarding behavior, but the resolver outbound endpoint still requires its own dedicated subnet delegation. Linking a ruleset does not repair the rejected endpoint placement.

Autoregistration is a supported feature when the VNet link has registration enabled; the issue is its resource/interface scope.

Azure Private DNS registration is configured on a virtual-network link, not an individual subnet or secondary NIC. Supported automatic VM hostname registration uses the primary NIC; a second NIC doesn't receive an independent auto-created record from a subnet toggle.

Tenancy is unrelated to creating separate auto records for multiple NICs attached to one VM.

A private DNS zone linked only to the spoke VNet is not automatically consulted by a separate custom DNS server in the hub. That server needs a conditional forwarding or resolver path able to query the linked Azure private zone to return the blob endpoint’s private IP.

Allow forwarded traffic controls network packet transit through appliances; it does not teach a custom DNS server to resolve an Azure private DNS zone. Proper DNS conditional forwarding to an Azure-aware resolver is still required.

Publishing RFC1918 addresses publicly is not a reliable internal resolution design. Use controlled private DNS forwarding.

An NSG may control DNS packet transport but does not change the resource model that permits only one corresponding VNet link for the zone. The portal validation would still fail.

A record holds a hostname address mapping and cannot authorize or create a zone-to-network relationship. Duplicating record data does not satisfy the VNet linking rule.

Automatic registration of private VM names is a Private DNS zone VNet-link feature, not a public-zone workaround. A public zone would expose a different resolution surface.

Overlapping suffixes are evaluated by specificity; their coexistence does not automatically invalidate a name. Rejecting the query would ignore the documented matching behavior.

Target IP ordering does not determine which forwarding rule applies. The matching domain suffix identifies the rule and then that rule supplies its configured target DNS servers.

Rule creation order does not override a longer domain-suffix match. The more-specific payroll rule remains the intended target for a name beneath that domain.

A backend pool enumerates destinations, but without a health probe the load balancer cannot reliably withdraw a process that stopped serving port 8080.

A load-balancing rule maps frontend traffic to backends, but it does not by itself supply the health measurement that removes the failed process from rotation.

Client-IP affinity influences which healthy backend receives a session; it does not detect an unavailable process or replace the need for health probes.

A public frontend exposes an internet-routable entry point, contrary to the stated private-only service boundary. It is not the least-exposure design.

IP filtering can limit who reaches a public frontend but the VIP remains publicly addressed. The requirement expressly calls for no internet-facing entry point.

A public application gateway can distribute HTTP requests, but it exposes a public frontend and does not match the private TCP-service requirement.

Client IP affinity chooses a backend by hashing client and destination addresses; it does not configure a destination-IP-preserving Floating IP rule or add any address to the guest OS. The listener specifically requires receiving traffic addressed to the shared frontend IP, so hash-based stickiness cannot replace the direct-server-return and loopback configuration.

HA Ports load balances multiple TCP/UDP ports for supported network virtual appliance patterns, but it does not automatically configure the guest to receive the load balancer frontend IP. The listener needs Floating IP semantics and appropriate guest IP bindings. Simply sending more transport ports to a backend cannot repair the application destination-address expectation.

An inbound NAT rule forwards a specified frontend port to one designated backend instance. That defeats a highly available shared clustered listener across two VMs and does not establish the listener IP on both guests. The required feature is the Floating IP load-balancing rule with matching guest configuration, not a single-VM administrative port mapping.

A dynamic private frontend address can change under applicable changes to the load balancer configuration. Health probes determine backend availability and do not pin frontend address allocation. Clients that record the old numeric IP could lose connectivity after a change.

A public frontend IP introduces a different client-access boundary and does not preserve the desired VNet-only private service address. Assigning a public address cannot satisfy a private static IP requirement held by internal legacy clients.

NAT Gateway supplies outbound SNAT for a subnet, not the inbound private frontend used by an internal Load Balancer. Its public IP is not a substitute for a static private frontend address and would not keep the client-facing private endpoint stable.

NSGs can permit outbound packets but do not provide the public source translation required for Internet connectivity.

An internal frontend alone cannot originate Internet-bound SNAT; egress needs a supported explicit public outbound translation design.

Inbound backend selection and health probing do not inherently allocate a public address for outbound connections.

A probe path determines backend health, not the URL path used to dispatch each client request.

Two backend pools do not supply the missing HTTP path matching feature. A Layer 7 gateway is needed to choose by URL path.

Azure Load Balancer matches transport fields, not decrypted HTTP host or URL paths; it cannot use those values for backend selection.