100% Latest & Updated Microsoft AZ-104 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 760
A company wants requests to /photos routed to one backend service and /api to a different service using the same HTTPS hostname. They have a Standard Azure Load Balancer but cannot configure URL path rules. Why?
- Use a load balancer health probe path /api to route only /api traffic
- Assign separate backend pools for /photos and /api in the same Layer 4 rule
- Azure Load Balancer operates at transport layer; use an HTTP-aware service such as Application Gateway for path routing
- Configure a Load Balancer rule on HTTPS 443 and inspect HTTP Host headers inside it
Explanation
Correct Answer
C:Azure Load Balancer is a Layer 4 TCP/UDP distribution service. HTTP path-based selection requires an application-layer reverse proxy/load balancer such as Application Gateway.
Incorrect Answers
A:A probe path determines backend health, not the URL path used to dispatch each client request.
B:Two backend pools do not supply the missing HTTP path matching feature. A Layer 7 gateway is needed to choose by URL path.
D:Azure Load Balancer matches transport fields, not decrypted HTTP host or URL paths; it cannot use those values for backend selection.
Question 761
A support team needs external TCP port 50222 on a Standard Load Balancer frontend to reach TCP 22 on one designated maintenance VM. That connection must not be load balanced across a pool. Which feature matches?
- A health probe without any forwarding configuration
- A load balancing rule targeting a backend pool of all VMs
- An inbound NAT rule mapping a frontend port to the chosen VM backend port
- An application gateway URL-path routing rule for TCP SSH
Explanation
Correct Answer
C:An inbound NAT rule provides port forwarding from a load balancer frontend port to the selected backend VM and port, without pooling that individual management connection.
Incorrect Answers
A:Health probes only assess backend health and cannot forward the requested SSH session.
B:A load balancing rule distributes eligible flows among backend instances, which is the opposite of reaching one designated maintenance VM.
D:Application Gateway URL routing operates at HTTP/HTTPS Layer 7, not arbitrary SSH TCP port forwarding.
Question 762
Two network virtual appliances sit behind an internal Azure Standard Load Balancer and must balance many changing TCP and UDP ports across identical backend instances. Maintaining one load-balancing rule per port is impractical. Which supported internal-load-balancer feature addresses this?
- Configure only an outbound SNAT rule with protocol All on a Standard Load Balancer and expect that rule to balance incoming NVA traffic across every TCP/UDP destination port
- An HA Ports load-balancing rule with the necessary supported frontend and backend design
- Create one standard load-balancing rule for port 443 and expect it to cover arbitrary TCP/UDP ports
- Use an inbound NAT rule for one NVA instance per port instead of a common all-port backend rule
Explanation
Correct Answer
B:HA Ports supports a broad all-port TCP/UDP load-balancing rule where supported, simplifying NVA-style multiport forwarding; it still requires correct health probes and backend routing design.
Incorrect Answers
A:An outbound rule governs SNAT of connections initiated by backend instances; it does not distribute inbound traffic to a healthy NVA backend pool. An internal Standard Load Balancer HA Ports inbound load-balancing rule targets all supported TCP/UDP ports.
C:A conventional load-balancing rule targets configured protocol/port mappings. It does not automatically include all the NVA’s dynamic ports.
D:Inbound NAT rules forward to selected instances and still require port-specific planning; they do not implement a single all-port balanced backend service.
Question 763
A Standard Load Balancer uses a TCP probe on port 443. The port accepts a connection, but the application responds with HTTP 500 to real requests. Why might the backend still appear healthy to the probe?
- TCP probes inspect the entire HTTP response body and accept only a 200 status
- Azure Load Balancer cannot probe TCP 443
- A healthy backend means every application endpoint responds correctly
- A successful TCP handshake meets the TCP probe even if application HTTP handling fails
Explanation
Correct Answer
D:A TCP probe establishes that the listener accepts a connection, not that a specific HTTP route returns success. Use an appropriate HTTP/HTTPS health endpoint to test the application layer.
Incorrect Answers
A:A TCP probe verifies connectivity to the port, not HTTP response semantics. It cannot conclude that an application route succeeds end-to-end.
B:TCP port probes are supported. The issue is that the selected protocol provides a weaker signal than an HTTP/HTTPS application health endpoint.
C:Load balancer health depends on the configured probe, which may be limited to port reachability. Application errors can remain invisible if the probe does not exercise them.
Question 764
A fleet of backend VMs uses a public Azure Standard Load Balancer for inbound traffic and a Load Balancer outbound rule for Internet egress. Its default outbound SNAT port allocation is exhausted under load. An approved design constraint prevents adding NAT Gateway, but the team can adjust this public Load Balancer and assign additional public frontend IPs. Which Load Balancer-specific configuration should it evaluate?
- Configure an outbound rule with manual SNAT-port allocation sized for the backend fleet and sufficient public frontend addresses; coordinate disableOutboundSnat on inbound rules sharing those frontend IPs
- Enable HA Ports on the inbound load-balancing rule because this automatically gives each backend additional outbound source NAT ports
- Increase the health probe frequency to produce more simultaneous probes and thereby enlarge the outbound SNAT port pool
- Change inbound session persistence from None to Client IP so the outbound rule automatically increases SNAT capacity per VM
Explanation
Correct Answer
A:Public Standard Load Balancer outbound rules let administrators choose manual SNAT port allocation and provision multiple public frontend addresses to increase the pool of usable outbound ports. Size those allocations against backend count and expected concurrency. If an inbound rule on the same frontend IP uses automatic outbound SNAT, disable that setting before letting the outbound rule control port allocation. NAT Gateway is ordinarily preferred for scale, but is explicitly unavailable here.
Incorrect Answers
B:HA Ports is an inbound transport rule that covers multiple TCP/UDP service ports for applications such as network virtual appliances. It does not itself expand the ephemeral SNAT port allocation of a Load Balancer outbound rule. The observed failure is outbound port exhaustion and requires changes to outbound translation capacity, not extra inbound port matching.
C:A health probe determines whether a backend can receive new incoming load-balanced flows. More frequent probes add health checks and cannot create new ephemeral outbound source ports. The fleet is already reaching outbound limits while sending Internet traffic; tune the SNAT allocation and frontend capacity rather than probe timing.
D:Client IP affinity changes how inbound flows from one source address are distributed across backend servers. It has no guarantee of increasing outbound translation port inventory. Outbound SNAT sizing is configured separately via outbound rules and available frontend public IPs, not through the inbound load-distribution hash mode.
Question 765
An Azure Standard Load Balancer distributes TCP connections across three identical servers. A manager assumes it can automatically keep all HTTP requests from one user on the same backend based on an application cookie. What is the limitation?
- Set session persistence to Client IP and assume this identifies a particular HTTP user cookie behind a shared corporate proxy
- Enable Floating IP on the load-balancing rule and assume the frontend IP rewrite makes it inspect application cookies
- Azure Load Balancer is Layer 4 and does not inspect HTTP cookies for application affinity
- Switch the load balancer health probe to HTTPS and assume it can pin requests based on a browser session cookie
Explanation
Correct Answer
C:Azure Load Balancer distributes transport flows using a five-tuple hash by default or configured Client IP variants. It does not parse HTTP cookie values and cannot guarantee per-browser-user affinity based on an application session cookie. A suitable HTTP-aware service or application-level session design is required when the identity of a browser session, rather than only its transport flow or source IP, controls routing.
Incorrect Answers
A:Client IP affinity uses network-layer source/destination address information, not an HTTP Cookie header. When many users share a proxy or NAT IP, the load balancer sees them as the same client address and cannot distinguish individual browser sessions. It may offer IP-based persistence but does not satisfy the specified per-user cookie-aware behavior.
B:Floating IP controls packet destination address translation for scenarios such as clustered listeners and port reuse. It does not turn a Layer 4 load-balancing rule into a Layer 7 parser or inspect cookies from application requests. The manager has confused direct-server-return mapping with application session affinity; the selected backend cannot be cookie-pinned that way.
D:An HTTPS health probe checks whether an application endpoint is healthy enough to receive new flows; it does not inspect each user request or maintain a cookie-to-backend lookup. Selecting a secure probe protocol changes backend eligibility checks, not the data-plane Layer 4 distribution algorithm or its lack of application-layer cookie parsing.
Question 766
A storage administrator must show how the transaction count on a storage account varied in five-minute intervals throughout the last hour. No inspection of individual operation messages is needed. Which Azure Monitor data category is most directly suited to this numerical time series?
- Platform metrics
- Per-request storage diagnostic logs exported and queried individually
- A storage account Cost Management forecast chart
- Activity Log resource-operation events for the storage account
Explanation
Correct Answer
A:Azure Monitor metrics store numeric time-series measurements for supported resources and can aggregate the transaction count by time interval. They suit a near-real-time utilization chart without examining individual log events.
Incorrect Answers
B:Diagnostic logs may support deeper investigations but impose log collection and query effort when a native transaction count metric already supplies the required aggregate time series.
C:Cost forecasts project billing trends rather than count requests in five-minute intervals. The chart would answer a different operational question.
D:Activity Log records management operations like configuration changes, not the data-plane transaction-count metric needed for interval utilization.
Question 767
A storage team observes rising overall transaction latency. It must isolate latency for one transaction category rather than aggregate all storage operations. A relevant Azure Monitor metric exposes API-name or operation-type dimensions. How should it analyze the signal?
- Use only the Azure subscription display name as a chart axis
- Disable diagnostic logging on the account to make the metric specific
- Filter or split the supported metric by the relevant dimension value
- Replace the storage-account redundancy type with LRS before viewing the metric
Explanation
Correct Answer
C:A metric dimension segments a numeric time series by properties such as operation or API type. It lets the analyst distinguish the affected operations without relying on one aggregate.
Incorrect Answers
A:A subscription name is management metadata and not the advertised metric dimension identifying the storage operation category.
B:Turning off logs does not isolate a dimension value in metrics. It also removes other useful investigative evidence.
D:Replication configuration changes durability and may create risk but does not provide the missing dimensional breakdown of the existing latency metric.
Question 768
An operator needs an overview of VM CPU utilization during a current load spike. The team has not configured custom guest-event collection and does not need individual process events. Which Azure Monitor data type is most direct?
- The platform CPU percentage metric chart for the virtual machine
- Only an Azure Activity Log export of subscription administrative events
- Query only the guest Perf table in Log Analytics even though no VM guest performance collection has been configured
- Use VM insights guest-memory counters as the substitute for the virtual machine’s platform CPU percentage metric during this load spike
Explanation
Correct Answer
A:Azure platform metrics provide numerical time-series measurements such as VM CPU usage. They can be charted without first collecting arbitrary guest process log records.
Incorrect Answers
B:Activity Log tracks management-plane events, not the continuous CPU utilization series needed to inspect the current workload.
C:The Perf table depends on appropriate guest performance collection into the workspace. With no guest collection configured, it is not the direct source of a current platform VM CPU series. Azure emits the VM Percentage CPU platform metric independently; the Metrics chart is the immediate appropriate data source for the requested live workload overview.
D:Guest memory counters describe memory use inside the VM operating system; they are not the direct platform CPU utilization signal requested. The CPU Percentage metric is already emitted by Azure for the VM without custom guest-event collection and can be charted immediately. Guest collection adds a different data source rather than replacing the CPU chart.
Question 769
An Azure VM CPU chart shows a daily average of only 35%, yet latency coincides with brief CPU saturation. The team wants the monitoring view to preserve the peak value in each one-minute interval rather than smoothing spikes. Which aggregation should be selected?
- Average over one-hour intervals
- Count aggregation on the one-minute Percentage CPU time series
- Maximum aggregation with a suitably fine time grain
- Sum aggregation of all Percentage CPU samples over the full day
Explanation
Correct Answer
C:Maximum reports the highest sampled value per interval, retaining brief peaks that are diluted by average. A fine time grain supports correlation with short latency events.
Incorrect Answers
A:Averaging across long windows will smooth short spikes and may hide the very saturation episodes the team needs to identify.
B:Count reports how many metric samples are present, not the highest utilization in the interval. It cannot reveal whether a brief CPU peak reached saturation.
D:Summing percentage observations across time generates a cumulative number that does not represent the maximum instantaneous utilization. It may mask or distort the peak the team needs.
Question 770
An API gateway’s overall Failed Requests metric increased. The resource publishes ResponseCode as a supported metric dimension, and the team needs to identify which response codes account for the rise. What should the analyst do?
- Set every displayed metric aggregation to Sum without dimensions
- Split or filter the metric by its ResponseCode dimension in Metrics Explorer
- Filter the metric series by VM resource ID rather than the advertised ResponseCode dimension
- Add a second metric chart using the same total Failed Requests measure without a dimension filter
Explanation
Correct Answer
B:Metric dimensions partition measurements by provider-defined attributes. Splitting on ResponseCode exposes which category contributes to the aggregate failure trend.
Incorrect Answers
A:Changing aggregation may show a total count but does not separate the response-code categories. The cause remains hidden in a combined series.
C:A resource filter narrows which resources contribute data but does not divide one API gateway’s observations by HTTP response code. The diagnostic dimension is the discriminating signal.
D:A duplicate unsegmented chart still mixes failures of different response codes. It cannot reveal whether 401, 429 or 500-class responses dominate.
Microsoft Azure Administrator (AZ-104) Practice Tests