Pass Microsoft AZ-104 Exam in First Attempt Guaranteed!

Subnet-level Any destination can affect multiple servers. Matching the intended destination prevents overly broad access. This matters here because a VM recently moved to a different ASG but traffic still follows old expected permissions.

Enabling a service endpoint alone does not authorize a subnet in every storage account. The service firewall must allow it. This matters here because a VM recently moved to a different ASG but traffic still follows old expected permissions.

Azure resource tags and application security group membership are separate constructs. Tags cannot substitute for joining an ASG.

A TCP probe confirms a listener exists, not that the application is functioning correctly. HTTP health can signal failures beyond port acceptance.

A public DNS A record is resolvable by external clients and does not deliver private VNet-scoped resolution. Configure an Azure Private DNS zone with the necessary VNet links and private records.

Azure VNets can use custom DNS servers for name resolution. The resolver must be reachable and able to resolve required Azure zones.

Internal load balancers use private VNet address exposure for backend distribution rather than a public Internet endpoint.

Resolution differences between VNets normally call for examining Private DNS virtual-network links and DNS forwarding settings. Public records do not repair missing private-zone visibility.

Azure VNets can use custom DNS servers for name resolution. The resolver must be reachable and able to resolve required Azure zones. This matters here because a linked private zone resolves in VNet A but not VNet B.

Outbound SNAT is distinct from inbound load balancing. Supported outbound mechanisms and their precedence must be planned.

Public Azure DNS zones provide authoritative records; registrar delegation makes Internet resolvers query those servers.

A CNAME can target the app's azurewebsites.net hostname, while App Service requires an explicit custom-hostname binding.

Guest network leases can retain prior DNS server information. Updating VNet settings may not immediately update every running guest.

Private DNS provides internal record resolution for associated VNets. Publishing the names in a public zone could expose internal topology. This matters here because an Azure VM queries a configured custom DNS server for an internal application hostname. The authoritative private….

The VM is querying its configured private resolver, not the public Azure DNS zone for this internal hostname. An unrelated public-zone edit would not refresh that custom DNS source.

A CNAME can target the app's azurewebsites.net hostname, while App Service requires an explicit custom-hostname binding. This matters here because an Azure-hosted website uses a vendor hostname instead of a fixed IP and needs an alias. Which DNS record can point….

Private IP addresses cannot be simultaneously assigned to conflicting Azure resources in the same subnet. The frontend must be unique.

An A record is an address mapping; a service that changes its IP behind a stable vendor hostname normally calls for a CNAME at a supported alias name, subject to provider mapping requirements.

A scheduled log query cannot plot the requested platform CPU trend unless that signal is ingested. The VM CPU Percentage platform metric is already available through Azure Monitor Metrics without a custom agent.

Workbooks are presentation surfaces that need an explicit data source. Without binding the CPU Percentage metric or a populated log query, the workbook will not display the five-minute CPU trend.

Activity Log records subscription/resource operations rather than normal CPU utilization samples. Read the VM's Azure Monitor platform CPU metric over the relevant five-minute interval.

End-to-end latency includes the broader request path, while server latency measures service-side processing. Their difference may indicate network or client effects.

Azure Monitor Agent collects configured guest telemetry through data collection rules into supported destinations.

Workbooks combine Azure Monitor data into reusable interactive views. They do not by themselves apply resource configuration changes.

Host metrics do not supply every guest syslog or process event. Configure the Azure Monitor Agent and a supported DCR targeting the desired guest log sources and workspace.

App Service exposes service-specific request signals. A VM CPU threshold alone cannot detect all web response failures.

VM insights provides curated performance and dependency monitoring where supported. Data collection and permissions must be configured.

Agent presence alone does not define which Syslog facilities or severities are collected. Verify the rule association, source selectors and Log Analytics destination.

Queries can return only collected records. An empty table may be a collection problem rather than a KQL syntax failure.

CPU metrics cannot establish whether an underlying Azure service incident occurred. Platform health sources provide contextual evidence.

Flow logging records network connection metadata for analysis and troubleshooting. It is not a full packet payload capture.

Log search alerts evaluate returned query data on configured schedules. Metric alerts target numeric metric signals.

Budgets track money rather than identifying which principal called a VM management operation. The Azure Activity Log records relevant resource control-plane events and actors.