Microsoft AZ-104 Practice Test 27
Question 260
A job in ACI exits successfully but repeatedly starts again, causing duplicate data imports. What setting is wrong?
- Switch an unrelated Container Apps endpoint to internal ingress to stop an Azure Container Instances job from restarting.
- Deploy the container group into an eligible delegated VNet subnet under supported integration.
- Review the container group's restartPolicy and use Never or OnFailure as appropriate.
- Reduce requested resources or request an eligible regional ACI quota increase.
Explanation
Correct Answer
C:ACI restart policy determines whether completed jobs restart. Always is inappropriate for a one-time successful batch task.
Incorrect Answers
A:ACI restart behavior is controlled by its container-group restart policy. Internal HTTP ingress on another service cannot prevent duplicate job runs.
B:ACI VNet integration uses supported subnet configuration to give the group private connectivity. A private registry alone does not connect it to a VNet.
D:Local Docker execution does not test Azure subscription quota. Deployment requires Azure-side capacity authorization. This matters here because a job in ACI exits successfully but repeatedly starts again, causing duplicate data imports. What setting is wrong.
Question 261
A marketing event requires twice as many App Service workers for a predictable few-hour surge. What capacity operation is appropriate?
- Scale out the App Service plan to the desired supported instance count.
- Schedule a backup before the event and expect it to double the number of active App Service workers.
- Create an App Service plan in the desired region and supported pricing tier.
- Scale up the App Service plan to a larger supported compute tier or instance.
Explanation
Correct Answer
A:Horizontal scaling increases the number of workers serving the app. It is distinct from increasing each instance's size. This matters here because a marketing event requires twice as many App Service workers for a predictable few-hour surge. What capacity….
Incorrect Answers
B:Backup captures application state; it does not change compute capacity. Use scale-out or a supported autoscale configuration to meet peak concurrency.
C:The plan determines worker capacity, scaling limits and available features for hosted apps. A web app does not independently allocate a VM per site. This matters here because a marketing event requires twice as many App Service workers for a predictable few-hour surge. What capacity….
D:Vertical scaling increases per-worker resources, unlike adding more workers. Plan limits and compatibility must be reviewed. This matters here because a marketing event requires twice as many App Service workers for a predictable few-hour surge. What capacity….
Question 262
An App Service app's manually raised instance count resets after an autoscale rule evaluates. Why?
- Review access restriction rules for the expected upstream service address or service tag configuration.
- Configure App Service access restrictions to allow approved source addresses and deny the rest.
- Configure metric-based App Service plan autoscale rules with safe minimum and maximum capacity.
- Inspect active autoscale profiles and rules that control the plan's capacity.
Explanation
Correct Answer
D:Automatic scaling can override manual counts according to configured profiles. The effective autoscale policy must align with the event plan.
Incorrect Answers
A:A reverse proxy changes the observed source path. The app's inbound allow rules must reflect the trusted upstream in a supported manner. This matters here because an App Service app's manually raised instance count resets after an autoscale rule evaluates. Why.
B:Access restrictions evaluate inbound request sources at the App Service boundary. TLS certificates protect transport, not source eligibility.
C:Autoscale evaluates supported metrics and can adjust worker count under configured thresholds. It requires a plan that supports autoscale. This matters here because an App Service app's manually raised instance count resets after an autoscale rule evaluates. Why.
Question 263
A web app should add instances automatically when average CPU remains high over several minutes. Which automation fits?
- Plan database-specific backup and restore consistency in addition to App Service backup.
- Configure metric-based App Service plan autoscale rules with safe minimum and maximum capacity.
- Inspect active autoscale profiles and rules that control the plan's capacity.
- Inspect managed identity selection, secret permission and vault networking for the reference.
Explanation
Correct Answer
B:Autoscale evaluates supported metrics and can adjust worker count under configured thresholds. It requires a plan that supports autoscale. This matters here because a web app should add instances automatically when average CPU remains high over several minutes. Which automation fits.
Incorrect Answers
A:App Service backup does not automatically guarantee consistent recovery of every external database. Dependencies need coordinated RPO and RTO. This matters here because a web app should add instances automatically when average CPU remains high over several minutes. Which automation fits.
C:Automatic scaling can override manual counts according to configured profiles. The effective autoscale policy must align with the event plan. This matters here because a web app should add instances automatically when average CPU remains high over several minutes. Which automation fits.
D:A correct secret URI is only one prerequisite. Key Vault references require authorized network reachability and identity permissions.
Question 264
An autoscale rule repeatedly adds and removes instances around one threshold. What should be adjusted?
- Plan database-specific backup and restore consistency in addition to App Service backup.
- Review access restriction rules for the expected upstream service address or service tag configuration.
- Tune threshold separation, aggregation windows and cooldown to prevent oscillation.
- Inspect active autoscale profiles and rules that control the plan's capacity.
Explanation
Correct Answer
C:Scale-in and scale-out should not react to the same short-lived noise. Cooldowns and hysteresis reduce resource churn.
Incorrect Answers
A:App Service backup does not automatically guarantee consistent recovery of every external database. Dependencies need coordinated RPO and RTO. This matters here because an autoscale rule repeatedly adds and removes instances around one threshold.
B:A reverse proxy changes the observed source path. The app's inbound allow rules must reflect the trusted upstream in a supported manner. This matters here because an autoscale rule repeatedly adds and removes instances around one threshold.
D:Automatic scaling can override manual counts according to configured profiles. The effective autoscale policy must align with the event plan. This matters here because an autoscale rule repeatedly adds and removes instances around one threshold.
Question 265
A team needs to test an upcoming App Service release at a separate hostname before customers receive it. Which feature supports this?
- Run a backup of production and treat its archive as an independently reachable pre-release staging hostname.
- Create a staging deployment slot in a supported App Service plan.
- Change the production app's custom hostname and treat it as an isolated test deployment.
- Perform a supported deployment slot swap after validating slot-specific settings and warm-up.
Explanation
Correct Answer
B:Deployment slots provide separate running release environments for validation and controlled cutover. They share the plan's underlying compute.
Incorrect Answers
A:A backup cannot execute the next build at a separate web address. A supported App Service deployment slot provides a live staging endpoint for pre-release testing.
C:A second hostname on the same production app does not isolate a new release. A supported deployment slot has its own hostname and release content for preproduction validation.
D:Slot swapping promotes the candidate release while allowing preparatory warm-up. It is safer than deleting and recreating the application.
Question 266
A staging slot uses a test database but a slot swap transfers its connection string into production. Which property was missing?
- Link the appropriate privatelink.azurewebsites.net private DNS records to client VNets.
- Mark environment-specific connection strings as deployment slot settings.
- Leave the test database connection string as a swappable setting so it follows staging content into production.
- Inspect deployment slot setting flags for all environment-specific secrets and connection strings.
Explanation
Correct Answer
B:Sticky settings remain associated with their slot and avoid swapping protected environment values along with application content.
Incorrect Answers
A:Private routing requires the standard hostname to resolve to the private endpoint address. Endpoint connection without DNS integration is insufficient.
C:A connection string that travels with staging can accidentally move test-database credentials to the production slot. Mark environment-specific connection strings as deployment slot settings.
D:Sticky configuration distinguishes production and staging dependencies. Swapping nonsticky connections can produce incorrect environment access. This matters here because a staging slot uses a test database but a slot swap transfers its connection string into production. Which property….
Question 267
A company wants VNet A and VNet B in the same region to communicate privately using Azure's network backbone. Which link is appropriate?
- Configure virtual network peering between the nonoverlapping VNets.
- Create an Azure Private DNS zone and link the authorized VNets.
- Review the source NIC's effective routes and the matching user-defined route.
- Use global VNet peering with supported nonoverlapping address spaces.
Explanation
Correct Answer
A:VNet peering connects private Azure address spaces without routing through public internet endpoints. NSG and UDR conditions still apply.
Incorrect Answers
B:Private DNS zones resolve within linked VNets rather than publishing records to the Internet. Links and resolver paths control client reachability.
C:Effective routes show which prefix and next hop govern a destination. A VM's subnet attachment does not reveal overrides by itself.
D:Global peering connects VNets in different regions over Microsoft's backbone. Costs and special limitations must be reviewed.
Question 268
VMs in peered VNets cannot reach each other even though peering shows Connected. What should be evaluated?
- Inspect effective NSG rules, user-defined routes and guest firewall on both ends.
- Renumber one network or use a supported translation architecture outside ordinary VNet peering.
- Inspect hub Allow gateway transit and spoke Use remote gateways settings plus effective routes.
- Review the source NIC's effective routes and the matching user-defined route.
Explanation
Correct Answer
A:Peering connectivity does not override security rules or guest firewalls. Connected peering is a network relationship, not authorization to every port.
Incorrect Answers
B:Ordinary Azure VNet peering does not address overlapping address spaces by itself. Distinct reachable prefixes are needed.
C:A spoke must opt into supported remote gateway use. Gateway advertisements and route tables also determine reachability.
D:Effective routes show which prefix and next hop govern a destination. A VM's subnet attachment does not reveal overrides by itself. This matters here because vMs in peered VNets cannot reach each other even though peering shows Connected.
Question 269
A company needs to peer VNets across different Azure regions using Microsoft's backbone. Which feature fits?
- Use global VNet peering with supported nonoverlapping address spaces.
- Use 10.2.2.0/25 and 10.2.2.128/25 as the two nonoverlapping child subnets.
- Permit overlapping VNet CIDR prefixes because global peering automatically translates duplicate source addresses.
- Use only same-region VNet peering and assume cross-region VNet connections are not supported.
Explanation
Correct Answer
A:Global peering connects VNets in different regions over Microsoft's backbone. Costs and special limitations must be reviewed. This matters here because a company needs to peer VNets across different Azure regions using Microsoft's backbone. Which feature fits.
Incorrect Answers
B:Two /25 blocks partition the /24 address space exactly. Their network boundaries align with the prefix size.
C:Global VNet peering still requires nonoverlapping address spaces; it does not translate colliding CIDR prefixes.
D:Standard same-region-only assumptions do not satisfy the requirement to peer VNets across different Azure regions. Global VNet peering enables that supported cross-region connection.
Question 270
An administrator assumes global VNet peering makes every resource region-local and removes cross-region traffic costs. What must be explained?
- Explicitly design forwarded traffic and routes because VNet peering is nontransitive by default.
- Renumber all participating VNets and assume global peering becomes free of interregional traffic charges.
- Review global peering data transfer charges and latency because regions remain separate.
- Enable guest packet forwarding on an unrelated VM and assume it eliminates global peering egress charges.
Explanation
Correct Answer
C:Global peering joins network paths, not physical locations. Cross-region transfer and latency considerations still apply. This matters here because an administrator assumes global VNet peering makes every resource region-local and removes cross-region traffic costs.
Incorrect Answers
A:VNet peering directly connects peers, but does not automatically turn a hub into a transit router for all spokes.
B:CIDR overlap fixes affect reachability, not billing geography. Global VNet peering still carries the applicable cross-region transfer costs and latency considerations.
D:Packet forwarding controls whether a virtual appliance can relay transit traffic; it has no effect on Azure's interregional peering meter. Global VNet peering remains cross-region and its data-transfer charges and latency require separate planning.
