Pass Microsoft AZ-104 Exam in First Attempt Guaranteed!

VNet peering directly connects peers, but does not automatically turn a hub into a transit router for all spokes.

CIDR overlap fixes affect reachability, not billing geography. Global VNet peering still carries the applicable cross-region transfer costs and latency considerations.

Packet forwarding controls whether a virtual appliance can relay transit traffic; it has no effect on Azure's interregional peering meter. Global VNet peering remains cross-region and its data-transfer charges and latency require separate planning.

A scoped UDR affects only matching destinations, keeping unrelated routing unchanged. Overly broad 0.0.0.0/0 routes can affect all egress.

VNet peering directly connects peers, but does not automatically turn a hub into a transit router for all spokes. This matters here because a spoke VNet already contains its own VPN virtual network gateway. Its administrator tries to select Use remote….

Forwarded-traffic peering settings can permit transit traffic, but they do not permit a VNet to use both its own gateway and a peered remote gateway simultaneously.

Network Watcher can test reachability and identify routing or filtering causes. ICMP success alone does not guarantee the application port works.

Removing a public IP can eliminate an implicit egress path. VNet connectivity alone does not guarantee outbound Internet reachability.

Spoke-to-hub peering does not automatically create spoke-to-spoke transitive routing. A routing service or topology change is needed.

Gateway-learned routes can appear in subnet effective routes under supported propagation and topology. A random public IP rule cannot establish private routing. This matters here because a network administrator needs to route application subnet traffic through a third-party firewall appliance. Which….

The /25 occupies part of the /24 range. Azure subnet definitions cannot overlap even if they have different names. This matters here because a network administrator needs to route application subnet traffic through a third-party firewall appliance. Which….

User-defined routes can override applicable system routes by prefix specificity and source priority. An NSG rule does not choose next hops.

Peering connectivity does not override security rules or guest firewalls. Connected peering is a network relationship, not authorization to every port. This matters here because a subnet route table sends traffic to a virtual appliance but packets are dropped. What VM setting is important.

Suppressing propagated gateway routes can remove learned destinations from effective tables. Custom routing must replace them explicitly if suppression is intentional. This matters here because a subnet route table sends traffic to a virtual appliance but packets are dropped. What VM setting is important.

A route table has no effect until associated with the source subnet. Effective route inspection shows the selected next hop. This matters here because a subnet route table sends traffic to a virtual appliance but packets are dropped. What VM setting is important.

Both subnet and NIC NSGs can restrict connectivity. One allow rule does not override a deny in another applicable group. This matters here because a security operator must determine why traffic is blocked after multiple NSG assignments. Which built-in view helps.

Spoke-to-spoke transit is not implicit. Both routing and peering permission for forwarded packets must align.

ASGs group supported NIC configurations for use as security rule source or destination. Membership changes avoid editing IP lists. This matters here because a security operator must determine why traffic is blocked after multiple NSG assignments. Which built-in view helps.

A private endpoint for one storage subresource does not privately expose all others. Each required endpoint must be planned.

A deny on an applicable NIC or subnet NSG can block traffic even if another NSG has an allow. Azure doesn't union permissions across independent filters.

NSG priorities process lower numbers first; evaluation stops at the first matching rule. An allow at a later priority cannot override an earlier match. This matters here because an engineer adds an allow on a NIC NSG, but traffic remains blocked by a subnet rule. What principle applies.

Private management paths reduce the VM's direct attack surface. SSH keys alone do not make a public SSH endpoint private. This matters here because an administrator must connect to Azure VMs by RDP without assigning each guest a public IP. Which service is suitable.

The guest itself does not require an Internet-facing address. Bastion is the controlled management entry point.

Private endpoints provide network-level private addresses for supported service resources. Public service endpoints may not meet private-only policy.

Service endpoints extend subnet identity for supported PaaS firewall rules without assigning private endpoints.

Network filtering can occur at several layers. Deleting one NSG cannot override an independent NIC or guest firewall block.

A particular allow evaluated before the default deny admits only the intended port/source combination. Removing the default deny would widen exposure.

Private endpoints provide network-level private addresses for supported service resources. Public service endpoints may not meet private-only policy. This matters here because a security team wants VM administrators to use private SSH while preventing direct Internet exposure of TCP 22. What….

A Storage private endpoint changes the storage service path, not administrative SSH reachability to the VM. Remove public SSH exposure and use Bastion or another authorized private management path.

Azure SQL private networking protects database connectivity; it does not hide TCP 22 on a VM. The remote-administration ingress path must be redesigned independently.

Private endpoint plus public access restriction narrows the service's exposed network paths. An NSG on the client subnet alone is not equivalent.

Network filtering can occur at several layers. Deleting one NSG cannot override an independent NIC or guest firewall block. This matters here because an Azure VM with no public IP is still reached through Bastion. What transport distinction explains it.

A private endpoint can remain unusable until the target service accepts the connection. DNS and routes should be validated after approval.