Microsoft AZ-104 Practice Test 37
Question 360
An ACI deployment asks for more memory than the selected region's allowed container-group capacity. What should be checked?
- Inspect external ingress flags and the environment's public network exposure.
- Validate container CPU and memory requests against current regional resource quotas.
- Validate the cron expression and time-zone interpretation of Container Apps job scheduling.
- Deploy a container group using Azure Container Instances.
Explanation
Correct Answer
B:ACI deployment is constrained by supported resource shapes and subscription quota. A correct container image cannot overcome unavailable capacity.
Incorrect Answers
A:Ingress type determines the application's network audience. A private app should not have unintended public routing.
C:Schedules are evaluated according to the service's documented clock semantics. A local-time assumption can shift an execution window.
D:ACI runs isolated container workloads without maintaining a cluster control plane. It is appropriate for simple short-duration tasks.
Question 361
A validated staging build must become the production App Service build with minimal cutover disruption. What deployment operation is appropriate?
- Perform a supported deployment slot swap after validating slot-specific settings and warm-up.
- Mark environment-specific connection strings as deployment slot settings.
- Scale up the App Service plan to a larger supported compute tier or instance.
- Use App Service application settings with appropriate deployment-slot stickiness.
Explanation
Correct Answer
A:Slot swapping promotes the candidate release while allowing preparatory warm-up. This is safer than deleting and recreating the application.
Incorrect Answers
B:Sticky settings remain associated with their slot and avoid swapping protected environment values along with application content. This matters here because a validated staging build must become the production App Service build with minimal cutover disruption. What….
C:Vertical scaling increases per-worker resources, unlike adding more workers. Plan limits and compatibility must be reviewed. This matters here because a validated staging build must become the production App Service build with minimal cutover disruption. What….
D:App settings are injected into the runtime environment and can be marked slot-specific. Image baking is unsuitable for secrets.
Question 362
After a slot swap the old production version is needed urgently. Which rollback path is available?
- Validate staging content, warm-up requests, sticky settings and target routing before slot swap.
- Use App Service application settings with appropriate deployment-slot stickiness.
- Link the appropriate privatelink.azurewebsites.net private DNS records to client VNets.
- Swap back to the prior stable slot when the retained revision and configuration allow it.
Explanation
Correct Answer
D:Slots can preserve the previous production build after a swap. Their configuration must be checked before a reverse swap.
Incorrect Answers
A:A slot swap changes production-visible content under specified configuration rules. Testing prevents silent database or routing mismatches.
B:App settings are injected into the runtime environment and can be marked slot-particular. Image baking is unsuitable for secrets.
C:Private routing requires the standard hostname to resolve to the private endpoint address. Endpoint connection without DNS integration is insufficient. This matters here because after a slot swap the old production version is needed urgently. Which rollback path is available.
Question 363
A company wants customers to reach an App Service app at portal.example.com. What must be configured?
- Create and approve an App Service private endpoint for inbound client traffic.
- Bind a valid TLS certificate to the custom hostname using a supported App Service method.
- Verify the certificate SAN or common-name coverage and hostname-specific TLS binding.
- Verify the custom domain's DNS records and bind the hostname to the App Service app.
Explanation
Correct Answer
D:DNS and App Service hostname mapping work together. A DNS record alone does not authorize the platform to serve the hostname.
Incorrect Answers
A:Private endpoints provide private network ingress to supported App Service apps. Regional VNet integration is for outbound app calls.
B:TLS bindings present the domain's certificate to clients and authenticate the endpoint. HTTPS-only settings alone cannot supply a trusted certificate.
C:A certificate must match the requested host. A correct default endpoint certificate does not automatically cover a custom domain.
Question 364
A DNS CNAME points correctly at azurewebsites.net but the custom hostname returns an App Service site not found response. What is missing?
- Verify the certificate SAN or common-name coverage and hostname-specific TLS binding.
- Configure private inbound access or appropriate App Service access restrictions separately.
- Bind a valid TLS certificate to the custom hostname using a supported App Service method.
- Check the custom hostname binding and domain ownership validation on the app.
Explanation
Correct Answer
D:Routing a domain to the service endpoint is not enough; App Service must recognize the hostname for the intended web app.
Incorrect Answers
A:A certificate must match the requested host. A correct default endpoint certificate does not automatically cover a custom domain. This matters here because a DNS CNAME points correctly at azurewebsites.net but the custom hostname returns an App Service site not found….
B:Outbound VNet integration does not inherently make an App Service web endpoint private. Inbound restrictions are a different feature.
C:TLS bindings present the domain's certificate to clients and authenticate the endpoint. HTTPS-only settings alone cannot supply a trusted certificate. This matters here because a DNS CNAME points correctly at azurewebsites.net but the custom hostname returns an App Service site not found….
Question 365
An App Service custom domain needs trusted HTTPS encryption and identification. Which binding should be configured?
- Verify the custom domain's DNS records and bind the hostname to the App Service app.
- Bind a valid TLS certificate to the custom hostname using a supported App Service method.
- Check the custom hostname binding and domain ownership validation on the app.
- Inspect active autoscale profiles and rules that control the plan's capacity.
Explanation
Correct Answer
B:TLS bindings present the domain's certificate to clients and authenticate the endpoint. HTTPS-only settings alone cannot supply a trusted certificate. This matters here because an App Service custom domain needs trusted HTTPS encryption and identification. Which binding should be configured.
Incorrect Answers
A:DNS and App Service hostname mapping work together. A DNS record alone does not authorize the platform to serve the hostname. This matters here because an App Service custom domain needs trusted HTTPS encryption and identification. Which binding should be configured.
C:Routing a domain to the service endpoint is not enough; App Service must recognize the hostname for the intended web app. This matters here because an App Service custom domain needs trusted HTTPS encryption and identification. Which binding should be configured.
D:Automatic scaling can override manual counts according to configured profiles. The effective autoscale policy must align with the event plan. This matters here because an App Service custom domain needs trusted HTTPS encryption and identification. Which binding should be configured.
Question 366
An uploaded certificate works for the default hostname but browsers reject the custom domain certificate. What should be checked?
- Verify the custom domain's DNS records and bind the hostname to the App Service app.
- Enable Always On on a hosting tier that supports the feature.
- Check the custom hostname binding and domain ownership validation on the app.
- Verify the certificate SAN or common-name coverage and hostname-specific TLS binding.
Explanation
Correct Answer
D:A certificate must match the requested host. A correct default endpoint certificate does not automatically cover a custom domain. This matters here because an uploaded certificate works for the default hostname but browsers reject the custom domain certificate.
Incorrect Answers
A:DNS and App Service hostname mapping work together. A DNS record alone does not authorize the platform to serve the hostname. This matters here because an uploaded certificate works for the default hostname but browsers reject the custom domain certificate.
B:Always On sends periodic requests to keep the app loaded, reducing cold starts for applicable plans.
C:Routing a domain to the service endpoint is not enough; App Service must recognize the hostname for the intended web app. This matters here because an uploaded certificate works for the default hostname but browsers reject the custom domain certificate.
Question 367
A route table already contains the appropriate user-defined route to a firewall, but VMs in a newly created subnet still follow the Azure system Internet route for that destination. What configuration step is missing?
- Inspect the route table's subnet association and effective routes on the VM NIC.
- Enable gateway transit on the hub peering and remote gateway use on the spoke peering where supported.
- Associate a route table containing the desired user-defined routes with the subnet.
- Create another user-defined route to the firewall in a route table that is not associated with the affected subnet.
Explanation
Correct Answer
C:User-defined routes can override applicable system routes by prefix particularity and source priority. An NSG rule does not choose next hops.
Incorrect Answers
A:A route table has no effect until associated with the source subnet. Effective route inspection shows the selected next hop. This matters here because a route table already contains the appropriate user-defined route to a firewall, but VMs in a newly created subnet….
B:Gateway transit permits a spoke to use a hub gateway under supported topology constraints. Peering alone does not automatically grant remote gateway use.
D:Adding the route to an unassociated route table does not affect the subnet effective routes. The existing table must be associated with the source subnet before its UDR can participate in routing decisions.
Question 368
A packet to 10.1.8.10 uses a /24 UDR rather than a /16 system route. Why?
- Use supported BGP-propagated gateway routes with appropriate virtual network gateway configuration.
- Re-enable gateway route propagation where on-premises connectivity is required.
- Review the source NIC's effective routes and the matching user-defined route.
- Longest-prefix match selects the most specific matching effective route.
Explanation
Correct Answer
D:A /24 destination match is more specific than /16. Effective routing chooses the longest matching prefix before considering source tie-breaking.
Incorrect Answers
A:Gateway-learned routes can appear in subnet effective routes under supported propagation and topology. A random public IP rule cannot establish private routing. This matters here because a packet to 10.1.8.10 uses a /24 UDR rather than a /16 system route. Why.
B:Suppressing propagated gateway routes can remove learned destinations from effective tables. Custom routing must replace them explicitly if suppression is intentional. This matters here because a packet to 10.1.8.10 uses a /24 UDR rather than a /16 system route. Why.
C:Effective routes show which prefix and next hop govern a destination. A VM's subnet attachment does not reveal overrides by itself. This matters here because a packet to 10.1.8.10 uses a /24 UDR rather than a /16 system route. Why.
Question 369
A VNet contains 10.4.0.0/16, but a subnet is specified as 10.5.1.0/24. Why does subnet provisioning fail?
- Split the requested 10.5.1.0/24 into smaller prefixes and expect them to fit a VNet declared as 10.4.0.0/16.
- Select a subnet prefix within the VNet's declared 10.4.0.0/16 space.
- Accept 10.5.1.0/24 because it is private RFC1918 space even though the VNet is 10.4.0.0/16.
- Explicitly design forwarded traffic and routes because VNet peering is nontransitive by default.
Explanation
Correct Answer
B:A subnet must be fully contained within one of the VNet address prefixes. Private addressing alone does not make the prefix eligible. This matters here because a VNet contains 10.4.0.0/16, but a subnet is specified as 10.5.1.0/24. Why does subnet provisioning fail.
Incorrect Answers
A:Shrinking a prefix within 10.5.0.0/16 doesn't move it into 10.4.0.0/16. Choose a subnet address contained in the actual parent range.
C:Private-address classification doesn't make a prefix part of the parent network. The chosen 10.5.1.0/24 lies outside the configured 10.4.0.0/16 range.
D:VNet peering directly connects peers, but does not automatically turn a hub into a transit router for all spokes. This matters here because a VNet contains 10.4.0.0/16, but a subnet is specified as 10.5.1.0/24. Why does subnet provisioning fail.
Question 370
An engineer adds an overlapping address block to a VNet and gets an error. What constraint applies?
- Enable global VNet peering as a workaround for overlapping address prefixes inside a single VNet.
- Use nonoverlapping VNet address prefixes and check peering conflicts.
- Enable forwarding on the VNet's first VM instead of correcting its overlapping CIDR address spaces.
- Remove overlapping subnet definitions and choose disjoint CIDR blocks.
Explanation
Correct Answer
B:A VNet cannot contain conflicting address spaces in ways that undermine subnet allocation and routing. Peering also requires unique address planning.
Incorrect Answers
A:Peering connects different VNets and cannot legitimize two overlapping address-space blocks in one VNet. Correct the duplicated or intersecting prefixes before creating subnets.
C:Guest packet forwarding cannot make overlapping VNet address ranges routable or permit conflicting peering prefixes. Choose nonoverlapping network ranges, including connected networks, before applying the VNet address-space change.
D:The /25 occupies part of the /24 range. Azure subnet definitions cannot overlap even if they have different names. This matters here because an engineer adds an overlapping address block to a VNet and gets an error. What constraint applies.
