Microsoft AZ-104 Practice Test 39
Question 380
A VM reaches an Azure SQL private endpoint IP but fails to resolve the server's name. What should be checked?
- Link and verify the corresponding privatelink private DNS zone for the client VNet.
- Provision and resolve a blob private endpoint separately if blob private access is required.
- Inspect privatelink.database.windows.net DNS integration and resolver behavior.
- Organize VM NICs into application security groups and use ASG-based NSG rules.
Explanation
Correct Answer
C:A private endpoint needs matching DNS to direct standard SQL hostnames to its private address. IP reachability alone is insufficient for normal clients.
Incorrect Answers
A:Private endpoint access depends on name resolution to the private address. Connection approval does not create correct DNS in every client network. This matters here because a VM reaches an Azure SQL private endpoint IP but fails to resolve the server's name.
B:A private endpoint for one storage subresource does not privately expose all others. Each required endpoint must be planned. This matters here because a VM reaches an Azure SQL private endpoint IP but fails to resolve the server's name.
D:ASGs express tier-oriented source and destination membership for supported Azure NICs. They do not replace the NSG rule engine.
Question 381
A database cluster must distribute TCP connections only to clients inside its VNet. Which load balancer type is appropriate?
- Choose an unused private address inside the associated subnet for the frontend.
- Check whether a corresponding TCP 80 load-balancing rule exists and matches the frontend.
- Configure an internal Azure Load Balancer with a private frontend IP.
- Configure a static private frontend IP from an available address in the selected subnet.
Explanation
Correct Answer
C:Internal load balancers use private VNet address exposure for backend distribution rather than a public Internet endpoint. This matters here because a database cluster must distribute TCP connections only to clients inside its VNet. Which load balancer type is….
Incorrect Answers
A:Private IP addresses cannot be simultaneously assigned to conflicting Azure resources in the same subnet. The frontend must be unique. This matters here because a database cluster must distribute TCP connections only to clients inside its VNet. Which load balancer type is….
B:Load balancer rules are port-specific. A valid HTTPS mapping does not automatically establish a separate HTTP listener.
D:A static frontend gives internal clients a predictable service endpoint. Dynamic allocation can complicate fixed service references.
Question 382
An internal load balancer cannot be reached from an arbitrary Internet client. Why is that expected?
- Create a CNAME record for the subdomain pointing to the vendor's supported target hostname.
- Recognize the private frontend address has no inherent public Internet routing.
- Configure a static private frontend IP from an available address in the selected subnet.
- Use a supported Azure DNS alias record design at the zone apex instead of a conflicting CNAME.
Explanation
Correct Answer
B:Private frontend addresses require connected VNet or approved private networking paths. They are not globally reachable public service endpoints.
Incorrect Answers
A:CNAME aliases one DNS name to another, letting the target's addresses change without rewriting the original alias. This matters here because an internal load balancer cannot be reached from an arbitrary Internet client. Why is that expected.
C:A static frontend gives internal clients a predictable service endpoint. Dynamic allocation can complicate fixed service references. This matters here because an internal load balancer cannot be reached from an arbitrary Internet client. Why is that expected.
D:An ordinary CNAME cannot coexist at a DNS name with other data records such as required apex SOA/NS. This matters here because an internal load balancer cannot be reached from an arbitrary Internet client. Why is that expected.
Question 383
A Standard Load Balancer backend VM is running, but the application port is closed. How should new traffic be handled?
- Inspect backend NIC membership, health probe state and matching load-balancing rule.
- Keep sending new TCP flows to a VM because its guest OS is running, even though its application port is closed.
- Resolve the hostname to an IP first, then test the actual destination address and service port.
- Use a health probe that checks the actual service port and excludes unhealthy backends.
Explanation
Correct Answer
D:Load balancer probes evaluate backend availability and determine whether new flows can be routed. VM power status alone is insufficient.
Incorrect Answers
A:Front-end existence does not imply healthy destinations. The pool, probe and rules jointly determine effective delivery. This matters here because a Standard Load Balancer backend VM is running, but the application port is closed.
B:Guest power state is not proof that a particular application port is accepting connections. Configure the load balancer health probe for the service endpoint so failing backends leave the new-connection rotation.
C:Separating DNS and transport checks shows whether the name maps correctly before a network probe. A generic ping failure is not definitive.
Question 384
A probe checks TCP 80 while the service actually listens on 8080 and every backend shows unhealthy. What should be changed?
- Choose an unused private address inside the associated subnet for the frontend.
- Use application-aware health checks rather than relying only on open TCP ports.
- Configure the correct probe port and any required application listener response.
- Verify its NIC IP configuration is actually associated with the intended backend pool.
Explanation
Correct Answer
C:A probe must target a reachable listener or health endpoint. Checking an unused port incorrectly marks healthy applications down.
Incorrect Answers
A:Private IP addresses cannot be simultaneously assigned to conflicting Azure resources in the same subnet. The frontend must be unique. This matters here because a probe checks TCP 80 while the service actually listens on 8080 and every backend shows unhealthy.
B:A TCP probe confirms a listener exists, not that the application is functioning correctly. HTTP health can signal failures beyond port acceptance. This matters here because a probe checks TCP 80 while the service actually listens on 8080 and every backend shows unhealthy.
D:A VM's presence in the same VNet is not backend pool membership. The load-balancing resource selects only configured eligible targets.
Question 385
An application needs two public services on ports 80 and 443 to reach different backend ports on the same pool. Which load balancer objects should be created?
- Use only administrative inbound NAT mappings rather than explicit service rules for ports 80 and 443.
- Inspect backend NIC membership, health probe state and matching load-balancing rule.
- Use separate load-balancing rules mapping the intended frontend and backend ports.
- Verify its NIC IP configuration is actually associated with the intended backend pool.
Explanation
Correct Answer
C:Azure Load Balancer rules match protocol and frontend port to a backend port and pool. A probe does not by itself define port mapping. This matters here because an application needs two public services on ports 80 and 443 to reach different backend ports on the same pool.….
Incorrect Answers
A:NAT rules are intended for per-backend port translation, not health-probed shared service distribution. Define and validate the required frontend-to-backend load-balancing rules for each exposed service port.
B:Front-end existence does not imply healthy destinations. The pool, probe and rules jointly determine effective delivery. This matters here because an application needs two public services on ports 80 and 443 to reach different backend ports on the same pool.….
D:A VM's presence in the same VNet is not backend pool membership. The load-balancing resource selects only configured eligible targets. This matters here because an application needs two public services on ports 80 and 443 to reach different backend ports on the same pool.….
Question 386
A database administrator needs to find VM errors in Log Analytics using a query language. Which query platform applies?
- Run Kusto Query Language queries against supported Log Analytics workspace tables.
- Create an Azure Monitor scheduled query alert rule against the KQL result.
- Graph Storage account transactions, availability and latency metrics over the same time window.
- Create Azure Monitor diagnostic settings for supported storage resource log categories.
Explanation
Correct Answer
A:KQL provides filtering, aggregation and joins over telemetry such as Heartbeat or event records. This is separate from Azure Resource Graph queries.
Incorrect Answers
B:Log search alerts evaluate returned query data on configured schedules. Metric alerts target numeric metric signals. This matters here because a database administrator needs to find VM errors in Log Analytics using a query language. Which query platform applies.
C:Azure Storage platform metrics can reveal traffic volume and response time. A license assignment cannot explain a storage throughput trend. This matters here because a database administrator needs to find VM errors in Log Analytics using a query language. Which query platform applies.
D:Diagnostic settings route resource logs to Log Analytics, storage or Event Hubs where supported. Metrics do not automatically include request details. This matters here because a database administrator needs to find VM errors in Log Analytics using a query language. Which query platform applies.
Question 387
A query returns zero events because it uses a table not populated by the chosen DCR. What should be checked?
- Verify the data collection rule association, syslog facility/severity filters and workspace destination.
- Export Azure Activity Log to Log Analytics, storage or Event Hubs through diagnostic settings.
- Attach a generic VM Insights performance DCR and expect it to populate any arbitrary Log Analytics event table referenced by a query.
- Inspect the workspace tables and active data collection rules before rewriting the KQL logic.
Explanation
Correct Answer
D:Queries can return only collected records. An empty table may be a collection problem instead of a KQL syntax failure.
Incorrect Answers
A:Agent installation alone does not specify every log source or destination. DCR rules determine collected data. This matters here because a query returns zero events because it uses a table not populated by the chosen DCR.
B:Activity Log retains control-plane events for a limited native period; export supports organization-defined retention and analysis.
C:A DCR collects only its configured streams and routes them to a designated destination. Match the query's expected table to the actual collection rule and ingested records.
Question 388
A KQL query must return only failed events from the previous day. Which combination is appropriate?
- Filter by TimeGenerated with ago(1d) and apply where to the failure condition.
- Configure supported virtual network flow logs or NSG flow logs under current regional support.
- Use where for the operation predicate and project for the chosen output columns.
- Use project or project-away to control which columns appear in results.
Explanation
Correct Answer
A:KQL where reduces rows by predicates, while ago supplies a relative time window. Selecting a dashboard time picker alone may not change a scripted query.
Incorrect Answers
B:Flow logging records network connection metadata for analysis and troubleshooting. This is not a full packet payload capture.
C:Where selects qualifying rows; project selects displayed fields. Neither operation by itself computes aggregate counts.
D:Column projection reduces result shape, making analysis focused and easier to export. It does not change the underlying stored telemetry.
Question 389
A query includes records from months ago because TimeGenerated isn't constrained. What should be added?
- Apply an explicit TimeGenerated time-range filter in the KQL query.
- Use project or project-away to control which columns appear in results.
- Distinguish alert evaluation and fired alert records from alert processing notification suppression.
- Use summarize avg(CounterValue) by Computer or the applicable column after filtering the time range.
Explanation
Correct Answer
A:A table may retain many months of telemetry. Queries should constrain time for accuracy and performance.
Incorrect Answers
B:Column projection reduces result shape, making analysis focused and easier to export. It does not change the underlying stored telemetry. This matters here because a query includes records from months ago because TimeGenerated isn't constrained.
C:Suppressing notification actions does not necessarily disable the underlying alert condition. Evidence of the fired alert may remain available. This matters here because a query includes records from months ago because TimeGenerated isn't constrained.
D:KQL summarize aggregates numeric columns by grouping keys. A simple project expression only selects fields without calculating per-VM averages.
Question 390
An engineer needs average VM CPU by computer over the past hour in KQL. Which query operator computes the grouping?
- Use summarize count() by SeverityLevel after filtering the relevant error records.
- Use summarize avg(CounterValue) by Computer or the applicable column after filtering the time range.
- Apply an explicit TimeGenerated time-range filter in the KQL query.
- Inspect Azure Resource Health for the affected VM.
Explanation
Correct Answer
B:KQL summarize aggregates numeric columns by grouping keys. A simple project expression only selects fields without calculating per-VM averages. This matters here because an engineer needs average VM CPU by computer over the past hour in KQL. Which query operator computes the grouping.
Incorrect Answers
A:KQL count aggregation summarizes event rows by severity. Detailed raw events alone do not produce grouped counts.
C:A table may retain many months of telemetry. Queries should constrain time for accuracy and performance. This matters here because an engineer needs average VM CPU by computer over the past hour in KQL. Which query operator computes the grouping.
D:Resource Health reports platform availability for supported Azure resources and can help distinguish platform incidents from guest failures.
