Microsoft AZ-104 Practice Test 50
Question 490
IP flow verify reports Deny although a visible NSG rule allows the port. What should be investigated?
- Investigate client-side or network transit components beyond the storage service's processing time.
- Recognize that flow logs capture flow metadata, not full decrypted application payloads.
- Inspect effective subnet and NIC NSG rule ordering and the exact packet tuple.
- Install VM Insights on another machine rather than comparing the evaluated packet's subnet and NIC effective NSG rules.
Explanation
Correct Answer
C:An allow at one location may be superseded by a deny on another applicable filter. Direction and priority matter.
Incorrect Answers
A:End-to-end latency includes the broader request path, while server latency measures service-side processing. Their difference may indicate network or client effects. This matters here because iP flow verify reports Deny although a visible NSG rule allows the port.
B:Flow telemetry is designed to show traffic patterns and dispositions, not complete application message content. This matters here because iP flow verify reports Deny although a visible NSG rule allows the port.
D:VM Insights is telemetry collection, not authoritative NSG packet-rule evaluation. Use the exact IP flow tuple and inspect priority and effective rules at both relevant association scopes.
Question 491
An Azure VM has unusual network egress and the team needs flow-level source/destination records. Which logging option can provide metadata?
- Configure supported virtual network flow logs or NSG flow logs under current regional support.
- Run IP flow verify on the relevant VM NIC and packet source/destination/port.
- Inspect Azure Resource Health for the affected VM.
- Use Network Watcher next hop diagnostic for the source VM and destination IP.
Explanation
Correct Answer
A:Flow logging records network connection metadata for analysis and troubleshooting. It is not a full packet payload capture. This matters here because an Azure VM has unusual network egress and the team needs flow-level source/destination records. Which logging….
Incorrect Answers
B:IP flow verify evaluates effective NSG filtering for the specified traffic tuple and identifies the matching rule. This matters here because an Azure VM has unusual network egress and the team needs flow-level source/destination records. Which logging….
C:Resource Health reports platform availability for supported Azure resources and can help distinguish platform incidents from guest failures. This matters here because an Azure VM has unusual network egress and the team needs flow-level source/destination records. Which logging….
D:Next hop reports the chosen route type and address for a specified destination from a VM. It does not simulate every packet firewall. This matters here because an Azure VM has unusual network egress and the team needs flow-level source/destination records. Which logging….
Question 492
A flow log shows a connection tuple but not the HTTP request body. What should be understood?
- Recognize that flow logs capture flow metadata, not full decrypted application payloads.
- Review the action group's webhook receiver URL, authentication and delivery errors.
- Run IP flow verify on the relevant VM NIC and packet source/destination/port.
- Add an HTTP 5xx metric or log alert tied to an action group.
Explanation
Correct Answer
A:Flow telemetry is designed to show traffic patterns and dispositions, not complete application message content. This matters here because a flow log shows a connection tuple but not the HTTP request body.
Incorrect Answers
B:Alert rules invoke their configured action groups. A stale receiver configuration can fail delivery even when alert detection is correct. This matters here because a flow log shows a connection tuple but not the HTTP request body.
C:IP flow verify evaluates effective NSG filtering for the specified traffic tuple and identifies the matching rule. This matters here because a flow log shows a connection tuple but not the HTTP request body.
D:Application response errors are a different signal than infrastructure CPU saturation. Alerts must watch the symptom that matters. This matters here because a flow log shows a connection tuple but not the HTTP request body.
Question 493
A storage account's transactions per second rise unexpectedly, and the admin needs to correlate capacity and latency. Which Azure metrics help?
- Create an Azure Monitor workbook with relevant metric or log visualizations.
- Export subscription Activity Log operations without comparing storage transactions, server latency and egress metrics.
- Graph Storage account transactions, availability and latency metrics over the same time window.
- Check category-specific diagnostic settings on the blob service and the selected Log Analytics workspace.
Explanation
Correct Answer
C:Azure Storage platform metrics can reveal traffic volume and response time. A license assignment cannot explain a storage throughput trend. This matters here because a storage account's transactions per second rise unexpectedly, and the admin needs to correlate capacity and….
Incorrect Answers
A:Workbooks combine Azure Monitor data into reusable interactive views. They do not by themselves apply resource configuration changes. This matters here because a storage account's transactions per second rise unexpectedly, and the admin needs to correlate capacity and….
B:The storage throughput investigation requires correlated service metrics such as Transactions, SuccessServerLatency, Egress and utilization; management change events alone cannot show transaction-level saturation.
D:Logging must be enabled at the correct service resource and category. A storage account metric chart does not imply blob request logging. This matters here because a storage account's transactions per second rise unexpectedly, and the admin needs to correlate capacity and….
Question 494
An Azure VM needs continuous replication to a secondary region to support regional failover. Which Azure service fits?
- Initiate a planned or unplanned Site Recovery failover as appropriate to the incident.
- Choose the database service's native backup and point-in-time restore features where supported.
- Create an ASR recovery plan with ordered groups and supported automation steps.
- Enable Azure Site Recovery for the supported Azure VM and select target region infrastructure.
Explanation
Correct Answer
D:For a supported Azure VM, Site Recovery replicates protected workload data and provides coordinated failover to configured recovery infrastructure. Validate source and target regions, networking, replication policy and test-failover readiness rather than assuming a periodic backup is continuous DR.
Incorrect Answers
A:Failover uses replicated state in the recovery region to start supported workloads. A regional outage may require unplanned failover. This matters here because an Azure VM needs continuous replication to a secondary region to support regional failover. Which Azure service fits.
B:Managed database platforms offer service-particular automated backups and restore controls. VM backup policies do not cover every PaaS database.
C:Recovery plans coordinate groups of protected machines and recovery actions. Starting tiers arbitrarily can break dependencies. This matters here because an Azure VM needs continuous replication to a secondary region to support regional failover. Which Azure service fits.
Question 495
A VM in Site Recovery is replicating, but its target subnet is not configured. What should be fixed?
- Set target VNet, subnet, resource group and other recovery settings in the replication configuration.
- Initiate a planned or unplanned Site Recovery failover as appropriate to the incident.
- Review restored NIC, subnet, NSG, identity and DNS settings after VM recovery.
- Recognize that vault soft delete can retain backup data beyond ordinary protection stop actions.
Explanation
Correct Answer
A:Replica disks alone do not ensure a bootable, reachable application VM at the destination. Recovery topology must be configured. This matters here because a VM in Site Recovery is replicating, but its target subnet is not configured.
Incorrect Answers
B:Failover uses replicated state in the recovery region to start supported workloads. A regional outage may require unplanned failover. This matters here because a VM in Site Recovery is replicating, but its target subnet is not configured.
C:Backup restores data and compute artifacts, but the environment may need networking and identity reconciliation to return service. This matters here because a VM in Site Recovery is replicating, but its target subnet is not configured.
D:Soft delete intentionally delays permanent deletion under supported settings. Retention protects recovery evidence against quick destructive actions. This matters here because a VM in Site Recovery is replicating, but its target subnet is not configured.
Question 496
A team wants to validate its Azure Site Recovery plan without disrupting the production source VM. Which operation is designed for this?
- Run an isolated Site Recovery test failover using a suitable test network.
- Initiate a planned or unplanned Site Recovery failover as appropriate to the incident.
- Create an ASR recovery plan with ordered groups and supported automation steps.
- Inspect the managed database backup retention and available point-in-time restore range.
Explanation
Correct Answer
A:Test failover brings up recovery instances without committing a production cutover. Isolation reduces network and identity collision risk. This matters here because a team wants to validate its Azure Site Recovery plan without disrupting the production source VM. Which operation….
Incorrect Answers
B:Failover uses replicated state in the recovery region to start supported workloads. A regional outage may require unplanned failover. This matters here because a team wants to validate its Azure Site Recovery plan without disrupting the production source VM. Which operation….
C:Recovery plans coordinate groups of protected machines and recovery actions. Starting tiers arbitrarily can break dependencies. This matters here because a team wants to validate its Azure Site Recovery plan without disrupting the production source VM. Which operation….
D:PITR operates only over retained database backups. Recovery cannot target a timestamp outside the supported window.
Question 497
A test failover completed but left test VMs and networks running. What cleanup step matters?
- Perform Site Recovery test failover cleanup after verification and record results.
- Verify the vault's diagnostic routing to the reporting workspace and data ingestion delay.
- Retain every temporary test-failover VM as permanent production capacity after concluding the drill.
- Initiate a planned or unplanned Site Recovery failover as appropriate to the incident.
Explanation
Correct Answer
A:Test resources can incur cost or cause unexpected network effects if not cleaned up. The drill is not complete until cleanup is performed.
Incorrect Answers
B:Central reporting depends on exported telemetry and timing. Successful local backup jobs do not automatically populate another workspace.
C:A Site Recovery test failover creates isolated trial resources and does not automatically convert them into production replicas. Complete the cleanup workflow after validating the drill to remove temporary VMs, networks and unnecessary costs.
D:Failover uses replicated state in the recovery region to start supported workloads. A regional outage may require unplanned failover. This matters here because a test failover completed but left test VMs and networks running. What cleanup step matters.
Question 498
A primary region is unavailable and Site Recovery replication is current enough for recovery. What operation moves service to the target region?
- Start another test failover and treat its isolated test VM as the production service endpoint.
- Set target VNet, subnet, resource group and other recovery settings in the replication configuration.
- Initiate a planned or unplanned Site Recovery failover as appropriate to the incident.
- Create a Backup vault and choose supported data-source protection policies.
Explanation
Correct Answer
C:Failover uses replicated state in the recovery region to start supported workloads. A regional outage may require unplanned failover. This matters here because a primary region is unavailable and Site Recovery replication is current enough for recovery. What operation moves….
Incorrect Answers
A:A test failover validates readiness without replacing production routing or committing a real recovery. During a regional outage, select the supported operational failover path and appropriate usable recovery point to activate the target workload.
B:Replica disks alone do not ensure a bootable, reachable application VM at the destination. Recovery topology must be configured. This matters here because a primary region is unavailable and Site Recovery replication is current enough for recovery. What operation moves….
D:Backup vaults support selected newer Azure Backup data sources and policy capabilities. They are not interchangeable with Recovery Services vaults for every workload. This matters here because a primary region is unavailable and Site Recovery replication is current enough for recovery. What operation moves….
Question 499
Operations attempt planned failover while the source region is inaccessible. What mode should they consider?
- Inspect the backup job history, policy association, VM agent state and failure details.
- Use an unplanned failover workflow when the source cannot participate safely.
- Reprotect the recovered workload and perform a supported failback sequence when the source is ready.
- Require the unreachable source VM to complete a coordinated shutdown before allowing any recovery.
Explanation
Correct Answer
B:Planned failover typically involves source coordination. An unavailable source requires incident-appropriate recovery semantics. This matters here because operations attempt planned failover while the source region is inaccessible. What mode should they consider.
Incorrect Answers
A:A policy configured on paper does not prove successful execution. Job outcomes and generated recovery points establish actual protection. This matters here because operations attempt planned failover while the source region is inaccessible. What mode should they consider.
C:Failback requires replication direction and target infrastructure readiness; the initial failover is not automatically reversible.
D:Planned failover presumes source participation and a controlled sync/shutdown. If the source region is inaccessible, an unplanned failover may be necessary; communicate that the last replicated recovery point can lag acknowledged writes.
Question 500
After a successful ASR failover, the organization wants the original region to become primary again. Which lifecycle stage is relevant?
- Enable backup soft delete to reverse the Azure Site Recovery replication direction after failover.
- Configure supported geo-redundant backup storage with cross-region restore requirements where eligible.
- Reprotect the recovered workload and perform a supported failback sequence when the source is ready.
- Create an unrelated new backup policy instead of restoring replication direction to the original region.
Explanation
Correct Answer
C:Failback requires replication direction and target infrastructure readiness; the initial failover is not automatically reversible. This matters here because after a successful ASR failover, the organization wants the original region to become primary again. Which lifecycle….
Incorrect Answers
A:Soft delete protects certain deleted backup data; it is not a Site Recovery failback action. Reprotect, validate the original site and follow the supported failback sequence.
B:Geo redundancy can replicate supported backup data to a secondary region, subject to service options and replication delay.
D:A failback is not a standalone backup restore. After service is running in the recovery region, re-establish healthy protection in the reverse direction and follow the supported failback workflow when the former primary is ready.