Pass Microsoft AZ-104 Exam in First Attempt Guaranteed!

Private endpoints change the service network path, not flow-log content. NSG or virtual-network flow logs provide metadata, not full payload packet capture.

The guest itself does not require an Internet-facing address. Bastion is the controlled management entry point. This matters here because a company wants to monitor attempted connections but expects NSGs to be full packet-capture devices. What….

IP flow verify evaluates traffic against effective Azure security rules and reports an allow or deny rule. It is a diagnostic, not a rule mutation. This matters here because a company wants to monitor attempted connections but expects NSGs to be full packet-capture devices. What….

Guest network leases can retain prior DNS server information. Updating VNet settings may not immediately update every running guest. This matters here because an administrator wants to test whether DNS resolution or TCP connectivity is responsible for an application outage.….

Load balancer probes evaluate backend availability and determine whether new flows can be routed. VM power status alone is insufficient. This matters here because an administrator wants to test whether DNS resolution or TCP connectivity is responsible for an application outage.….

Troubleshooting should establish whether DNS returns the expected IP and whether transport access works independently. Changing public DNS first can mask an NSG or service-listener failure.

Azure VNets can use custom DNS servers for name resolution. The resolver must be reachable and able to resolve required Azure zones. This matters here because a VM reaches the service by IP but not by hostname. Which layer should be investigated.

Private DNS provides internal record resolution for associated VNets. Publishing the names in a public zone could expose internal topology. This matters here because a VM reaches the service by IP but not by hostname. Which layer should be investigated.

IP connectivity succeeds, so investigate hostname resolution: DNS server selection, zone links, private endpoint zone records and TTL caching. An unrelated public record may not be consulted.

Load balancer probes evaluate backend availability and determine whether new flows can be routed. VM power status alone is insufficient. This matters here because a highly available web app must route only to instances whose HTTP health endpoint returns 200. Which supported load….

A TCP probe confirms socket reachability, not that an HTTP endpoint returns 200. Configure a supported HTTP(S) probe with the correct path when using Standard Load Balancer, or select Application Gateway for HTTP-aware routing requirements.

DNS caches can hold earlier records until expiry. Comparing answers identifies resolver staleness without altering the service itself. This matters here because a highly available web app must route only to instances whose HTTP health endpoint returns 200. Which supported load….

DNS caches can hold earlier records until expiry. Comparing answers identifies resolver staleness without altering the service itself. This matters here because a TCP probe succeeds while the app returns HTTP 500 on all pages. What limitation is exposed.

A probe must target a reachable listener or health endpoint. Checking an unused port incorrectly marks healthy applications down. This matters here because a TCP probe succeeds while the app returns HTTP 500 on all pages. What limitation is exposed.

Load balancer probes evaluate backend availability and determine whether new flows can be routed. VM power status alone is insufficient. This matters here because a TCP probe succeeds while the app returns HTTP 500 on all pages. What limitation is exposed.

Managed App Service routing can use provider-backed hostnames; CNAME-based mappings are common for subdomains. Hard-coded addresses can be brittle and may not meet ownership validation.

CNAME aliases one DNS name to another, letting the target's addresses change without rewriting the original alias. This matters here because an App Service app needs to accept custom DNS mapping without using a fixed public IPv4 address. Which record….

Resolvers can cache DNS results for their configured lifetime. A successful zone update is not instantly visible to every client. This matters here because an App Service app needs to accept custom DNS mapping without using a fixed public IPv4 address. Which record….

Agent installation alone does not specify every log source or destination. DCR rules determine collected data. This matters here because a virtual network team wants to visualize packet route decisions from a VM to an IP after modifying route tables.….

Flow logging records network connection metadata for analysis and troubleshooting. It is not a full packet payload capture. This matters here because a virtual network team wants to visualize packet route decisions from a VM to an IP after modifying route tables.….

IP flow verify evaluates effective NSG filtering for the specified traffic tuple and identifies the matching rule. This matters here because a virtual network team wants to visualize packet route decisions from a VM to an IP after modifying route tables.….

An allow at one location may be superseded by a deny on another applicable filter. Direction and priority matter. This matters here because the next hop is an unexpected virtual appliance address rather than VNet peering.

Cost data can have processing delay and is aggregated across billing usage. Budget alerts are not real-time VM-event notifications.

Sort direction controls ordering; ascending displays small values first. DESC is required for most-frequent-first output. This matters here because the next hop is an unexpected virtual appliance address rather than VNet peering.

Activity Log records Azure control-plane events and caller information. It differs from detailed process logs inside the guest OS. This matters here because an administrator wants to record storage management updates for more than the default Activity Log window.

Cost data can have processing delay and is aggregated across billing usage. Budget alerts are not real-time VM-event notifications. This matters here because an administrator wants to record storage management updates for more than the default Activity Log window.

For investigations beyond the native retained window, send the Activity Log to an appropriate Log Analytics workspace, storage account or Event Hub through diagnostic export before the records age out.

Historical control-plane events cannot be recovered by creating a metric chart after their retention expires. Confirm whether a log export existed and query the long-retention sink for role changes.

Metrics are not an archival record of Azure RBAC control-plane changes. Inspect the Activity Log export destination and historical retention for those events.

KQL provides filtering, aggregation and joins over telemetry such as Heartbeat or event records. It is separate from Azure Resource Graph queries. This matters here because a compliance query cannot find last year's role changes in the portal Activity Log.

Spending and HTTP server errors are different signals. Select the App Service response-code metric or a validated application log query to detect the stated failure rate.

An instantaneous successful test does not prove sustained availability. Repeated probes reveal time-dependent faults. This matters here because a cloud team wants to alert when App Service HTTP 5xx error rates jump, not just when its VMs use CPU. Which….

High application error rates can occur with normal CPU. Use supported App Service HTTP response/5xx metrics or application telemetry and an appropriately scoped threshold.