Microsoft AZ-104 Practice Test 77
Question 760
An ACR registry has obsolete manifests but releases need reliable rollback. What cleanup principle should be followed?
- Use reviewed registry retention or purge policies with exclusions for deployed and rollback versions.
- Pin the deployed container to a verified immutable image digest.
- Configure HTTP ingress scaling on Azure Container Apps.
- Inspect the queue scaler's authentication, metadata, scale-to-zero limits and min/max replicas.
Explanation
Correct Answer
A:Automated artifact cleanup must avoid removing references required by active deployments or disaster recovery. Blind tag deletion can cause pull failures. This matters here because an ACR registry has obsolete manifests but releases need reliable rollback. What cleanup principle should be followed.
Incorrect Answers
B:Digests identify exact content independent of mutable tags. This reduces accidental deployment of an unreviewed artifact. This matters here because an ACR registry has obsolete manifests but releases need reliable rollback. What cleanup principle should be followed.
C:Container Apps supports HTTP concurrency-based scaling with managed replicas. VMSS CPU autoscale addresses a different hosting model. This matters here because an ACR registry has obsolete manifests but releases need reliable rollback. What cleanup principle should be followed.
D:Queue scaling depends on valid scaler configuration and access. A backlog without a functioning trigger does not activate replicas. This matters here because an ACR registry has obsolete manifests but releases need reliable rollback. What cleanup principle should be followed.
Question 761
An App Service restore recovers code but an external database remains at the wrong version. What should be checked?
- Verify that slot-specific settings stay with their designated slot during swaps.
- Configure App Service regional VNet integration with a supported delegated subnet.
- Plan database-specific backup and restore consistency in addition to App Service backup.
- Verify App Service OS, language stack and runtime version compatibility.
Explanation
Correct Answer
C:App Service backup does not automatically guarantee consistent recovery of every external database. Dependencies need coordinated RPO and RTO. This matters here because an App Service restore recovers code but an external database remains at the wrong version.
Incorrect Answers
A:Sticky settings do not follow swapped code into another slot. Their behavior must be planned separately from deployment content. This matters here because an App Service restore recovers code but an external database remains at the wrong version.
B:VNet integration routes supported App Service outbound traffic into the VNet. It does not expose the app itself through a private IP. This matters here because an App Service restore recovers code but an external database remains at the wrong version.
D:App Service offerings vary by operating system and runtime. A build that runs locally may need a compatible hosting configuration. This matters here because an App Service restore recovers code but an external database remains at the wrong version.
Question 762
An application needs to retrieve a connection secret from Key Vault through an App Service setting without writing custom token code. Which integration may help?
- Enable the App Service managed identity and grant the needed Key Vault data role.
- Use an App Service Key Vault reference with managed identity authorization.
- Check the vault's data-plane authorization model and the identity's effective role or access policy.
- Copy the Key Vault connection secret into a literal App Service setting and refresh it manually when the password changes.
Explanation
Correct Answer
B:Key Vault references can resolve secrets into app configuration under supported identity and vault settings, avoiding plaintext storage. This matters here because an application needs to retrieve a connection secret from Key Vault through an App Service setting without writing….
Incorrect Answers
A:Managed identities supply Entra tokens to supported services without embedded long-lived application secrets. This matters here because an application needs to retrieve a connection secret from Key Vault through an App Service setting without writing….
C:Authentication is separate from Key Vault secret permissions. A valid identity token does not automatically allow reading secrets. This matters here because an application needs to retrieve a connection secret from Key Vault through an App Service setting without writing….
D:A literal secret copy defeats the desired Key Vault reference integration and requires custom rotation handling. A managed-identity-backed Key Vault reference resolves the secret in supported app settings.
Question 763
A Key Vault reference appears unresolved in App Service configuration even though the URI is correct. What should be examined?
- Create and approve an App Service private endpoint for inbound client traffic.
- Enable the App Service managed identity and grant the needed Key Vault data role.
- Check the vault's data-plane authorization model and the identity's effective role or access policy.
- Inspect managed identity selection, secret permission and vault networking for the reference.
Explanation
Correct Answer
D:A correct secret URI is only one prerequisite. Key Vault references require authorized network reachability and identity permissions. This matters here because a Key Vault reference appears unresolved in App Service configuration even though the URI is correct.
Incorrect Answers
A:Private endpoints provide private network ingress to supported App Service apps. Regional VNet integration is for outbound app calls. This matters here because a Key Vault reference appears unresolved in App Service configuration even though the URI is correct.
B:Managed identities supply Entra tokens to supported services without embedded long-lived application secrets. This matters here because a Key Vault reference appears unresolved in App Service configuration even though the URI is correct.
C:Authentication is separate from Key Vault secret permissions. A valid identity token does not automatically allow reading secrets. This matters here because a Key Vault reference appears unresolved in App Service configuration even though the URI is correct.
Question 764
A production application wants to minimize downtime during deployment while using staging validation. What should be tested prior to a swap?
- Verify that slot-specific settings stay with their designated slot during swaps.
- Perform a supported deployment slot swap after validating slot-specific settings and warm-up.
- Validate staging content, warm-up requests, sticky settings and target routing before slot swap.
- Scale up the App Service plan to a larger supported compute tier or instance.
Explanation
Correct Answer
C:A slot swap changes production-visible content under specified configuration rules. Testing prevents silent database or routing mismatches. This matters here because a production application wants to minimize downtime during deployment while using staging validation.
Incorrect Answers
A:Sticky settings do not follow swapped code into another slot. Their behavior must be planned separately from deployment content. This matters here because a production application wants to minimize downtime during deployment while using staging validation.
B:Slot swapping promotes the candidate release while allowing preparatory warm-up. It is safer than deleting and recreating the application. This matters here because a production application wants to minimize downtime during deployment while using staging validation.
D:Vertical scaling increases per-worker resources, unlike adding more workers. Plan limits and compatibility must be reviewed. This matters here because a production application wants to minimize downtime during deployment while using staging validation.
Question 765
A slot swap causes staging to connect to the production database accidentally. Which preflight would prevent this?
- Inspect deployment slot setting flags for all environment-specific secrets and connection strings.
- Perform a supported deployment slot swap after validating slot-specific settings and warm-up.
- Restore the most recent App Service backup after swapping slots instead of inspecting sticky database connection settings beforehand.
- Make every environment-specific database connection string non-sticky so it always moves with swapped content.
Explanation
Correct Answer
A:Sticky configuration distinguishes production and staging dependencies. Swapping nonsticky connections can produce incorrect environment access. This matters here because a slot swap causes staging to connect to the production database accidentally. Which preflight would prevent this.
Incorrect Answers
B:Slot swapping promotes the candidate release while allowing preparatory warm-up. It is safer than deleting and recreating the application. This matters here because a slot swap causes staging to connect to the production database accidentally. Which preflight would prevent this.
C:A post-swap restore cannot reliably prevent a staged build from using production connection secrets. Validate app settings and slot stickiness prior to the swap.
D:Nonsticky connection strings can follow the swapped build into the wrong environment. Database endpoints and secrets that belong to a slot need the appropriate deployment-slot setting.
Question 766
A development team needs to diagnose a failed deployment while preserving its current live App Service content. Which approach limits risk?
- Plan database-specific backup and restore consistency in addition to App Service backup.
- Validate staging content, warm-up requests, sticky settings and target routing before slot swap.
- Mark environment-specific connection strings as deployment slot settings.
- Deploy and test the candidate in a staging slot without swapping it to production.
Explanation
Correct Answer
D:A staging slot isolates the candidate release from ordinary customer traffic. A failed validation does not require replacing the live slot. This matters here because a development team needs to diagnose a failed deployment while preserving its current live App Service content.….
Incorrect Answers
A:App Service backup does not automatically guarantee consistent recovery of every external database. Dependencies need coordinated RPO and RTO. This matters here because a development team needs to diagnose a failed deployment while preserving its current live App Service content.….
B:A slot swap changes production-visible content under specified configuration rules. Testing prevents silent database or routing mismatches. This matters here because a development team needs to diagnose a failed deployment while preserving its current live App Service content.….
C:Sticky settings remain associated with their slot and avoid swapping protected environment values along with application content. This matters here because a development team needs to diagnose a failed deployment while preserving its current live App Service content.….
Question 767
A developer adds 10.2.1.0/24 and 10.2.1.128/25 as subnets in one VNet. What is the address problem?
- Explicitly design forwarded traffic and routes because VNet peering is nontransitive by default.
- Keep 10.2.1.0/24 and add 10.2.1.128/25 as a separate subnet because the nested addresses are in the same VNet.
- Remove overlapping subnet definitions and choose disjoint CIDR blocks.
- Treat 10.2.1.128/25 as nonoverlapping with 10.2.1.0/24 just because its mask is narrower.
Explanation
Correct Answer
C:The /25 occupies part of the /24 range. Azure subnet definitions cannot overlap even if they have different names. This matters here because a developer adds 10.2.1.0/24 and 10.2.1.128/25 as subnets in one VNet. What is the address problem.
Incorrect Answers
A:VNet peering directly connects peers, but does not automatically turn a hub into a transit router for all spokes. This matters here because a developer adds 10.2.1.0/24 and 10.2.1.128/25 as subnets in one VNet. What is the address problem.
B:A /25 inside an existing /24 shares its entire address interval with that subnet. Azure subnets in one VNet require disjoint address ranges.
D:The /25 is wholly contained in the /24, so both subnets claim some of the same addresses. Select two disjoint prefixes instead.
Question 768
An engineer wants two equal subnets from 10.2.2.0/24. Which address plan works?
- Associate a route table containing the desired user-defined routes with the subnet.
- Add a supported nonoverlapping address space prefix to the VNet.
- Add secondary private IP configurations to a supported Azure network interface.
- Use 10.2.2.0/25 and 10.2.2.128/25 as the two nonoverlapping child subnets.
Explanation
Correct Answer
D:Two /25 blocks partition the /24 address space exactly. Their network boundaries align with the prefix size. This matters here because an engineer wants two equal subnets from 10.2.2.0/24. Which address plan works.
Incorrect Answers
A:User-defined routes can override applicable system routes by prefix specificity and source priority. An NSG rule does not choose next hops. This matters here because an engineer wants two equal subnets from 10.2.2.0/24. Which address plan works.
B:Azure VNets can have multiple address spaces, subject to overlap, peerings and service constraints. Routing and existing subnets must be reviewed. This matters here because an engineer wants two equal subnets from 10.2.2.0/24. Which address plan works.
C:A NIC can hold multiple private IP configurations within applicable subnet and SKU limits. Each assigned address must be available. This matters here because an engineer wants two equal subnets from 10.2.2.0/24. Which address plan works.
Question 769
A company wants a stable public endpoint for a VM that is recreated occasionally. What design avoids dependence on a dynamic address?
- Compare the VM NIC's effective private IP configuration with the DNS A record.
- Add a supported nonoverlapping address space prefix to the VNet.
- Keep a separate static public IP resource and reattach it to a supported replacement endpoint.
- Keep a dynamically allocated public IP and assume recreating the VM will automatically reserve that same address without retaining an IP resource.
Explanation
Correct Answer
C:A public IP exists as a separate Azure resource; appropriate reassociation can preserve the address across supported NIC replacement. This matters here because a company wants a stable public endpoint for a VM that is recreated occasionally. What design avoids dependence on a….
Incorrect Answers
A:Dynamic allocation can change after resource replacement. A stale DNS mapping can misdirect clients even if routing is healthy. This matters here because a company wants a stable public endpoint for a VM that is recreated occasionally. What design avoids dependence on a….
B:Azure VNets can have multiple address spaces, subject to overlap, peerings and service constraints. Routing and existing subnets must be reviewed. This matters here because a company wants a stable public endpoint for a VM that is recreated occasionally. What design avoids dependence on a….
D:A dynamically assigned address has no guarantee of surviving deletion and recreation. The requirement calls for a retained static public IP resource that can be attached to the replacement supported endpoint.
Question 770
An engineer deletes the public IP resource and assumes the same global IP can be recreated later. What risk exists?
- Recognize the address may be released on resource deletion and cannot always be recovered.
- Use nonoverlapping VNet address prefixes and check peering conflicts.
- Use 10.2.2.0/25 and 10.2.2.128/25 as the two nonoverlapping child subnets.
- Associate a route table containing the desired user-defined routes with the subnet.
Explanation
Correct Answer
A:Releasing the address resource can return it to the pool. Retaining the IP resource is safer than relying on reacquisition. This matters here because an engineer deletes the public IP resource and assumes the same global IP can be recreated later. What risk exists.
Incorrect Answers
B:A VNet cannot contain conflicting address spaces in ways that undermine subnet allocation and routing. Peering also requires unique address planning. This matters here because an engineer deletes the public IP resource and assumes the same global IP can be recreated later. What risk exists.
C:Two /25 blocks partition the /24 address space exactly. Their network boundaries align with the prefix size. This matters here because an engineer deletes the public IP resource and assumes the same global IP can be recreated later. What risk exists.
D:User-defined routes can override applicable system routes by prefix specificity and source priority. An NSG rule does not choose next hops. This matters here because an engineer deletes the public IP resource and assumes the same global IP can be recreated later. What risk exists.
