Pass Your Microsoft AZ-104 Exam Easy!

A backup taken only after the failed swap preserves the currently broken production state; it does not automatically reconstruct the healthy build that ran before the swap. Azure App Service can roll back an ordinary swap by swapping the same two slots again when the previous version remains on staging. The operator should identify the actual prior build and review slot-specific settings before performing a controlled reverse swap or an already validated rollback. A newly captured image of failure is not equivalent to a known-good recovery point.

The nearby action 'Remove leaked values and use secure App Service settings, secret references and managed identity' is associated with this separate need: a new web app includes sample credentials in app settings and public build logs. That is because application configuration must keep credentials out of public deployment artifacts. Here a slot swap causes production errors and operations need to return to the prior build, so 'Remove leaked values and use secure App Service settings, secret references and managed identity' misses the fact that rollback must restore working code and appropriate settings, not merely rename the slot. 'Identify the actual prior slot revision and perform a controlled reverse swap or deployment rollback' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Mark the sensitive application setting as deployment-slot-specific (sticky)' solves another task because some App Service settings are swappable, while explicitly sticky values remain bound to their slot. For the situation where a slot swap causes production errors and operations need to return to the prior build, this distractor misses the requirement that rollback must restore working code and appropriate settings, not merely rename the slot. Unlike 'Mark the sensitive application setting as deployment-slot-specific (sticky)', 'Identify the actual prior slot revision and perform a controlled reverse swap or deployment rollback' directly targets that requirement; its success must be confirmed at the authorized resource scope.

The nearby action 'Allocate a nonoverlapping subnet prefix with adequate free addresses' is associated with this separate need: a new database tier must fit into an existing VNet without disrupting current subnets. That is because overlapping or exhausted VNet address space prevents safe subnet creation and future growth. Here two VNets intended for peering both use overlapping 10.20.0.0/16 address space, so 'Allocate a nonoverlapping subnet prefix with adequate free addresses' misses the fact that peering requires routable distinct prefixes; NSG rule changes cannot resolve CIDR overlap. 'Assign nonoverlapping VNet address spaces before establishing peering' is the more defensible action; confirm its behavior in the target service before calling the task complete.

Azure VNet peering checks the entire set of address prefixes assigned to both virtual networks, not only newly added subnets. Adding a spare nonoverlapping prefix does not remove the original 10.20.0.0/16 collision, so peering remains unsupported. Before establishing the relationship, administrators must readdress or remove the conflicting VNet prefix while considering existing attached subnet resources and dependencies. Merely appending a compatible range would be useful only after the old conflicting range is actually removed.

When two existing VNets must communicate privately without a VPN gateway, the action 'Create the required VNet peering relationships with appropriate mutual settings' can be relevant: peer-to-peer connectivity requires matching configurations and nonoverlapping address spaces. For the different problem of two VNets intended for peering both use overlapping 10.20.0.0/16 address space, 'Create the required VNet peering relationships with appropriate mutual settings' misses the mechanism that peering requires routable distinct prefixes; NSG rule changes cannot resolve CIDR overlap. Choosing 'Create the required VNet peering relationships with appropriate mutual settings' would address that other need, whereas 'Assign nonoverlapping VNet address spaces before establishing peering' is intended to solve the stated condition.

Changing a route table is not a substitute for a valid peering address plan. Azure refuses peering where the VNets' CIDR ranges overlap, before effective routing between them can be used. Leaving 10.20.0.0/16 in both networks means the same destination addresses have ambiguous ownership across the desired connection. The correct fix is to plan and assign nonoverlapping VNet address spaces, migrate dependent subnet resources safely where necessary, and only then establish the supported peering. This alternative preserves the precondition that causes deployment rejection.

'Apply the service-required subnet delegation and verify service compatibility' solves another task because delegation grants appropriate control to a platform service; not every subnet can be shared arbitrarily. For the situation where a team allocates an Azure subnet as /29 and assumes every address is assignable to VMs, this distractor misses the requirement that Azure reserves five IPs per subnet, limiting usable host addresses beyond ordinary network math. Unlike 'Apply the service-required subnet delegation and verify service compatibility', 'Account for Azure-reserved subnet IP addresses when calculating usable capacity' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a security team mixes VMs and managed private endpoint NICs in one subnet without reviewing service policy, the action 'Review private endpoint subnet network policies and placement requirements' can be relevant: private endpoints are service NICs with specific routing/NSG features that may differ from ordinary VMs. For the different problem of a team allocates an Azure subnet as /29 and assumes every address is assignable to VMs, 'Review private endpoint subnet network policies and placement requirements' misses the mechanism that Azure reserves five IPs per subnet, limiting usable host addresses beyond ordinary network math. Choosing 'Review private endpoint subnet network policies and placement requirements' would address that other need, whereas 'Account for Azure-reserved subnet IP addresses when calculating usable capacity' is intended to solve the stated condition.

A /29 subnet has eight addresses in total, but Azure consumes five reserved addresses regardless of how many VM NICs are created. It therefore provides three ordinary private addresses, not the five required. Keeping /29 on the assumption that no addresses are reserved will lead to allocation failures. The proper calculation subtracts Azure platform reservations before assigning a prefix, with headroom for additional endpoints. Verify that the chosen replacement prefix is supported and does not overlap any existing VNet subnet.

Creating an overlapping subnet cannot increase the number of usable IP addresses for five independent VMs; Azure subnet prefixes within a VNet must not overlap. The diagnosed capacity shortfall is mathematical: /29 has eight total but only three assignable after five Azure-reserved addresses. Select a new, nonoverlapping subnet size that leaves sufficient assignable addresses, and plan any migration of already allocated NICs. An overlapping block would introduce an address-plan conflict rather than solve the reservation constraint.

When an organization has almost exhausted the address range of its primary VNet, the action 'Add compatible nonoverlapping address space and new subnets after dependency review' can be relevant: overlapping expansion cannot safely route workloads; peering and gateway dependencies may limit changes. For the different problem of a new database tier must fit into an existing VNet without disrupting current subnets, 'Add compatible nonoverlapping address space and new subnets after dependency review' misses the mechanism that overlapping or exhausted VNet address space prevents safe subnet creation and future growth. Choosing 'Add compatible nonoverlapping address space and new subnets after dependency review' would address that other need, whereas 'Allocate a nonoverlapping subnet prefix with adequate free addresses' is intended to solve the stated condition.

Azure subnets within one virtual network must have compatible nonoverlapping address ranges. Assigning a prefix that collides with an existing subnet does not create a usable database tier or preserve current workloads. The administrator should allocate an available prefix with enough addresses after Azure reservations and planned headroom, while keeping it inside the VNet address space and avoiding conflicts. A duplicate prefix would fail validation or break routing assumptions.

The nearby action 'Assign nonoverlapping VNet address spaces before establishing peering' is associated with this separate need: two VNets intended for peering both use overlapping 10.20.0.0/16 address space. That is because peering requires routable distinct prefixes; NSG rule changes cannot resolve CIDR overlap. Here a new database tier must fit into an existing VNet without disrupting current subnets, so 'Assign nonoverlapping VNet address spaces before establishing peering' misses the fact that overlapping or exhausted VNet address space prevents safe subnet creation and future growth. 'Allocate a nonoverlapping subnet prefix with adequate free addresses' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Choose a supported subnet CIDR leaving address headroom after Azure reservations' applies to a different feature boundary because a technically valid but tiny subnet can prevent future scaling or infrastructure allocation. In the stated scenario where a PaaS service's VNet integration reports that its target subnet is not delegated correctly, 'Choose a supported subnet CIDR leaving address headroom after Azure reservations' does not satisfy the mechanism that delegation grants appropriate control to a platform service; not every subnet can be shared arbitrarily. The necessary action is 'Apply the service-required subnet delegation and verify service compatibility', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Account for Azure-reserved subnet IP addresses when calculating usable capacity' is associated with this separate need: a team allocates an Azure subnet as /29 and assumes every address is assignable to VMs. That is because Azure reserves five IPs per subnet, limiting usable host addresses beyond ordinary network math. Here a PaaS service's VNet integration reports that its target subnet is not delegated correctly, so 'Account for Azure-reserved subnet IP addresses when calculating usable capacity' misses the fact that delegation grants appropriate control to a platform service; not every subnet can be shared arbitrarily. 'Apply the service-required subnet delegation and verify service compatibility' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Review private endpoint subnet network policies and placement requirements' solves another task because private endpoints are service NICs with specific routing/NSG features that may differ from ordinary VMs. For the situation where a PaaS service's VNet integration reports that its target subnet is not delegated correctly, this distractor misses the requirement that delegation grants appropriate control to a platform service; not every subnet can be shared arbitrarily. Unlike 'Review private endpoint subnet network policies and placement requirements', 'Apply the service-required subnet delegation and verify service compatibility' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Apply the service-required subnet delegation and verify service compatibility' solves another task because delegation grants appropriate control to a platform service; not every subnet can be shared arbitrarily. For the situation where a container platform requires spare IP addresses as replica count rises, this distractor misses the requirement that a technically valid but tiny subnet can prevent future scaling or infrastructure allocation. Unlike 'Apply the service-required subnet delegation and verify service compatibility', 'Choose a supported subnet CIDR leaving address headroom after Azure reservations' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a team allocates an Azure subnet as /29 and assumes every address is assignable to VMs, the action 'Account for Azure-reserved subnet IP addresses when calculating usable capacity' can be relevant: Azure reserves five IPs per subnet, limiting usable host addresses beyond ordinary network math. For the different problem of a container platform requires spare IP addresses as replica count rises, 'Account for Azure-reserved subnet IP addresses when calculating usable capacity' misses the mechanism that a technically valid but tiny subnet can prevent future scaling or infrastructure allocation. Choosing 'Account for Azure-reserved subnet IP addresses when calculating usable capacity' would address that other need, whereas 'Choose a supported subnet CIDR leaving address headroom after Azure reservations' is intended to solve the stated condition.

Azure VNet subnets cannot use overlapping prefixes, and not every IP in an allocated CIDR block is assignable to a workload. Azure reserves five IPv4 addresses per subnet before container runtime or interface allocations are counted. An overlapping address range would fail subnet planning and could break routing, while treating reserved IPs as free overstates available scale-out capacity. Select a supported, nonoverlapping prefix large enough for the maximum replica design and service requirements instead of trying to reuse occupied addresses.

Subnet delegation reserves a subnet for supported delegated Azure services and their expected network configuration. Delegating it to App Service integration does not activate private endpoint network policies or grant enforcement to an NSG on the private endpoint NIC. The problem is not that a web application needs a delegated subnet; it is that private endpoint policy enforcement is disabled. Changing delegation can violate compatibility requirements and disrupt unrelated resources. Enable the specific private endpoint network-policy support needed by the NSG, and verify that any shared-subnet configuration is supported by the deployed services.

Associating an NSG to the subnet can secure compatible VM network traffic, but the question explicitly says private endpoint network policies are disabled. Microsoft documents a distinct subnet configuration that enables NSG and/or route-table enforcement on private endpoints. Leaving that setting disabled while merely retaining the NSG does not address the observed lack of enforcement for the private endpoint NIC. After enabling the supported policy, the operator must still verify priority, direction, tuple matching and intended routes. A policy switch does not by itself create appropriate allow or deny rules for the application.

A service endpoint and a private endpoint use different connectivity models. A service endpoint continues to address the Azure service's public endpoint while associating authorized VNet subnet identity with requests; it does not create the private IP-based connection used by Private Link. Replacing the private endpoint therefore would not preserve the same VNet private address or necessarily satisfy private-only access requirements. The desired change is to enable private endpoint network-policy support for the existing endpoint subnet, not to remove Private Link. DNS and service firewall rules should remain aligned with the approved private connectivity design.

When two existing VNets must communicate privately without a VPN gateway, the action 'Create the required VNet peering relationships with appropriate mutual settings' can be relevant: peer-to-peer connectivity requires matching configurations and nonoverlapping address spaces. For the different problem of peering fails because two VNet CIDR blocks overlap, 'Create the required VNet peering relationships with appropriate mutual settings' misses the mechanism that forwarded-traffic configuration does not create unique routes for conflicting network prefixes. Choosing 'Create the required VNet peering relationships with appropriate mutual settings' would address that other need, whereas 'Use nonoverlapping address spaces before peering' is intended to solve the stated condition.

The nearby action 'Allocate a nonoverlapping subnet prefix with adequate free addresses' is associated with this separate need: a new database tier must fit into an existing VNet without disrupting current subnets. That is because overlapping or exhausted VNet address space prevents safe subnet creation and future growth. Here peering fails because two VNet CIDR blocks overlap, so 'Allocate a nonoverlapping subnet prefix with adequate free addresses' misses the fact that forwarded-traffic configuration does not create unique routes for conflicting network prefixes. 'Use nonoverlapping address spaces before peering' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Review effective routes and user-defined route priorities after peering' solves another task because peering connection status is separate from chosen next hop and network security evaluation. For the situation where peering fails because two VNet CIDR blocks overlap, this distractor misses the requirement that forwarded-traffic configuration does not create unique routes for conflicting network prefixes. Unlike 'Review effective routes and user-defined route priorities after peering', 'Use nonoverlapping address spaces before peering' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Overlapping network address ranges undermine unambiguous routing between connected VNets and can prevent supported peering or forwarding designs. The request is to add capacity to a VNet approaching exhaustion while maintaining its dependencies. Plan additional nonoverlapping address space and subnets with available IP capacity, then validate connected-network routing and service constraints. Introducing a duplicate range recreates conflict instead of providing a safe growth path.

'Allocate a nonoverlapping subnet prefix with adequate free addresses' solves another task because overlapping or exhausted VNet address space prevents safe subnet creation and future growth. For the situation where an organization has almost exhausted the address range of its primary VNet, this distractor misses the requirement that overlapping expansion cannot safely route workloads; peering and gateway dependencies may limit changes. Unlike 'Allocate a nonoverlapping subnet prefix with adequate free addresses', 'Add compatible nonoverlapping address space and new subnets after dependency review' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When two VNets intended for peering both use overlapping 10.20.0.0/16 address space, the action 'Assign nonoverlapping VNet address spaces before establishing peering' can be relevant: peering requires routable distinct prefixes; NSG rule changes cannot resolve CIDR overlap. For the different problem of an organization has almost exhausted the address range of its primary VNet, 'Assign nonoverlapping VNet address spaces before establishing peering' misses the mechanism that overlapping expansion cannot safely route workloads; peering and gateway dependencies may limit changes. Choosing 'Assign nonoverlapping VNet address spaces before establishing peering' would address that other need, whereas 'Add compatible nonoverlapping address space and new subnets after dependency review' is intended to solve the stated condition.

'Change the DNS zone name and assume packets are now routed across VNets' fails the stated scenario where two existing VNets must communicate privately without a VPN gateway because DNS records cannot replace the required peering relationships. The required multi-part resolution instead needs peer-to-peer connectivity requires matching configurations and nonoverlapping address spaces, which 'Change the DNS zone name and assume packets are now routed across VNets' does not establish. Do not count 'Change the DNS zone name and assume packets are now routed across VNets' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

'Enable only management-group RBAC without creating any VNet network connection' fails the stated scenario where two existing VNets must communicate privately without a VPN gateway because authorization to configure resources is not equivalent to actual network peering. The required multi-part resolution instead needs peer-to-peer connectivity requires matching configurations and nonoverlapping address spaces, which 'Enable only management-group RBAC without creating any VNet network connection' does not establish. Do not count 'Enable only management-group RBAC without creating any VNet network connection' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

'Create peering only from VNet A and assume the reverse definition exists' fails the stated scenario where two existing VNets must communicate privately without a VPN gateway because the intended bidirectional peering relationship still needs corresponding configuration on VNet B. The required multi-part resolution instead needs peer-to-peer connectivity requires matching configurations and nonoverlapping address spaces, which 'Create peering only from VNet A and assume the reverse definition exists' does not establish. Do not count 'Create peering only from VNet A and assume the reverse definition exists' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

'Give both VNets identical overlapping CIDR blocks' fails the stated scenario where two existing VNets must communicate privately without a VPN gateway because overlapping ranges prevent unambiguous routing and peering eligibility. The required multi-part resolution instead needs peer-to-peer connectivity requires matching configurations and nonoverlapping address spaces, which 'Give both VNets identical overlapping CIDR blocks' does not establish. Do not count 'Give both VNets identical overlapping CIDR blocks' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

'Review effective routes and user-defined route priorities after peering' solves another task because peering connection status is separate from chosen next hop and network security evaluation. For the situation where a peering link shows Connected but packets target a duplicate address range in the other network, this distractor misses the requirement that connected status does not make ambiguous IP destinations routable between VNets. Unlike 'Review effective routes and user-defined route priorities after peering', 'Correct overlapping address-space design and effective routing' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When two VNets intended for peering both use overlapping 10.20.0.0/16 address space, the action 'Assign nonoverlapping VNet address spaces before establishing peering' can be relevant: peering requires routable distinct prefixes; NSG rule changes cannot resolve CIDR overlap. For the different problem of a peering link shows Connected but packets target a duplicate address range in the other network, 'Assign nonoverlapping VNet address spaces before establishing peering' misses the mechanism that connected status does not make ambiguous IP destinations routable between VNets. Choosing 'Assign nonoverlapping VNet address spaces before establishing peering' would address that other need, whereas 'Correct overlapping address-space design and effective routing' is intended to solve the stated condition.

A new nonoverlapping prefix can support future growth, but it does not by itself remove the ambiguous existing range that the reported packet is trying to reach. The peering status Connected does not prove successful routing when the destination prefix is duplicated. The design must correct the conflicting address ranges and applicable effective routes; retaining the overlap leaves the root cause for that traffic unresolved.