Pass Your Microsoft AZ-104 Exam Easy!

'Review effective routes and user-defined route priorities after peering' solves another task because peering connection status is separate from chosen next hop and network security evaluation. For the situation where a peering link shows Connected but packets target a duplicate address range in the other network, this distractor misses the requirement that connected status does not make ambiguous IP destinations routable between VNets. Unlike 'Review effective routes and user-defined route priorities after peering', 'Correct overlapping address-space design and effective routing' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When two VNets intended for peering both use overlapping 10.20.0.0/16 address space, the action 'Assign nonoverlapping VNet address spaces before establishing peering' can be relevant: peering requires routable distinct prefixes; NSG rule changes cannot resolve CIDR overlap. For the different problem of a peering link shows Connected but packets target a duplicate address range in the other network, 'Assign nonoverlapping VNet address spaces before establishing peering' misses the mechanism that connected status does not make ambiguous IP destinations routable between VNets. Choosing 'Assign nonoverlapping VNet address spaces before establishing peering' would address that other need, whereas 'Correct overlapping address-space design and effective routing' is intended to solve the stated condition.

A new nonoverlapping prefix can support future growth, but it does not by itself remove the ambiguous existing range that the reported packet is trying to reach. The peering status Connected does not prove successful routing when the destination prefix is duplicated. The design must correct the conflicting address ranges and applicable effective routes; retaining the overlap leaves the root cause for that traffic unresolved.

Direct VNet peering between the two spokes could provide connectivity in architectures that permit a peer-to-peer traffic path. Here that path is explicitly forbidden, because security requires all east-west flows to traverse the hub firewall for inspection. Creating a direct peering route could make traffic bypass the intended security control. Nontransitive peering does not itself configure the hub as a router; use an explicit firewall transit design with appropriate route tables, forwarding and bidirectional rules instead of violating the mandated path.

'Configure hub gateway transit and spoke use-remote-gateways where supported' applies to a different feature boundary because gateway sharing has specific peering, ownership and route constraints; simple peering alone is insufficient. In the stated scenario where a spoke A connects to hub H, and spoke B also connects to H. The team assumes A automatically peers with B through H, 'Configure hub gateway transit and spoke use-remote-gateways where supported' does not satisfy the mechanism that Azure VNet peering is nontransitive by default; a hub topology needs intentional transit design. The necessary action is 'Configure allowed spoke-to-spoke UDRs to the hub firewall private next hop, with forwarding and rules for both directions', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Review effective routes and user-defined route priorities after peering' is associated with this separate need: a VNet peering is configured but packet flow still goes to an unexpected appliance. That is because peering connection status is separate from chosen next hop and network security evaluation. Here a spoke A connects to hub H, and spoke B also connects to H. The team assumes A automatically peers with B through H, so 'Review effective routes and user-defined route priorities after peering' misses the fact that Azure VNet peering is nontransitive by default; a hub topology needs intentional transit design. 'Configure allowed spoke-to-spoke UDRs to the hub firewall private next hop, with forwarding and rules for both directions' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Use global VNet peering for connectivity while enforcing separate data residency controls' solves another task because connectivity across regions does not migrate stored resources or override data-location requirements. For the situation where a spoke A connects to hub H, and spoke B also connects to H. The team assumes A automatically peers with B through H, this distractor misses the requirement that Azure VNet peering is nontransitive by default; a hub topology needs intentional transit design. Unlike 'Use global VNet peering for connectivity while enforcing separate data residency controls', 'Configure allowed spoke-to-spoke UDRs to the hub firewall private next hop, with forwarding and rules for both directions' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Creating bidirectional VNet peering relationships with nonoverlapping address spaces enables ordinary peering connectivity. It doesn't automatically authorize a spoke to use a VPN gateway owned by its hub for on-premises routes. Gateway transit requires particular settings on each side of the peering, and the spoke must not have its own conflicting gateway. Thus basic mutual peering is necessary background, but insufficient to meet the question's gateway-sharing requirement. Configure hub Allow gateway transit and spoke Use remote gateways where supported, and validate the effective routes and permitted traffic afterward.

Global VNet peering can connect VNets in different Azure regions, subject to documented constraints, but it doesn't by itself configure remote gateway transit or confer permission to use the hub VPN gateway. The distinction between data residency and connectivity is also separate from the specific peering flags. A spoke that merely has global peering may still lack routes through its desired hub gateway. Set Allow gateway transit on the appropriate hub peering and Use remote gateways on the spoke peering; verify the supported gateway topology and ensure the spoke doesn't also own an incompatible gateway.

Explicit transit routing, a network virtual appliance, or a firewall path may be a valid design when forced inspection or third-party transit is required. Those designs use effective routes and forwarding controls according to the network topology, and ordinary peering isn't a general transitive router. The present scenario instead names an existing hub VPN gateway and asks how to share it with a peered spoke. Use the supported gateway-transit and remote-gateway peering options rather than replacing the stated service with an unrelated transit architecture. Such a redesign would be an additional engineering decision, not the specific gateway-sharing control.

Inspecting route tables, effective routes, and peering status helps verify a deployed hub-and-spoke network after the peering settings are configured. A route check might reveal that a spoke never learned the desired on-premises prefix, but checking alone doesn't enable gateway sharing. The configuration must first permit hub gateway transit and request remote gateway use on the spoke. Also confirm that the spoke is not configured with a conflicting local gateway; a VNet can use only one local or eligible remote gateway. Use route inspection to validate the result, not as a substitute for the required peering flags.

Global VNet peering supplies private network reachability between VNets; it does not replicate application databases, storage objects or virtual machine disks. The team must design data replication and residency controls separately from connectivity, including where customer information is stored and processed. Treating a network connection as automatic data movement would yield incorrect compliance assumptions and an incomplete recovery architecture.

When a spoke A connects to hub H, and spoke B also connects to H. The team assumes A automatically peers with B through H, the action 'Implement explicit transit routing/firewall or direct peering as designed' can be relevant: Azure VNet peering is nontransitive by default; a hub topology needs intentional transit design. For the different problem of a regulated team peers VNets in two geographic regions and assumes peering moves all stored data, 'Implement explicit transit routing/firewall or direct peering as designed' misses the mechanism that connectivity across regions does not migrate stored resources or override data-location requirements. Choosing 'Implement explicit transit routing/firewall or direct peering as designed' would address that other need, whereas 'Use global VNet peering for connectivity while enforcing separate data residency controls' is intended to solve the stated condition.

'Review effective routes and user-defined route priorities after peering' applies to a different feature boundary because peering connection status is separate from chosen next hop and network security evaluation. In the stated scenario where a regulated team peers VNets in two geographic regions and assumes peering moves all stored data, 'Review effective routes and user-defined route priorities after peering' does not satisfy the mechanism that connectivity across regions does not migrate stored resources or override data-location requirements. The necessary action is 'Use global VNet peering for connectivity while enforcing separate data residency controls', which should be checked against this Azure resource's actual permissions and state.

DNS determines which destination address a name resolves to; it does not by itself establish which virtual appliance Azure's effective routes select as the next hop for an already-determined destination IP. Checking DNS TTL might be relevant if the application were resolving an obsolete address, but the given symptom specifically identifies traffic routed toward an unexpected appliance after peering. The right diagnostic is the source NIC's effective route table and relevant UDR or BGP route, followed by a targeted Next hop test. Changing DNS TTL without looking at the route selection does not address that failure.

'Create the required VNet peering relationships with appropriate mutual settings' applies to a different feature boundary because peer-to-peer connectivity requires matching configurations and nonoverlapping address spaces. In the stated scenario where a VNet peering is configured but packet flow still goes to an unexpected appliance, 'Create the required VNet peering relationships with appropriate mutual settings' does not satisfy the mechanism that peering connection status is separate from chosen next hop and network security evaluation. The necessary action is 'Review effective routes and user-defined route priorities after peering', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Configure hub gateway transit and spoke use-remote-gateways where supported' is associated with this separate need: a spoke should use a VPN gateway hosted in a hub VNet. That is because gateway sharing has specific peering, ownership and route constraints; simple peering alone is insufficient. Here a VNet peering is configured but packet flow still goes to an unexpected appliance, so 'Configure hub gateway transit and spoke use-remote-gateways where supported' misses the fact that peering connection status is separate from chosen next hop and network security evaluation. 'Review effective routes and user-defined route priorities after peering' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Create the required VNet peering relationships with appropriate mutual settings' applies to a different feature boundary because peer-to-peer connectivity requires matching configurations and nonoverlapping address spaces. In the stated scenario where two VNets peer successfully, but an app port is blocked, 'Create the required VNet peering relationships with appropriate mutual settings' does not satisfy the mechanism that peering provides a network path but does not bypass packet filters. The necessary action is 'Check subnet/NIC NSGs and endpoint listener permissions on both sides', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Use global VNet peering for connectivity while enforcing separate data residency controls' is associated with this separate need: a regulated team peers VNets in two geographic regions and assumes peering moves all stored data. That is because connectivity across regions does not migrate stored resources or override data-location requirements. Here two VNets peer successfully, but an app port is blocked, so 'Use global VNet peering for connectivity while enforcing separate data residency controls' misses the fact that peering provides a network path but does not bypass packet filters. 'Check subnet/NIC NSGs and endpoint listener permissions on both sides' is the more defensible action; confirm its behavior in the target service before calling the task complete.

A route update may change next-hop selection, but it cannot override an effective network security group rule that denies the particular TCP or UDP connection. The VNets already peer successfully; the remaining symptom is a blocked application port. Test the actual source, destination, protocol and port against subnet/NIC NSGs and verify the backend listener or host firewall before altering routes. Retaining the port deny while adding another remote prefix would not enable the required flow and could introduce unrelated network reachability changes.

'Update DNS with TTL-aware cutover and verify actual client resolution' applies to a different feature boundary because changing a frontend IP does not immediately change cached name-to-address mappings everywhere. In the stated scenario where a public-facing endpoint must keep a predictable address used in DNS, 'Update DNS with TTL-aware cutover and verify actual client resolution' does not satisfy the mechanism that a durable frontend address should not rely on transient dynamic assignment assumptions. The necessary action is 'Configure a stable supported public IP allocation and verify SKU constraints', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Use a region-compatible public IP and load-balancer frontend combination' is associated with this separate need: a deployment references a public IP created in a different region from its load balancer. That is because regional Azure networking resources cannot be attached arbitrarily across locations. Here a public-facing endpoint must keep a predictable address used in DNS, so 'Use a region-compatible public IP and load-balancer frontend combination' misses the fact that a durable frontend address should not rely on transient dynamic assignment assumptions. 'Configure a stable supported public IP allocation and verify SKU constraints' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Use compatible public IP SKU, region and zone settings with the load balancer' solves another task because frontend public-IP resources have SKU and zonal compatibility requirements. For the situation where a public-facing endpoint must keep a predictable address used in DNS, this distractor misses the requirement that a durable frontend address should not rely on transient dynamic assignment assumptions. Unlike 'Use compatible public IP SKU, region and zone settings with the load balancer', 'Configure a stable supported public IP allocation and verify SKU constraints' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Associate the IP to a supported NIC/frontend and configure access rules' applies to a different feature boundary because a public IP is a separate Azure resource that must be bound to an applicable endpoint. In the stated scenario where a public-facing endpoint must keep a predictable address used in DNS, 'Associate the IP to a supported NIC/frontend and configure access rules' does not satisfy the mechanism that a durable frontend address should not rely on transient dynamic assignment assumptions. The necessary action is 'Configure a stable supported public IP allocation and verify SKU constraints', which should be checked against this Azure resource's actual permissions and state.

A Standard Azure Load Balancer requires compatible frontend public IP properties, including supported SKU and any relevant regional or zonal alignment. Picking a dynamic Basic IP solely because it is available does not satisfy the Standard frontend requirement and may be rejected or lack intended zone resilience. Verify the supported public IP SKU and zone configuration in the same region as the load balancer rather than relying on an arbitrary address allocation.

'Associate the IP to a supported NIC/frontend and configure access rules' solves another task because a public IP is a separate Azure resource that must be bound to an applicable endpoint. For the situation where a zone-resilient Standard Load Balancer requires a frontend public IP, this distractor misses the requirement that frontend public-IP resources have SKU and zonal compatibility requirements. Unlike 'Associate the IP to a supported NIC/frontend and configure access rules', 'Use compatible public IP SKU, region and zone settings with the load balancer' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Remove direct public management exposure and use Bastion or controlled private access' applies to a different feature boundary because a public IP can widen attack surface even when NSGs later restrict selected ports. In the stated scenario where a zone-resilient Standard Load Balancer requires a frontend public IP, 'Remove direct public management exposure and use Bastion or controlled private access' does not satisfy the mechanism that frontend public-IP resources have SKU and zonal compatibility requirements. The necessary action is 'Use compatible public IP SKU, region and zone settings with the load balancer', which should be checked against this Azure resource's actual permissions and state.

'Use compatible public IP SKU, region and zone settings with the load balancer' solves another task because frontend public-IP resources have SKU and zonal compatibility requirements. For the situation where a server VM gets a direct public IP to simplify administration, despite a policy against internet-exposed management ports, this distractor misses the requirement that a public IP can widen attack surface even when NSGs later restrict selected ports. Unlike 'Use compatible public IP SKU, region and zone settings with the load balancer', 'Remove direct public management exposure and use Bastion or controlled private access' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When an engineer assumes creating a public IP automatically exposes a VM with no NIC association, the action 'Associate the IP to a supported NIC/frontend and configure access rules' can be relevant: a public IP is a separate Azure resource that must be bound to an applicable endpoint. For the different problem of a server VM gets a direct public IP to simplify administration, despite a policy against internet-exposed management ports, 'Associate the IP to a supported NIC/frontend and configure access rules' misses the mechanism that a public IP can widen attack surface even when NSGs later restrict selected ports. Choosing 'Associate the IP to a supported NIC/frontend and configure access rules' would address that other need, whereas 'Remove direct public management exposure and use Bastion or controlled private access' is intended to solve the stated condition.

The nearby action 'Use a region-compatible public IP and load-balancer frontend combination' is associated with this separate need: a deployment references a public IP created in a different region from its load balancer. That is because regional Azure networking resources cannot be attached arbitrarily across locations. Here a server VM gets a direct public IP to simplify administration, despite a policy against internet-exposed management ports, so 'Use a region-compatible public IP and load-balancer frontend combination' misses the fact that a public IP can widen attack surface even when NSGs later restrict selected ports. 'Remove direct public management exposure and use Bastion or controlled private access' is the more defensible action; confirm its behavior in the target service before calling the task complete.

A load balancer frontend public IP must use compatible SKU, region and zone settings for the actual Azure resource. But the stem explicitly confirms that the replacement endpoint already serves the application when clients connect directly to its new IP. The remaining error is not an incompatible frontend SKU; authoritative DNS still advertises the old address. Changing a working load-balancer address can add disruption and will not update DNS records in the hosted zone. The correct fix is to change the authoritative A-record value, then verify public DNS answers and application access under the planned cutover.

Static IP allocation can keep a frontend address stable across supported operations, but it is not the missing control in this cutover. A new valid Azure public IP is already deployed, responds to direct requests and matches the application. Allocating yet another address would introduce a third endpoint without changing the hostname mapping that resolvers read. The DNS team already completed the separate advance-TTL preparation. The immediate problem is an obsolete authoritative A record that still holds the former IPv4 value; replace it with the new address and validate resolution.

Associating a public IP with a VM NIC or load-balancer frontend can be necessary when the target Azure resource has not been configured to receive traffic. The scenario rules out that problem by stating the application responds successfully when addressed by its replacement public IP. Modifying NIC or frontend bindings is therefore not a correction for the obsolete DNS answer. The authoritative zone must contain the new IPv4 address in the hostname A record; then recursive resolver answers and application behavior can be checked. Azure networking association and DNS publication are separate configuration steps.

Azure public IP resources have regional compatibility restrictions, but moving the frontend address to another region will not cause authoritative DNS records to update automatically. The application is already reachable through the correct new public IPv4 endpoint, so a regional IP change would add another unnecessary migration. The question identifies the actual source of wrong-address answers: the authoritative A record was never updated after preparation of the TTL window. Change the record in the authoritative DNS zone and verify the returned IPv4 value from its nameservers, then confirm recursive resolver behavior.

'Use compatible public IP SKU, region and zone settings with the load balancer' applies to a different feature boundary because frontend public-IP resources have SKU and zonal compatibility requirements. In the stated scenario where an engineer assumes creating a public IP automatically exposes a VM with no NIC association, 'Use compatible public IP SKU, region and zone settings with the load balancer' does not satisfy the mechanism that a public IP is a separate Azure resource that must be bound to an applicable endpoint. The necessary action is 'Associate the public IP with an IP configuration on the VM network interface and permit the approved inbound flow with effective NSG rules', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Remove direct public management exposure and use Bastion or controlled private access' is associated with this separate need: a server VM gets a direct public IP to simplify administration, despite a policy against internet-exposed management ports. That is because a public IP can widen attack surface even when NSGs later restrict selected ports. Here an engineer assumes creating a public IP automatically exposes a VM with no NIC association, so 'Remove direct public management exposure and use Bastion or controlled private access' misses the fact that a public IP is a separate Azure resource that must be bound to an applicable endpoint. 'Associate the public IP with an IP configuration on the VM network interface and permit the approved inbound flow with effective NSG rules' is the more defensible action; confirm its behavior in the target service before calling the task complete.

A public load balancer may legitimately expose back-end VMs when it is configured with a frontend address, matching load-balancing rules, and a backend pool containing those VMs. The proposed option does none of that: it attaches the IP to an unrelated frontend with no rule or target backend. It also conflicts with the explicit requirement for direct access through this VM's own network interface. A Public IP allocated independently of a reachable endpoint cannot make this particular VM addressable by itself.