Pass Your Microsoft AZ-104 Exam Easy!

'Use compatible public IP SKU, region and zone settings with the load balancer' applies to a different feature boundary because frontend public-IP resources have SKU and zonal compatibility requirements. In the stated scenario where an engineer assumes creating a public IP automatically exposes a VM with no NIC association, 'Use compatible public IP SKU, region and zone settings with the load balancer' does not satisfy the mechanism that a public IP is a separate Azure resource that must be bound to an applicable endpoint. The necessary action is 'Associate the public IP with an IP configuration on the VM network interface and permit the approved inbound flow with effective NSG rules', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Remove direct public management exposure and use Bastion or controlled private access' is associated with this separate need: a server VM gets a direct public IP to simplify administration, despite a policy against internet-exposed management ports. That is because a public IP can widen attack surface even when NSGs later restrict selected ports. Here an engineer assumes creating a public IP automatically exposes a VM with no NIC association, so 'Remove direct public management exposure and use Bastion or controlled private access' misses the fact that a public IP is a separate Azure resource that must be bound to an applicable endpoint. 'Associate the public IP with an IP configuration on the VM network interface and permit the approved inbound flow with effective NSG rules' is the more defensible action; confirm its behavior in the target service before calling the task complete.

A public load balancer may legitimately expose back-end VMs when it is configured with a frontend address, matching load-balancing rules, and a backend pool containing those VMs. The proposed option does none of that: it attaches the IP to an unrelated frontend with no rule or target backend. It also conflicts with the explicit requirement for direct access through this VM's own network interface. A Public IP allocated independently of a reachable endpoint cannot make this particular VM addressable by itself.

'Associate the IP to a supported NIC/frontend and configure access rules' solves another task because a public IP is a separate Azure resource that must be bound to an applicable endpoint. For the situation where a deployment references a public IP created in a different region from its load balancer, this distractor misses the requirement that regional Azure networking resources cannot be attached arbitrarily across locations. Unlike 'Associate the IP to a supported NIC/frontend and configure access rules', 'Use a region-compatible public IP and load-balancer frontend combination' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a public-facing endpoint must keep a predictable address used in DNS, the action 'Configure a stable supported public IP allocation and verify SKU constraints' can be relevant: a durable frontend address should not rely on transient dynamic assignment assumptions. For the different problem of a deployment references a public IP created in a different region from its load balancer, 'Configure a stable supported public IP allocation and verify SKU constraints' misses the mechanism that regional Azure networking resources cannot be attached arbitrarily across locations. Choosing 'Configure a stable supported public IP allocation and verify SKU constraints' would address that other need, whereas 'Use a region-compatible public IP and load-balancer frontend combination' is intended to solve the stated condition.

'Remove direct public management exposure and use Bastion or controlled private access' applies to a different feature boundary because a public IP can widen attack surface even when NSGs later restrict selected ports. In the stated scenario where a deployment references a public IP created in a different region from its load balancer, 'Remove direct public management exposure and use Bastion or controlled private access' does not satisfy the mechanism that regional Azure networking resources cannot be attached arbitrarily across locations. The necessary action is 'Use a region-compatible public IP and load-balancer frontend combination', which should be checked against this Azure resource's actual permissions and state.

'Associate the IP to a supported NIC/frontend and configure access rules' solves another task because a public IP is a separate Azure resource that must be bound to an applicable endpoint. For the situation where several VMs need outbound internet but security forbids attaching a public IP to each, this distractor misses the requirement that outbound egress does not require individually internet-addressable VM network interfaces. Unlike 'Associate the IP to a supported NIC/frontend and configure access rules', 'Use a supported shared outbound path such as NAT Gateway or approved firewall' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a zone-resilient Standard Load Balancer requires a frontend public IP, the action 'Use compatible public IP SKU, region and zone settings with the load balancer' can be relevant: frontend public-IP resources have SKU and zonal compatibility requirements. For the different problem of several VMs need outbound internet but security forbids attaching a public IP to each, 'Use compatible public IP SKU, region and zone settings with the load balancer' misses the mechanism that outbound egress does not require individually internet-addressable VM network interfaces. Choosing 'Use compatible public IP SKU, region and zone settings with the load balancer' would address that other need, whereas 'Use a supported shared outbound path such as NAT Gateway or approved firewall' is intended to solve the stated condition.

'Remove direct public management exposure and use Bastion or controlled private access' applies to a different feature boundary because a public IP can widen attack surface even when NSGs later restrict selected ports. In the stated scenario where several VMs need outbound internet but security forbids attaching a public IP to each, 'Remove direct public management exposure and use Bastion or controlled private access' does not satisfy the mechanism that outbound egress does not require individually internet-addressable VM network interfaces. The necessary action is 'Use a supported shared outbound path such as NAT Gateway or approved firewall', which should be checked against this Azure resource's actual permissions and state.

A direct Internet next hop bypasses the Azure Firewall appliance that policy requires for all traffic from this subnet to the other spoke. The goal is not merely to reach the destination; it is to preserve centralized inspection and filtering. An exception allowing a less inspected path violates that security invariant even if packet delivery becomes possible. Associate a UDR to the source subnet that routes the relevant destination prefix to the hub firewall private address as a virtual appliance, and validate the return route and firewall policy.

An Azure route-table entry is evaluated by its destination prefix, next-hop type and next-hop address, not by the human-readable description of that route. Changing the display name while keeping Internet as next hop would continue to send matching traffic away from the specified hub firewall, failing the mandatory inspection. Update the actual UDR to use the correct Virtual appliance next hop 10.0.1.4 and verify its effective selection on the spoke NIC. Naming edits cannot correct a wrong packet path.

'Inspect effective route entries, prefix lengths and UDR priority' solves another task because peering doesn't necessarily override a more specific user-defined route. For the situation where traffic from a spoke subnet must be inspected by a firewall appliance before reaching another network, this distractor misses the requirement that uDRs steer subnet traffic to a virtual appliance where permitted by forwarding and firewall rules. Unlike 'Inspect effective route entries, prefix lengths and UDR priority', 'Associate a user-defined route with the appliance's private IP as next hop' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a subnet has a user-defined route overriding a built-in system route, and traffic takes the custom path, the action 'Evaluate route selection including user-defined overrides and longest-prefix specificity' can be relevant: system routes and custom routes have defined precedence and effective routing must be inspected. For the different problem of traffic from a spoke subnet must be inspected by a firewall appliance before reaching another network, 'Evaluate route selection including user-defined overrides and longest-prefix specificity' misses the mechanism that uDRs steer subnet traffic to a virtual appliance where permitted by forwarding and firewall rules. Choosing 'Evaluate route selection including user-defined overrides and longest-prefix specificity' would address that other need, whereas 'Associate a user-defined route with the appliance's private IP as next hop' is intended to solve the stated condition.

A user-defined route targeting a stopped network virtual appliance still selects an unavailable next hop; creating an identical route does not make the appliance forward packets. The problem is not missing route syntax or the priority of the same entry, but the actual endpoint receiving forwarded traffic. The operator must point the route at a healthy, correctly configured inspection NVA, or restore that appliance through an authorized process, and check the resulting effective route and return traffic.

The premise states that the existing route table is associated with the production subnet, so an unrelated new table with no subnet association cannot affect its outgoing traffic. Even if the new table contains a correct route, Azure evaluates effective routes for each attached NIC according to the subnet route association. The specified packet path would still use the original route to the stopped NVA. Repair the active UDR and validate its forwarding endpoint instead.

Directly routing production traffic to the Internet might appear to bypass the outage, but this scenario requires that the path remain inspected by an authorized network virtual appliance. The proposed exception explicitly defeats that control and can expose the subnet to uncontrolled egress. It also avoids diagnosing the route that still targets a stopped appliance. Use the healthy replacement NVA as the next hop, retain expected return routing and confirm effective paths instead of claiming reachability alone is a safe resolution.

The nearby action 'Associate a user-defined route with the appliance's private IP as next hop' is associated with this separate need: traffic from a spoke subnet must be inspected by a firewall appliance before reaching another network. That is because uDRs steer subnet traffic to a virtual appliance where permitted by forwarding and firewall rules. Here a subnet has a user-defined route overriding a built-in system route, and traffic takes the custom path, so 'Associate a user-defined route with the appliance's private IP as next hop' misses the fact that system routes and custom routes have defined precedence and effective routing must be inspected. 'Evaluate route selection including user-defined overrides and longest-prefix specificity' is the more defensible action; confirm its behavior in the target service before calling the task complete.

Azure effective route selection depends on both prefix specificity and route-source precedence under supported conditions. A user-defined route can override a system route for the same prefix, but a more specific matching route can change the decision. A diagnosis that simply sees a UDR and ignores effective prefixes is incomplete. The question asks why a particular custom path was selected, so review effective route priority and longest-prefix matching together.

'Review effective routes and user-defined route priorities after peering' applies to a different feature boundary because peering connection status is separate from chosen next hop and network security evaluation. In the stated scenario where a subnet has a user-defined route overriding a built-in system route, and traffic takes the custom path, 'Review effective routes and user-defined route priorities after peering' does not satisfy the mechanism that system routes and custom routes have defined precedence and effective routing must be inspected. The necessary action is 'Evaluate route selection including user-defined overrides and longest-prefix specificity', which should be checked against this Azure resource's actual permissions and state.

'Associate a user-defined route with the appliance's private IP as next hop' solves another task because uDRs steer subnet traffic to a virtual appliance where permitted by forwarding and firewall rules. For the situation where a new peering route appears but a subnet still sends packets through its custom appliance, this distractor misses the requirement that peering doesn't necessarily override a more specific user-defined route. Unlike 'Associate a user-defined route with the appliance's private IP as next hop', 'Inspect effective route entries, prefix lengths and UDR priority' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Azure creates system routes when VNets are peered, but user-defined routes may override those system routes for the same prefix or more specific destinations. An existing NVA route can therefore remain selected after peering is established. Assuming that peering always wins would contradict the observed forwarding path and cannot explain why packets still reach the appliance. Inspect the affected NIC effective route table, prefix specificity and route source for the destination. Only then consider whether the UDR is intentional or needs a targeted change.

Deleting a VNet peering would remove an intended connectivity path but would not diagnose which effective route sent the traffic to the custom appliance. The question already observes a peering system route, alongside existing custom routing. Azure route selection depends on destination prefix and route source, and a UDR can override a peering system route. Compare the effective route entries, chosen next hop and relevant prefix lengths before making any network changes. Removing peering blindly can disrupt unrelated traffic while leaving the underlying UDR design unexamined.

'Associate the route table with the intended subnet' solves another task because route tables apply to attached subnets, not automatically to an entire VNet. For the situation where a new peering route appears but a subnet still sends packets through its custom appliance, this distractor misses the requirement that peering doesn't necessarily override a more specific user-defined route. Unlike 'Associate the route table with the intended subnet', 'Inspect effective route entries, prefix lengths and UDR priority' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When traffic from a spoke subnet must be inspected by a firewall appliance before reaching another network, the action 'Associate a user-defined route with the appliance's private IP as next hop' can be relevant: uDRs steer subnet traffic to a virtual appliance where permitted by forwarding and firewall rules. For the different problem of a route table was created but packets from the intended VM subnet are unchanged, 'Associate a user-defined route with the appliance's private IP as next hop' misses the mechanism that route tables apply to attached subnets, not automatically to an entire VNet. Choosing 'Associate a user-defined route with the appliance's private IP as next hop' would address that other need, whereas 'Associate the route table with the intended subnet' is intended to solve the stated condition.

'Inspect effective route entries, prefix lengths and UDR priority' applies to a different feature boundary because peering doesn't necessarily override a more specific user-defined route. In the stated scenario where a route table was created but packets from the intended VM subnet are unchanged, 'Inspect effective route entries, prefix lengths and UDR priority' does not satisfy the mechanism that route tables apply to attached subnets, not automatically to an entire VNet. The necessary action is 'Associate the route table with the intended subnet', which should be checked against this Azure resource's actual permissions and state.

'Correct the UDR next hop to an available forwarding appliance or path' solves another task because routing depends on a functioning next hop; Azure does not automatically bypass a bad UDR. For the situation where a route table was created but packets from the intended VM subnet are unchanged, this distractor misses the requirement that route tables apply to attached subnets, not automatically to an entire VNet. Unlike 'Correct the UDR next hop to an available forwarding appliance or path', 'Associate the route table with the intended subnet' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Associate a user-defined route with the appliance's private IP as next hop' applies to a different feature boundary because uDRs steer subnet traffic to a virtual appliance where permitted by forwarding and firewall rules. In the stated scenario where a company forces all outbound VNet traffic through an on-premises firewall and Azure PaaS connectivity slows or fails, 'Associate a user-defined route with the appliance's private IP as next hop' does not satisfy the mechanism that traffic to PaaS can follow unexpected routes; security design must preserve permitted egress. The necessary action is 'Evaluate forced tunneling routes and supported service endpoint/private endpoint paths', which should be checked against this Azure resource's actual permissions and state.

'Evaluate route selection including user-defined overrides and longest-prefix specificity' solves another task because system routes and custom routes have defined precedence and effective routing must be inspected. For the situation where a company forces all outbound VNet traffic through an on-premises firewall and Azure PaaS connectivity slows or fails, this distractor misses the requirement that traffic to PaaS can follow unexpected routes; security design must preserve permitted egress. Unlike 'Evaluate route selection including user-defined overrides and longest-prefix specificity', 'Evaluate forced tunneling routes and supported service endpoint/private endpoint paths' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When several VMs need outbound internet but security forbids attaching a public IP to each, the action 'Use a supported shared outbound path such as NAT Gateway or approved firewall' can be relevant: outbound egress does not require individually internet-addressable VM network interfaces. For the different problem of a company forces all outbound VNet traffic through an on-premises firewall and Azure PaaS connectivity slows or fails, 'Use a supported shared outbound path such as NAT Gateway or approved firewall' misses the mechanism that traffic to PaaS can follow unexpected routes; security design must preserve permitted egress. Choosing 'Use a supported shared outbound path such as NAT Gateway or approved firewall' would address that other need, whereas 'Evaluate forced tunneling routes and supported service endpoint/private endpoint paths' is intended to solve the stated condition.

A route through a second inspection appliance does not satisfy the requirement to bypass the appliance path for a specific Azure control-plane endpoint when policy forbids that inspection. It simply substitutes a different next-hop device while leaving the routing exception absent. The authorized change is a narrowly matched route or network service exception that selects the permitted next hop for the documented endpoint prefix. Examine effective routes after applying it, then verify the real control-plane connection while retaining monitoring for traffic that should still traverse inspection.

When traffic from a spoke subnet must be inspected by a firewall appliance before reaching another network, the action 'Associate a user-defined route with the appliance's private IP as next hop' can be relevant: uDRs steer subnet traffic to a virtual appliance where permitted by forwarding and firewall rules. For the different problem of operations traffic to an Azure control-plane endpoint must bypass a failing inspection appliance under policy, 'Associate a user-defined route with the appliance's private IP as next hop' misses the mechanism that a deliberate exception is safer than disabling the entire firewall or ignoring the failing route. Choosing 'Associate a user-defined route with the appliance's private IP as next hop' would address that other need, whereas 'Implement a narrowly scoped approved route exception and verify effective next hop' is intended to solve the stated condition.

'Inspect effective route entries, prefix lengths and UDR priority' applies to a different feature boundary because peering doesn't necessarily override a more specific user-defined route. In the stated scenario where operations traffic to an Azure control-plane endpoint must bypass a failing inspection appliance under policy, 'Inspect effective route entries, prefix lengths and UDR priority' does not satisfy the mechanism that a deliberate exception is safer than disabling the entire firewall or ignoring the failing route. The necessary action is 'Implement a narrowly scoped approved route exception and verify effective next hop', which should be checked against this Azure resource's actual permissions and state.

'Inspect application listener and service health instead of immediately changing VNet routes' solves another task because a responding transport endpoint shows basic path exists; the app can still fail at higher layers. For the situation where a client can resolve a service name but TCP connection is refused, while another client cannot resolve it, this distractor misses the requirement that name resolution problems and transport denial have different evidence and corrective actions. Unlike 'Inspect application listener and service health instead of immediately changing VNet routes', 'Test DNS resolution separately from TCP listener and network path' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a connection fails intermittently and operations need packet-level evidence on the affected VM, the action 'Capture packets with Azure Network Watcher where supported' can be relevant: packet capture records traffic timing and path clues; Next hop alone doesn't expose packet details. For the different problem of a client can resolve a service name but TCP connection is refused, while another client cannot resolve it, 'Capture packets with Azure Network Watcher where supported' misses the mechanism that name resolution problems and transport denial have different evidence and corrective actions. Choosing 'Capture packets with Azure Network Watcher where supported' would address that other need, whereas 'Test DNS resolution separately from TCP listener and network path' is intended to solve the stated condition.

'Correct asymmetric effective routes and stateful inspection path' applies to a different feature boundary because stateful firewalls need consistent return routing; security rules alone may not resolve asymmetry. In the stated scenario where a client can resolve a service name but TCP connection is refused, while another client cannot resolve it, 'Correct asymmetric effective routes and stateful inspection path' does not satisfy the mechanism that name resolution problems and transport denial have different evidence and corrective actions. The necessary action is 'Test DNS resolution separately from TCP listener and network path', which should be checked against this Azure resource's actual permissions and state.