Pass Your Microsoft AZ-104 Exam Easy!

'Inspect application listener and service health instead of immediately changing VNet routes' solves another task because a responding transport endpoint shows basic path exists; the app can still fail at higher layers. For the situation where a client can resolve a service name but TCP connection is refused, while another client cannot resolve it, this distractor misses the requirement that name resolution problems and transport denial have different evidence and corrective actions. Unlike 'Inspect application listener and service health instead of immediately changing VNet routes', 'Test DNS resolution separately from TCP listener and network path' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a connection fails intermittently and operations need packet-level evidence on the affected VM, the action 'Capture packets with Azure Network Watcher where supported' can be relevant: packet capture records traffic timing and path clues; Next hop alone doesn't expose packet details. For the different problem of a client can resolve a service name but TCP connection is refused, while another client cannot resolve it, 'Capture packets with Azure Network Watcher where supported' misses the mechanism that name resolution problems and transport denial have different evidence and corrective actions. Choosing 'Capture packets with Azure Network Watcher where supported' would address that other need, whereas 'Test DNS resolution separately from TCP listener and network path' is intended to solve the stated condition.

'Correct asymmetric effective routes and stateful inspection path' applies to a different feature boundary because stateful firewalls need consistent return routing; security rules alone may not resolve asymmetry. In the stated scenario where a client can resolve a service name but TCP connection is refused, while another client cannot resolve it, 'Correct asymmetric effective routes and stateful inspection path' does not satisfy the mechanism that name resolution problems and transport denial have different evidence and corrective actions. The necessary action is 'Test DNS resolution separately from TCP listener and network path', which should be checked against this Azure resource's actual permissions and state.

When a route table change reports Succeeded, but one application remains offline, the action 'Run targeted connectivity and application health tests after route change' can be relevant: ARM success does not prove the service's specific path and listener recovered. For the different problem of a VM cannot connect to a subnet service even though the route is present. Effective security rules show a deny on the destination port, 'Run targeted connectivity and application health tests after route change' misses the mechanism that a valid route is insufficient if an NSG denies the required flow. Choosing 'Run targeted connectivity and application health tests after route change' would address that other need, whereas 'Change the specific blocking NSG rule under authorized least-privilege review' is intended to solve the stated condition.

'Inspect effective route entries, prefix lengths and UDR priority' applies to a different feature boundary because peering doesn't necessarily override a more specific user-defined route. In the stated scenario where a VM cannot connect to a subnet service even though the route is present. Effective security rules show a deny on the destination port, 'Inspect effective route entries, prefix lengths and UDR priority' does not satisfy the mechanism that a valid route is insufficient if an NSG denies the required flow. The necessary action is 'Change the specific blocking NSG rule under authorized least-privilege review', which should be checked against this Azure resource's actual permissions and state.

'Associate the route table with the intended subnet' solves another task because route tables apply to attached subnets, not automatically to an entire VNet. For the situation where a VM cannot connect to a subnet service even though the route is present. Effective security rules show a deny on the destination port, this distractor misses the requirement that a valid route is insufficient if an NSG denies the required flow. Unlike 'Associate the route table with the intended subnet', 'Change the specific blocking NSG rule under authorized least-privilege review' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Capture packets with Azure Network Watcher where supported' applies to a different feature boundary because packet capture records traffic timing and path clues; Next hop alone doesn't expose packet details. In the stated scenario where one subnet's return packets are sent through a different firewall, causing sporadic drops, 'Capture packets with Azure Network Watcher where supported' does not satisfy the mechanism that stateful firewalls need consistent return routing; security rules alone may not resolve asymmetry. The necessary action is 'Correct asymmetric effective routes and stateful inspection path', which should be checked against this Azure resource's actual permissions and state.

'Change the specific blocking NSG rule under authorized least-privilege review' solves another task because a valid route is insufficient if an NSG denies the required flow. For the situation where one subnet's return packets are sent through a different firewall, causing sporadic drops, this distractor misses the requirement that stateful firewalls need consistent return routing; security rules alone may not resolve asymmetry. Unlike 'Change the specific blocking NSG rule under authorized least-privilege review', 'Correct asymmetric effective routes and stateful inspection path' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a client can resolve a service name but TCP connection is refused, while another client cannot resolve it, the action 'Test DNS resolution separately from TCP listener and network path' can be relevant: name resolution problems and transport denial have different evidence and corrective actions. For the different problem of one subnet's return packets are sent through a different firewall, causing sporadic drops, 'Test DNS resolution separately from TCP listener and network path' misses the mechanism that stateful firewalls need consistent return routing; security rules alone may not resolve asymmetry. Choosing 'Test DNS resolution separately from TCP listener and network path' would address that other need, whereas 'Correct asymmetric effective routes and stateful inspection path' is intended to solve the stated condition.

The nearby action 'Correct asymmetric effective routes and stateful inspection path' is associated with this separate need: one subnet's return packets are sent through a different firewall, causing sporadic drops. That is because stateful firewalls need consistent return routing; security rules alone may not resolve asymmetry. Here a client reaches a VM's IP and port through the VNet, but the application returns a 503, so 'Correct asymmetric effective routes and stateful inspection path' misses the fact that a responding transport endpoint shows basic path exists; the app can still fail at higher layers. 'Inspect application listener and service health instead of immediately changing VNet routes' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Test DNS resolution separately from TCP listener and network path' solves another task because name resolution problems and transport denial have different evidence and corrective actions. For the situation where a client reaches a VM's IP and port through the VNet, but the application returns a 503, this distractor misses the requirement that a responding transport endpoint shows basic path exists; the app can still fail at higher layers. Unlike 'Test DNS resolution separately from TCP listener and network path', 'Inspect application listener and service health instead of immediately changing VNet routes' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Run targeted connectivity and application health tests after route change' applies to a different feature boundary because ARM success does not prove the service's specific path and listener recovered. In the stated scenario where a client reaches a VM's IP and port through the VNet, but the application returns a 503, 'Run targeted connectivity and application health tests after route change' does not satisfy the mechanism that a responding transport endpoint shows basic path exists; the app can still fail at higher layers. The necessary action is 'Inspect application listener and service health instead of immediately changing VNet routes', which should be checked against this Azure resource's actual permissions and state.

'Test DNS resolution separately from TCP listener and network path' solves another task because name resolution problems and transport denial have different evidence and corrective actions. For the situation where a connection fails intermittently and operations need packet-level evidence on the affected VM, this distractor misses the requirement that packet capture records traffic timing and path clues; Next hop alone doesn't expose packet details. Unlike 'Test DNS resolution separately from TCP listener and network path', 'Capture packets with Azure Network Watcher where supported' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When one subnet's return packets are sent through a different firewall, causing sporadic drops, the action 'Correct asymmetric effective routes and stateful inspection path' can be relevant: stateful firewalls need consistent return routing; security rules alone may not resolve asymmetry. For the different problem of a connection fails intermittently and operations need packet-level evidence on the affected VM, 'Correct asymmetric effective routes and stateful inspection path' misses the mechanism that packet capture records traffic timing and path clues; Next hop alone doesn't expose packet details. Choosing 'Correct asymmetric effective routes and stateful inspection path' would address that other need, whereas 'Capture packets with Azure Network Watcher where supported' is intended to solve the stated condition.

The nearby action 'Review effective routes and user-defined route priorities after peering' is associated with this separate need: a VNet peering is configured but packet flow still goes to an unexpected appliance. That is because peering connection status is separate from chosen next hop and network security evaluation. Here a connection fails intermittently and operations need packet-level evidence on the affected VM, so 'Review effective routes and user-defined route priorities after peering' misses the fact that packet capture records traffic timing and path clues; Next hop alone doesn't expose packet details. 'Capture packets with Azure Network Watcher where supported' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When a VM cannot connect to a subnet service even though the route is present. Effective security rules show a deny on the destination port, the action 'Change the specific blocking NSG rule under authorized least-privilege review' can be relevant: a valid route is insufficient if an NSG denies the required flow. For the different problem of a route table change reports Succeeded, but one application remains offline, 'Change the specific blocking NSG rule under authorized least-privilege review' misses the mechanism that ARM success does not prove the service's specific path and listener recovered. Choosing 'Change the specific blocking NSG rule under authorized least-privilege review' would address that other need, whereas 'Run targeted connectivity and application health tests after route change' is intended to solve the stated condition.

'Associate the route table with the intended subnet' applies to a different feature boundary because route tables apply to attached subnets, not automatically to an entire VNet. In the stated scenario where a route table change reports Succeeded, but one application remains offline, 'Associate the route table with the intended subnet' does not satisfy the mechanism that ARM success does not prove the service's specific path and listener recovered. The necessary action is 'Run targeted connectivity and application health tests after route change', which should be checked against this Azure resource's actual permissions and state.

The workload's listener status is useful but cannot by itself show that the new user-defined route selects the intended next hop or that real clients can reach the service. The scenario explicitly states the application remains offline after a successful ARM route-table update, so treating one local process check as full validation risks missing a wrong subnet association, asymmetric return route, or network policy block. Validate the effective routes and end-to-end packet and application flow, including both directions when inspection appliances are involved.

'Review outbound NSG rules and the flow's direction-specific tuple' applies to a different feature boundary because inbound allow is not general permission for new outbound connections. In the stated scenario where two inbound NSG rules exist: broad Allow priority 200 and narrow Deny priority 100, 'Review outbound NSG rules and the flow's direction-specific tuple' does not satisfy the mechanism that Azure NSGs evaluate matching rules in ascending priority; a broad later allow cannot override an earlier deny. The necessary action is 'The lower-priority-number deny rule wins when its tuple matches', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Use a valid custom rule with higher evaluation priority and the correct tuple' is associated with this separate need: a new custom NSG allow should supersede a broad default deny. That is because built-in default rules apply only after more specific custom rules that match first. Here two inbound NSG rules exist: broad Allow priority 200 and narrow Deny priority 100, so 'Use a valid custom rule with higher evaluation priority and the correct tuple' misses the fact that Azure NSGs evaluate matching rules in ascending priority; a broad later allow cannot override an earlier deny. 'The lower-priority-number deny rule wins when its tuple matches' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When two custom NSG rules contradict each other on TCP 443, the action 'Compare rule priority numbers and match conditions' can be relevant: only the earliest matching applicable priority rule governs that direction. For the different problem of two inbound NSG rules exist: broad Allow priority 200 and narrow Deny priority 100, 'Compare rule priority numbers and match conditions' misses the mechanism that Azure NSGs evaluate matching rules in ascending priority; a broad later allow cannot override an earlier deny. Choosing 'Compare rule priority numbers and match conditions' would address that other need, whereas 'The lower-priority-number deny rule wins when its tuple matches' is intended to solve the stated condition.

'Evaluate both applied NSGs and their combined allow/deny outcome' applies to a different feature boundary because traffic must satisfy relevant security checks at each applicable network boundary. In the stated scenario where two inbound NSG rules exist: broad Allow priority 200 and narrow Deny priority 100, 'Evaluate both applied NSGs and their combined allow/deny outcome' does not satisfy the mechanism that Azure NSGs evaluate matching rules in ascending priority; a broad later allow cannot override an earlier deny. The necessary action is 'The lower-priority-number deny rule wins when its tuple matches', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'The lower-priority-number deny rule wins when its tuple matches' is associated with this separate need: two inbound NSG rules exist: broad Allow priority 200 and narrow Deny priority 100. That is because Azure NSGs evaluate matching rules in ascending priority; a broad later allow cannot override an earlier deny. Here a VM can accept inbound HTTPS but cannot initiate a connection to a remote API, so 'The lower-priority-number deny rule wins when its tuple matches' misses the fact that inbound allow is not general permission for new outbound connections. 'Review outbound NSG rules and the flow's direction-specific tuple' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Account for NSG stateful flow tracking for permitted connections' solves another task because allowed established flows normally permit return traffic without a separate inverse rule. For the situation where a VM can accept inbound HTTPS but cannot initiate a connection to a remote API, this distractor misses the requirement that inbound allow is not general permission for new outbound connections. Unlike 'Account for NSG stateful flow tracking for permitted connections', 'Review outbound NSG rules and the flow's direction-specific tuple' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Allow the frontend ASG or subnet to the backend on required TCP 8443 only' applies to a different feature boundary because a constrained five-tuple protects the backend without an unnecessary global service allow. In the stated scenario where a VM can accept inbound HTTPS but cannot initiate a connection to a remote API, 'Allow the frontend ASG or subnet to the backend on required TCP 8443 only' does not satisfy the mechanism that inbound allow is not general permission for new outbound connections. The necessary action is 'Review outbound NSG rules and the flow's direction-specific tuple', which should be checked against this Azure resource's actual permissions and state.

Network security group rules match traffic on source/destination address, protocol and port criteria as well as direction. The VM accepts inbound HTTPS, but that says nothing about the separate outbound flow to a remote API. Inspect the effective outbound NSG rules using the remote API’s destination and the actual packet tuple. Checking only the inbound listener’s source port would not locate the outbound deny condition.

'Correct source/destination addresses, ports and protocol for actual packet direction' solves another task because NSG rule matching depends on each field in the connection tuple. For the situation where Network policies should apply to all web NICs without listing each changing private IP, this distractor misses the requirement that aSGs group eligible NICs for rule matching instead of static address lists. Unlike 'Correct source/destination addresses, ports and protocol for actual packet direction', 'Use application security groups in supported NSG source/destination rules' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When an NSG rule allows source TCP port 443 but browsers connect from ephemeral client ports to destination 443, the action 'Match the correct destination port and leave client source port appropriately broad' can be relevant: client source ports are usually ephemeral; confusing source/destination fields prevents intended connections. For the different problem of Network policies should apply to all web NICs without listing each changing private IP, 'Match the correct destination port and leave client source port appropriately broad' misses the mechanism that aSGs group eligible NICs for rule matching instead of static address lists. Choosing 'Match the correct destination port and leave client source port appropriately broad' would address that other need, whereas 'Use application security groups in supported NSG source/destination rules' is intended to solve the stated condition.

The nearby action 'Use a private endpoint when a private IP in the VNet is required' is associated with this separate need: a team expects a service endpoint to assign a private IP to storage in its VNet. That is because service endpoints connect to a service's public endpoint with subnet identity, not private IP allocation. Here Network policies should apply to all web NICs without listing each changing private IP, so 'Use a private endpoint when a private IP in the VNet is required' misses the fact that aSGs group eligible NICs for rule matching instead of static address lists. 'Use application security groups in supported NSG source/destination rules' is the more defensible action; confirm its behavior in the target service before calling the task complete.

The client initiates an HTTPS connection from a transient high-numbered source port, not normally from TCP source port 443. Keeping that wrong source-port match means a broad destination port range does not cause the rule to match the reported flow. It also grants unnecessary destination-port breadth if a qualifying request somehow arrives. Correct the tuple to cover client ephemeral source ports with a suitably broad source-port rule while restricting the destination to approved TCP 443 and the intended source address range.

The nearby action 'Allow the frontend ASG or subnet to the backend on required TCP 8443 only' is associated with this separate need: a public frontend should contact only one backend service on TCP 8443. That is because a constrained five-tuple protects the backend without an unnecessary global service allow. Here an NSG rule allows source TCP port 443 but browsers connect from ephemeral client ports to destination 443, so 'Allow the frontend ASG or subnet to the backend on required TCP 8443 only' misses the fact that client source ports are usually ephemeral; confusing source/destination fields prevents intended connections. 'Match the correct destination port and leave client source port appropriately broad' is the more defensible action; confirm its behavior in the target service before calling the task complete.

A second NSG rule with the same incorrect TCP source-port-443 condition repeats the error. Broadening or ignoring the destination port without matching the actual ephemeral source port cannot reliably permit a normal browser request. The case names the intended server-side destination port and explains the existing failure; configure source ports for client-originated connections and destination 443 explicitly instead. Verify rule priority, stateful connection behavior and the matching five-tuple before considering the flow restored.

When Network policies should apply to all web NICs without listing each changing private IP, the action 'Use application security groups in supported NSG source/destination rules' can be relevant: aSGs group eligible NICs for rule matching instead of static address lists. For the different problem of an NSG rule allows source TCP port 443 but browsers connect from ephemeral client ports to destination 443, 'Use application security groups in supported NSG source/destination rules' misses the mechanism that client source ports are usually ephemeral; confusing source/destination fields prevents intended connections. Choosing 'Use application security groups in supported NSG source/destination rules' would address that other need, whereas 'Match the correct destination port and leave client source port appropriately broad' is intended to solve the stated condition.

'The lower-priority-number deny rule wins when its tuple matches' applies to a different feature boundary because Azure NSGs evaluate matching rules in ascending priority; a broad later allow cannot override an earlier deny. In the stated scenario where both subnet and NIC NSGs apply to a VM, 'The lower-priority-number deny rule wins when its tuple matches' does not satisfy the mechanism that traffic must satisfy relevant security checks at each applicable network boundary. The necessary action is 'Evaluate both applied NSGs and their combined allow/deny outcome', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Correct the NIC's ASG association and verify rule scope' is associated with this separate need: an application security group name was added to an NSG rule but one backend NIC isn't a member. That is because nSGs match eligible NIC group membership, not merely a similarly named application tag. Here both subnet and NIC NSGs apply to a VM, so 'Correct the NIC's ASG association and verify rule scope' misses the fact that traffic must satisfy relevant security checks at each applicable network boundary. 'Evaluate both applied NSGs and their combined allow/deny outcome' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When both a subnet NSG and a network-interface NSG apply, a connection must pass the applicable rules at both scopes for its direction. An allow on the NIC does not erase a matching deny on the subnet, and the reverse can also fail. The scenario explicitly says both NSGs are attached, so inspecting only one level gives an incomplete access decision. Evaluate the same source/destination address, protocol, and port tuple through both effective rule sets before adding a rule or declaring the VM protected.