Pass Your Microsoft AZ-104 Exam Easy!

When a response packet is blocked according to a team that already allowed the original outbound TCP connection, the action 'Account for NSG stateful flow tracking for permitted connections' can be relevant: allowed established flows normally permit return traffic without a separate inverse rule. For the different problem of before deleting a suspicious NSG deny, the operator wants objective evidence of which rule blocks a test connection, 'Account for NSG stateful flow tracking for permitted connections' misses the mechanism that effective-rule tooling identifies matched rules; wholesale deletion is premature. Choosing 'Account for NSG stateful flow tracking for permitted connections' would address that other need, whereas 'Inspect effective security rules or Network Watcher IP flow verify' is intended to solve the stated condition.

Azure NSG rules are evaluated by priority among rules whose direction, addresses, protocol and port ranges match the packet. The lowest number is not proof of a block if the rule does not match the test flow. The operator needs objective evidence of the particular denying rule before changing a security control. Network Watcher IP flow verify and effective security-rule inspection can evaluate the real five-tuple and relevant subnet/NIC policy. A priority-only list can point to the wrong rule and encourage an unnecessary or unsafe deletion.

The nearby action 'Use a valid custom rule with higher evaluation priority and the correct tuple' is associated with this separate need: a new custom NSG allow should supersede a broad default deny. That is because built-in default rules apply only after more specific custom rules that match first. Here before deleting a suspicious NSG deny, the operator wants objective evidence of which rule blocks a test connection, so 'Use a valid custom rule with higher evaluation priority and the correct tuple' misses the fact that effective-rule tooling identifies matched rules; wholesale deletion is premature. 'Inspect effective security rules or Network Watcher IP flow verify' is the more defensible action; confirm its behavior in the target service before calling the task complete.

An NSG rule label has no authority to create an Azure virtual network subnet or satisfy an Azure Bastion host's subnet prerequisite. The required resource is a dedicated subnet with the reserved name AzureBastionSubnet and a supported CIDR size; a mere rule rename leaves that subnet absent. Network security rules may still need review after the host deploys, but they are a separate configuration boundary. Create the correct subnet in the intended VNet, respecting Bastion SKU requirements, before attempting the host deployment again.

RDP rules on the target VM determine whether permitted administration traffic can reach the VM once Bastion is running. They do not create the Bastion service host or provide its dedicated deployment subnet. In this scenario host creation is failing before any Bastion-to-VM flow is available, so changing only an RDP NSG rule cannot resolve the missing reserved subnet and undersized address space. Provision the required AzureBastionSubnet first, then diagnose network access rules only if a deployed Bastion host has a connection problem.

A browser session requires a provisioned Bastion host to broker the RDP or SSH connection. The deployment has already failed because the dedicated Bastion subnet prerequisite is not met, so an attempted login cannot prove or repair the missing infrastructure. Test sessions after provisioning succeeds and required security rules and role permissions are in place. The first correction is to create a properly named and sized AzureBastionSubnet in the appropriate VNet, which is a deployment requirement distinct from a VM's interactive login settings.

Private DNS can help resolve selected Azure private service names, but it does not create a subnet named AzureBastionSubnet or increase an undersized VNet address range. A Bastion Basic host needs the reserved dedicated subnet before provisioning can succeed, independently of whether the target VM has a resolvable hostname. Creating a private DNS zone alone therefore changes name-resolution configuration while leaving the actual Bastion deployment blocker intact. Correct the subnet's name, size and dedicated use, then revisit DNS only for a specific later name-resolution symptom.

The nearby action 'Check guest OS account credentials and VM authentication separately' is associated with this separate need: bastion establishes a session path to a VM but the operating system rejects the login. That is because bastion connectivity does not create a valid Windows/Linux login credential. Here an Azure Bastion deployment fails because the VNet has no correctly named dedicated subnet, so 'Check guest OS account credentials and VM authentication separately' misses the fact that bastion has a dedicated subnet naming and sizing prerequisite, which varies by SKU capability. 'Configure the required AzureBastionSubnet with supported address size' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Check supported Bastion private-only deployment options and SKU prerequisites' solves another task because private Bastion offerings are capability-dependent and cannot be assumed for every deployment. For the situation where an Azure Bastion deployment fails because the VNet has no correctly named dedicated subnet, this distractor misses the requirement that bastion has a dedicated subnet naming and sizing prerequisite, which varies by SKU capability. Unlike 'Check supported Bastion private-only deployment options and SKU prerequisites', 'Configure the required AzureBastionSubnet with supported address size' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a Bastion host appears healthy yet cannot connect to a target VM's management port, the action 'Verify permitted Bastion-to-VM RDP/SSH flow in effective NSGs' can be relevant: the Bastion service still needs an authorized path to the VM management listener. For the different problem of an Azure Bastion deployment fails because the VNet has no correctly named dedicated subnet, 'Verify permitted Bastion-to-VM RDP/SSH flow in effective NSGs' misses the mechanism that bastion has a dedicated subnet naming and sizing prerequisite, which varies by SKU capability. Choosing 'Verify permitted Bastion-to-VM RDP/SSH flow in effective NSGs' would address that other need, whereas 'Configure the required AzureBastionSubnet with supported address size' is intended to solve the stated condition.

For dedicated Azure Bastion SKUs, a correctly named AzureBastionSubnet with the supported size is a deployment requirement independent of selecting an otherwise valid Bastion tier. Retrying the host creation on a differently named ordinary VNet subnet leaves the identified prerequisite absent, so the same class of deployment error remains. Create the reserved subnet in the intended virtual network with sufficient address space first, then deploy the selected supported Bastion SKU and confirm effective connectivity. Changing only the host SKU cannot rename a subnet.

The nearby action 'Verify permitted Bastion-to-VM RDP/SSH flow in effective NSGs' is associated with this separate need: a Bastion host appears healthy yet cannot connect to a target VM's management port. That is because the Bastion service still needs an authorized path to the VM management listener. Here bastion establishes a session path to a VM but the operating system rejects the login, so 'Verify permitted Bastion-to-VM RDP/SSH flow in effective NSGs' misses the fact that bastion connectivity does not create a valid Windows/Linux login credential. 'Check guest OS account credentials and VM authentication separately' is the more defensible action; confirm its behavior in the target service before calling the task complete.

Azure Bastion establishes a protected management transport path, but it does not automatically supply valid credentials to the target Windows or Linux operating system. The stated symptom occurs after a path exists and the guest rejects the login. Repeating the same connection or assuming the Bastion tunnel authenticates the guest will not resolve an invalid password, missing Microsoft Entra VM login extension, wrong local account or SSH key. Review the actual guest authentication mechanism and relevant failed-login evidence; network reachability and OS authorization are separate checks.

When security needs Bastion management access with restricted private connectivity, the action 'Check supported Bastion private-only deployment options and SKU prerequisites' can be relevant: private Bastion offerings are capability-dependent and cannot be assumed for every deployment. For the different problem of bastion establishes a session path to a VM but the operating system rejects the login, 'Check supported Bastion private-only deployment options and SKU prerequisites' misses the mechanism that bastion connectivity does not create a valid Windows/Linux login credential. Choosing 'Check supported Bastion private-only deployment options and SKU prerequisites' would address that other need, whereas 'Check guest OS account credentials and VM authentication separately' is intended to solve the stated condition.

When a private VM requires browser-based RDP/SSH administration while security forbids VM public IP addresses, the action 'Deploy Azure Bastion with supported subnet and SKU configuration' can be relevant: bastion brokers management sessions without requiring a public IP on each protected VM. For the different problem of a business wants remote employees to reach all private applications, not just administer a few VMs, 'Deploy Azure Bastion with supported subnet and SKU configuration' misses the mechanism that bastion focuses on secure VM administration, not arbitrary whole-network user tunnels. Choosing 'Deploy Azure Bastion with supported subnet and SKU configuration' would address that other need, whereas 'Use VPN gateway or other network access for general client connectivity' is intended to solve the stated condition.

'Verify permitted Bastion-to-VM RDP/SSH flow in effective NSGs' applies to a different feature boundary because the Bastion service still needs an authorized path to the VM management listener. In the stated scenario where a business wants remote employees to reach all private applications, not just administer a few VMs, 'Verify permitted Bastion-to-VM RDP/SSH flow in effective NSGs' does not satisfy the mechanism that bastion focuses on secure VM administration, not arbitrary whole-network user tunnels. The necessary action is 'Use VPN gateway or other network access for general client connectivity', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Check supported Bastion private-only deployment options and SKU prerequisites' is associated with this separate need: security needs Bastion management access with restricted private connectivity. That is because private Bastion offerings are capability-dependent and cannot be assumed for every deployment. Here a business wants remote employees to reach all private applications, not just administer a few VMs, so 'Check supported Bastion private-only deployment options and SKU prerequisites' misses the fact that bastion focuses on secure VM administration, not arbitrary whole-network user tunnels. 'Use VPN gateway or other network access for general client connectivity' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Check supported Bastion private-only deployment options and SKU prerequisites' applies to a different feature boundary because private Bastion offerings are capability-dependent and cannot be assumed for every deployment. In the stated scenario where a Bastion host appears healthy yet cannot connect to a target VM's management port, 'Check supported Bastion private-only deployment options and SKU prerequisites' does not satisfy the mechanism that the Bastion service still needs an authorized path to the VM management listener. The necessary action is 'Verify permitted Bastion-to-VM RDP/SSH flow in effective NSGs', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Deploy Azure Bastion with supported subnet and SKU configuration' is associated with this separate need: a private VM requires browser-based RDP/SSH administration while security forbids VM public IP addresses. That is because bastion brokers management sessions without requiring a public IP on each protected VM. Here a Bastion host appears healthy yet cannot connect to a target VM's management port, so 'Deploy Azure Bastion with supported subnet and SKU configuration' misses the fact that the Bastion service still needs an authorized path to the VM management listener. 'Verify permitted Bastion-to-VM RDP/SSH flow in effective NSGs' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Check guest OS account credentials and VM authentication separately' solves another task because bastion connectivity does not create a valid Windows/Linux login credential. For the situation where a Bastion host appears healthy yet cannot connect to a target VM's management port, this distractor misses the requirement that the Bastion service still needs an authorized path to the VM management listener. Unlike 'Check guest OS account credentials and VM authentication separately', 'Verify permitted Bastion-to-VM RDP/SSH flow in effective NSGs' directly targets that requirement; its success must be confirmed at the authorized resource scope.

VM-side RDP and SSH rules determine whether the Bastion service can reach the target guest, not whether the Bastion host itself can be deployed without a public IP. Those flows have already been verified in this scenario. Rechecking them is reasonable post-deployment troubleshooting but cannot establish entitlement to private-only hosting. Confirm the Bastion Premium SKU and its private-only feature availability separately from target-network access, and verify the deployed Bastion resource does not expose the prohibited public endpoint.

Azure Bastion Basic normally uses a public IP on the Bastion host and does not satisfy an explicit private-only, no-public-IP architecture. The question does not merely forbid public IPs on managed VMs; it forbids them on the Bastion service itself. Selecting a different NSG rule or providing the right reserved subnet cannot convert Basic's public deployment into Premium's private-only feature. Use an eligible Bastion SKU that supports private-only hosting and verify the actual service resource configuration.

The dedicated AzureBastionSubnet and supported prefix size are important prerequisites for dedicated Bastion deployments, but this scenario states the subnet already exists and is correctly sized. Its presence does not prove the service can run without a public IP. The unanswered design requirement is specifically the private-only SKU capability, which Microsoft associates with Premium Bastion. Recreating the same subnet would be disruptive and would not make an otherwise public-only SKU meet the compliance rule.

'Check guest OS account credentials and VM authentication separately' solves another task because bastion connectivity does not create a valid Windows/Linux login credential. For the situation where an administrator disables direct VM public RDP and uses Bastion; the team assumes security is proven without trying a session, this distractor misses the requirement that removing a public IP is helpful, but actual management path and authorization must work. Unlike 'Check guest OS account credentials and VM authentication separately', 'Test end-to-end Bastion login and inspect real access logs' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a Bastion host appears healthy yet cannot connect to a target VM's management port, the action 'Verify permitted Bastion-to-VM RDP/SSH flow in effective NSGs' can be relevant: the Bastion service still needs an authorized path to the VM management listener. For the different problem of an administrator disables direct VM public RDP and uses Bastion; the team assumes security is proven without trying a session, 'Verify permitted Bastion-to-VM RDP/SSH flow in effective NSGs' misses the mechanism that removing a public IP is helpful, but actual management path and authorization must work. Choosing 'Verify permitted Bastion-to-VM RDP/SSH flow in effective NSGs' would address that other need, whereas 'Test end-to-end Bastion login and inspect real access logs' is intended to solve the stated condition.

'Deploy Azure Bastion with supported subnet and SKU configuration' applies to a different feature boundary because bastion brokers management sessions without requiring a public IP on each protected VM. In the stated scenario where an administrator disables direct VM public RDP and uses Bastion; the team assumes security is proven without trying a session, 'Deploy Azure Bastion with supported subnet and SKU configuration' does not satisfy the mechanism that removing a public IP is helpful, but actual management path and authorization must work. The necessary action is 'Test end-to-end Bastion login and inspect real access logs', which should be checked against this Azure resource's actual permissions and state.

A storage account's public IP firewall rules are not a substitute for specifying a subnet through a VNet rule when service endpoints are the intended restricted-network design. Subnet B's private RFC1918 addresses are not the supported internet source addresses for this approach. Adding them as if they were public client IP ranges does not associate subnet B with Microsoft.Storage endpoint routing or authorization. Instead enable the correct service endpoint on the actual source subnet and add that subnet to the storage account's permitted VNet rules, then verify separate data-plane permissions.

Two subnets share a VNet address space but can have different service endpoints, user-defined routes and security settings. A service endpoint enabled on subnet A is not automatically active on subnet B, and the storage account VNet rule for A does not necessarily admit calls originating from B. The VM was explicitly relocated to subnet B; relying on VNet membership alone leaves the existing denial unexplained. Identify B as the caller's subnet, activate its supported endpoint and update the allowed VNet rule for that exact subnet before retesting.

Resource Group Reader is an Azure management-plane role that permits inspection of many resource configurations but cannot alter a storage firewall or create a Microsoft.Storage service endpoint on the new subnet. Even if this role lets an operator see the storage account, the VM's Blob request may still be blocked by the network configuration and the caller may still lack Blob data-plane rights. The technical change needed here is endpoint and firewall eligibility for subnet B, not a broad read-only management assignment on the resource group.

Removing the existing subnet A service endpoint does not create a new endpoint on subnet B. It could instead break healthy users already relying on A's approved route and its storage firewall entry. Azure evaluates the actual source subnet's endpoint and applicable storage VNet rule, so changing an unrelated subnet is not a remedy for the newly relocated VM. Keep A unchanged unless its own policy requires removal; enable the appropriate service endpoint and firewall rule for subnet B, then verify the intended storage operation under the caller's data permissions.

When an Azure VM subnet accesses Blob Storage's public endpoint with strict storage VNet rules, the action 'Configure a Microsoft.Storage service endpoint plus matching subnet rule' can be relevant: service endpoints let approved VNet subnet identity reach a PaaS public service endpoint. For the different problem of a team expects a service endpoint to assign a private IP to storage in its VNet, 'Configure a Microsoft.Storage service endpoint plus matching subnet rule' misses the mechanism that service endpoints connect to a service's public endpoint with subnet identity, not private IP allocation. Choosing 'Configure a Microsoft.Storage service endpoint plus matching subnet rule' would address that other need, whereas 'Use a private endpoint when a private IP in the VNet is required' is intended to solve the stated condition.

The nearby action 'Fix the private DNS resolution chain and VNet link for the client' is associated with this separate need: a VM with approved private endpoint access still resolves the storage service to a public IP. That is because endpoint creation alone does not guarantee every resolver selects the private address. Here a team expects a service endpoint to assign a private IP to storage in its VNet, so 'Fix the private DNS resolution chain and VNet link for the client' misses the fact that service endpoints connect to a service's public endpoint with subnet identity, not private IP allocation. 'Use a private endpoint when a private IP in the VNet is required' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Test private DNS, private route, endpoint approval and Blob data permission independently' solves another task because a private IP path solves only network access; data-plane authorization may still deny the request. For the situation where a team expects a service endpoint to assign a private IP to storage in its VNet, this distractor misses the requirement that service endpoints connect to a service's public endpoint with subnet identity, not private IP allocation. Unlike 'Test private DNS, private route, endpoint approval and Blob data permission independently', 'Use a private endpoint when a private IP in the VNet is required' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Enabling a storage service endpoint on a different subnet does not grant access to the subnet where this client actually originates. Storage firewall virtual-network rules must include the appropriate authorized subnet, and the service endpoint must apply to that same network path. This scenario says endpoint activation is complete but storage still denies the caller, so verify the precise effective subnet identity in the storage VNet rules. Adding an unrelated subnet would not repair the denied source and could grant access to unintended workloads.

'Check the product-specific supported service endpoint and subnet constraints' solves another task because service endpoints are not universal for every Azure service; choose a supported alternative when absent. For the situation where Storage still denies a subnet after service endpoint activation, this distractor misses the requirement that service endpoint enablement alone doesn't automatically authorize the subnet on the account firewall. Unlike 'Check the product-specific supported service endpoint and subnet constraints', 'Add the actual subnet to the storage account's allowed VNet rules' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a subnet may reach Azure Storage but only approved company storage accounts, the action 'Use a storage service endpoint policy where compatible' can be relevant: endpoint policies restrict which service resources the subnet can access beyond generic service route enablement. For the different problem of Storage still denies a subnet after service endpoint activation, 'Use a storage service endpoint policy where compatible' misses the mechanism that service endpoint enablement alone doesn't automatically authorize the subnet on the account firewall. Choosing 'Use a storage service endpoint policy where compatible' would address that other need, whereas 'Add the actual subnet to the storage account's allowed VNet rules' is intended to solve the stated condition.