Pass Your Microsoft AZ-104 Exam Easy!

Enabling public network access for every source would bypass the storage account's explicitly required private-only boundary. It might hide a DNS or routing mistake by allowing clients to reach the public endpoint, but that would not prove the private endpoint is functioning correctly. The endpoint can appear healthy in the Azure control plane while the application still resolves the public address or lacks data authorization. Keep public networking disabled, then test the client's actual DNS answer, private route and data-plane permission. Those three targeted checks distinguish network isolation failures from authorization failures without weakening security.

Subscription Owner is a powerful management-plane role, but a user does not automatically gain Microsoft Entra Blob Storage data read access merely by receiving that role. Some authorized principals may access account keys depending on settings and permissions, yet that is not evidence of least-privilege Blob DataActions for the application's identity. Elevating an operator to Owner would also leave a misrouted client or incorrect private DNS answer untouched. Check the caller's actual supported blob authorization mechanism and effective data permissions while separately validating DNS and the private endpoint network path. Broad Owner assignment is not an appropriate first diagnostic repair.

Creating another private endpoint without identifying the failed layer duplicates infrastructure and can add conflicting DNS records. The scenario already says an endpoint reports healthy; that status does not show whether the application resolves the correct storage hostname, can route to the private IP, or has permission to read the blob. Diagnose the existing endpoint's approval state, the client's network path and name resolution, and the caller's Blob data authorization before creating anything new. If a defect is found in one of those layers, correct that layer rather than adding a second endpoint blindly.

An ordinary A record maps a hostname to an IPv4 address; it does not delegate authority over a DNS subdomain. The requirement is not merely to resolve one API endpoint today, but to allow a separately administered public DNS zone to host names and records under `api.acme.example`. Publishing an A record in the parent zone might let a client reach a single address, but those queries would still be answered under the parent's record management and would not discover the intended child-zone nameservers. An NS delegation at the `api` label is required for independent child-zone authority.

The existing registrar delegation for `acme.example` is already correct and must continue to direct the public DNS hierarchy to its parent zone. Replacing the entire domain's registrar name servers with those of the `api.acme.example` child would transfer or break authority for unrelated names in the parent and is not the supported subdomain delegation process. The correct change is made inside the Azure-hosted parent zone, where an NS record set points specifically the `api` subdomain at the child nameservers. The parent registrar record remains untouched.

Azure Private DNS zones serve private resolution scopes for linked virtual networks and configured forwarding clients. They do not publish authoritative records for arbitrary external internet resolvers in the public DNS hierarchy. This request explicitly requires an independently administered public child subdomain under an already delegated public parent. Linking a private zone to VNets may serve internal workloads, but it would not create an `api` NS delegation visible to internet recursive DNS services. The public Azure DNS child zone and parent NS record set address the required authority boundary.

A CNAME record aliases one DNS name to another and is used for name-to-name resolution, not authoritative zone delegation. Publishing a CNAME to a name-server hostname does not instruct recursive resolvers to query that server as the authority for all records beneath the `api.acme.example` child. DNS delegates subdomains using NS records in the parent zone. The team should use the Azure child zone's assigned authoritative name servers in an `api` NS record set, leaving normal A, AAAA, CNAME or TXT resource records to be managed within the appropriate delegated zone.

The nearby action 'Use an Azure Private DNS zone linked to authorized VNets' is associated with this separate need: one hostname should resolve to a private IP only inside selected VNets. That is because private zone resolution depends on VNet links or configured forwarding; public Azure DNS is different. Here an internal application hostname must resolve directly to a stable IPv4 address, so 'Use an Azure Private DNS zone linked to authorized VNets' misses the fact that an A record maps a name to an IPv4 address; CNAME would point to another DNS name. 'Publish an A record pointing the hostname to that IPv4 address' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Reduce TTL ahead of cutover and allow caches to expire before retiring the old endpoint' solves another task because TTL controls resolver caching duration; an immediate record change is not instant for every client. For the situation where an internal application hostname must resolve directly to a stable IPv4 address, this distractor misses the requirement that an A record maps a name to an IPv4 address; CNAME would point to another DNS name. Unlike 'Reduce TTL ahead of cutover and allow caches to expire before retiring the old endpoint', 'Publish an A record pointing the hostname to that IPv4 address' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a website uses a supported Azure resource that changes IPs behind a stable Azure frontend, the action 'Evaluate an Azure DNS alias record targeting that supported Azure resource' can be relevant: alias records bind supported resource identifiers rather than copying mutable address literals. For the different problem of an internal application hostname must resolve directly to a stable IPv4 address, 'Evaluate an Azure DNS alias record targeting that supported Azure resource' misses the mechanism that an A record maps a name to an IPv4 address; CNAME would point to another DNS name. Choosing 'Evaluate an Azure DNS alias record targeting that supported Azure resource' would address that other need, whereas 'Publish an A record pointing the hostname to that IPv4 address' is intended to solve the stated condition.

A standard A record can map the apex hostname to an IPv4 address, but it stores a literal value rather than maintaining a managed association with the Azure Public IP resource. If that address changes, the record must be revised by an administrator or external automation. The question specifically requires Azure DNS to follow a supported target resource rather than depend on a static text value. Azure DNS alias A records can reference Standard SKU public IP resources and maintain the record as the associated resource's address changes. The design should still monitor resource replacement and DNS correctness.

A conventional CNAME maps an alias hostname to another hostname, not directly to a numerical IPv4 address, and an ordinary DNS zone apex cannot be configured with a CNAME alongside mandatory SOA and NS records. This option fails both the record-value and apex constraints. Azure DNS supports resource-backed alias record sets, including alias A records targeting a supported Standard SKU Azure Public IP resource. For this public apex, that is the appropriate way to avoid manually storing the frontend's numeric address. Validate the authoritative Azure DNS zone and supported target before creating the record.

Azure Private DNS zones answer private DNS queries for appropriately linked virtual networks and configured resolvers. They are not authoritative public DNS zones for arbitrary internet clients, and placing this record only in a private zone would fail public reachability of `contoso.com`. The scenario explicitly uses an Azure DNS-hosted public zone apex and a Standard SKU public IP frontend. Create the supported public alias A record in that authoritative zone instead. Private DNS may serve internal split-horizon needs in other scenarios, but it does not substitute for this public record requirement.

When on-premises servers need to resolve private endpoint names in Azure, the action 'Configure supported DNS forwarding or Private Resolver to reach Azure private zones' can be relevant: on-premises DNS clients cannot necessarily use VNet private zone links directly without forwarding. For the different problem of an Azure public DNS zone has correct records, but external resolvers query old nameservers, 'Configure supported DNS forwarding or Private Resolver to reach Azure private zones' misses the mechanism that authoritative record creation has no effect if recursive resolvers are still sent to another provider. Choosing 'Configure supported DNS forwarding or Private Resolver to reach Azure private zones' would address that other need, whereas 'Update parent/registrar NS delegation to Azure DNS nameservers' is intended to solve the stated condition.

'Use an Azure Private DNS zone linked to authorized VNets' applies to a different feature boundary because private zone resolution depends on VNet links or configured forwarding; public Azure DNS is different. In the stated scenario where an Azure public DNS zone has correct records, but external resolvers query old nameservers, 'Use an Azure Private DNS zone linked to authorized VNets' does not satisfy the mechanism that authoritative record creation has no effect if recursive resolvers are still sent to another provider. The necessary action is 'Update parent/registrar NS delegation to Azure DNS nameservers', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Evaluate an Azure DNS alias record targeting that supported Azure resource' is associated with this separate need: a website uses a supported Azure resource that changes IPs behind a stable Azure frontend. That is because alias records bind supported resource identifiers rather than copying mutable address literals. Here an Azure public DNS zone has correct records, but external resolvers query old nameservers, so 'Evaluate an Azure DNS alias record targeting that supported Azure resource' misses the fact that authoritative record creation has no effect if recursive resolvers are still sent to another provider. 'Update parent/registrar NS delegation to Azure DNS nameservers' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Configure the correct private DNS zone group/records and VNet link' solves another task because private endpoint approval and IP assignment do not automatically repair an incorrect client resolver chain. For the situation where an Azure public DNS zone has correct records, but external resolvers query old nameservers, this distractor misses the requirement that authoritative record creation has no effect if recursive resolvers are still sent to another provider. Unlike 'Configure the correct private DNS zone group/records and VNet link', 'Update parent/registrar NS delegation to Azure DNS nameservers' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Azure DNS alias records can make a supported record point to an Azure resource rather than a hand-managed IP, which is valuable in a suitable architecture. But replacing a record with an alias during the same cutover cannot force recursive resolvers and clients to forget an A answer they already cached under its original TTL. The problem is specifically those stale answers during an address migration. The operator must reduce the TTL in advance and allow enough time for previous caches to age out, then update the appropriate record. Aliasing may be an additional design decision, not an instant cache invalidation mechanism.

Private DNS zone links apply to name resolution for selected VNets and private network resources. They can be essential for private endpoints and split-horizon internal naming, but the stem identifies the public A record and recursive caches used by website visitors. Altering VNet links would not change how external recursive resolvers honor the existing public TTL. The needed preparation is to reduce the public record set TTL ahead of the planned IP change, wait for older long-lived cached answers to expire, and then validate public resolution. This option addresses a different DNS namespace and does not mitigate the described caching problem.

Publishing the new A record is necessary at the cutover, but by itself it does not protect clients still carrying the old answer. If the old endpoint is retired immediately, those clients may fail until their cached record expires and they query again. This answer omits precisely the advance planning requested: lower the old public A-record TTL early enough and maintain an overlap or rollback period while DNS caches update. The Azure DNS authoritative servers can accept a new record promptly; they cannot purge all third-party recursive caches on command. An immediate edit with no TTL planning therefore fails the stated continuity requirement.

The nearby action 'Configure supported DNS forwarding or Private Resolver to reach Azure private zones' is associated with this separate need: on-premises servers need to resolve private endpoint names in Azure. That is because on-premises DNS clients cannot necessarily use VNet private zone links directly without forwarding. Here one hostname should resolve to a private IP only inside selected VNets, so 'Configure supported DNS forwarding or Private Resolver to reach Azure private zones' misses the fact that private zone resolution depends on VNet links or configured forwarding; public Azure DNS is different. 'Use an Azure Private DNS zone linked to authorized VNets' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Create a public Azure DNS zone and delegate authoritative nameservers from the registrar' solves another task because creating a zone inside Azure alone does not transfer public DNS authority until delegation is configured. For the situation where one hostname should resolve to a private IP only inside selected VNets, this distractor misses the requirement that private zone resolution depends on VNet links or configured forwarding; public Azure DNS is different. Unlike 'Create a public Azure DNS zone and delegate authoritative nameservers from the registrar', 'Use an Azure Private DNS zone linked to authorized VNets' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When an Azure public DNS zone has correct records, but external resolvers query old nameservers, the action 'Update parent/registrar NS delegation to Azure DNS nameservers' can be relevant: authoritative record creation has no effect if recursive resolvers are still sent to another provider. For the different problem of one hostname should resolve to a private IP only inside selected VNets, 'Update parent/registrar NS delegation to Azure DNS nameservers' misses the mechanism that private zone resolution depends on VNet links or configured forwarding; public Azure DNS is different. Choosing 'Update parent/registrar NS delegation to Azure DNS nameservers' would address that other need, whereas 'Use an Azure Private DNS zone linked to authorized VNets' is intended to solve the stated condition.

Private Resolver and DNS forwarding can solve hybrid or custom-DNS reachability problems, but the two clients here use Azure-provided DNS directly and do not have a forwarding-rule dependency. Introducing a resolver does not automatically limit zone access to the two approved VNets; it would add components beyond the stated requirement. Azure Private DNS supplies native virtual network links that select the VNets allowed to query a private zone. Create resolution links for the two authorized VNets and leave the third unlinked.

An A record maps a hostname to an IPv4 address within the DNS zone where that record exists. The scenario already has the correct private DNS zone and record, so publishing another ordinary A record does not control which VNets may resolve that private zone. With Azure-provided DNS, selected virtual-network links establish that resolution boundary. A record addition alone might provide an address value, but cannot grant access to precisely two VNets and withhold the zone from a third. Link only the approved VNets as resolution networks.

A public Azure DNS zone and registrar delegation are tools for publishing internet-visible authoritative records, not for limiting an existing Azure Private DNS zone to two selected VNets. Public delegation could expose internal service naming information or cause clients to resolve an unintended public destination. Here all clients use Azure-provided DNS and no public domain ownership change is required. The appropriate control is private-zone virtual network linking, keeping the third VNet out of the permitted resolution scope.

'Update parent/registrar NS delegation to Azure DNS nameservers' solves another task because authoritative record creation has no effect if recursive resolvers are still sent to another provider. For the situation where a storage private endpoint exists, but a VNet client lacks the required privatelink DNS record, this distractor misses the requirement that private endpoint approval and IP assignment do not automatically repair an incorrect client resolver chain. Unlike 'Update parent/registrar NS delegation to Azure DNS nameservers', 'Configure the correct private DNS zone group/records and VNet link' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a company purchased `acme.example` and wants Azure DNS to host records for `api.acme.example` publicly, the action 'Create a public Azure DNS zone and delegate authoritative nameservers from the registrar' can be relevant: creating a zone inside Azure alone does not transfer public DNS authority until delegation is configured. For the different problem of a storage private endpoint exists, but a VNet client lacks the required privatelink DNS record, 'Create a public Azure DNS zone and delegate authoritative nameservers from the registrar' misses the mechanism that private endpoint approval and IP assignment do not automatically repair an incorrect client resolver chain. Choosing 'Create a public Azure DNS zone and delegate authoritative nameservers from the registrar' would address that other need, whereas 'Configure the correct private DNS zone group/records and VNet link' is intended to solve the stated condition.

'Configure supported DNS forwarding or Private Resolver to reach Azure private zones' applies to a different feature boundary because on-premises DNS clients cannot necessarily use VNet private zone links directly without forwarding. In the stated scenario where a storage private endpoint exists, but a VNet client lacks the required privatelink DNS record, 'Configure supported DNS forwarding or Private Resolver to reach Azure private zones' does not satisfy the mechanism that private endpoint approval and IP assignment do not automatically repair an incorrect client resolver chain. The necessary action is 'Configure the correct private DNS zone group/records and VNet link', which should be checked against this Azure resource's actual permissions and state.

The storage private endpoint's address belongs to a private VNet path and should be resolved through the approved private DNS zone. Publishing a hard-coded A record in an unrelated public zone does not configure the endpoint's zone group, may expose private-address metadata, and will not follow supported private endpoint record lifecycle events. The requirement specifically calls for automatic DNS record maintenance when the endpoint is recreated or changed. Configure the relevant private DNS zone group and preserve the VNet link rather than relying on external static public records.

When two VNets need to resolve the same internal service name, while a third must not, the action 'Link only the approved VNets to the private DNS zone' can be relevant: VNet links define private resolution reachability; zone existence doesn't publish private names to all networks. For the different problem of on-premises servers need to resolve private endpoint names in Azure, 'Link only the approved VNets to the private DNS zone' misses the mechanism that on-premises DNS clients cannot necessarily use VNet private zone links directly without forwarding. Choosing 'Link only the approved VNets to the private DNS zone' would address that other need, whereas 'Configure supported DNS forwarding or Private Resolver to reach Azure private zones' is intended to solve the stated condition.

Publishing a private endpoint A record in a publicly delegated DNS zone would expose an internal address through an unintended public namespace and still would not provide a usable hybrid resolution path or private connectivity for the on-premises callers. Azure Private DNS zones are resolved from linked virtual networks or a supported forwarding path, not by making internal records publicly authoritative. Configure conditional forwarding from the on-premises resolver toward Azure DNS Private Resolver or a supported forwarder and verify that the application obtains the private endpoint's address using the approved network connection.

A private DNS zone link controls DNS resolution for linked Azure virtual networks, not arbitrary on-premises DNS servers across the network boundary. On-premises servers need a configured conditional forwarding path and connectivity to a resolver that can query the linked Azure private zone; merely linking a VNet does not configure those on-premises resolvers. The required integration is a supported Azure DNS Private Resolver inbound endpoint or an appropriate forwarding VM, plus the on-premises conditional forwarder. Test the intended private hostname from the on-premises client and trace actual DNS responses rather than relying on zone-link status alone.

The nearby action 'Match frontend listener IP/port and backend mapping to the required client contract' is associated with this separate need: a TCP client connects to port 8080, but the load balancer frontend is configured only for 8443. That is because an existing public IP alone cannot make an unconfigured port reach the workload. Here a database backend should be reachable by private subnet consumers but not the internet, so 'Match frontend listener IP/port and backend mapping to the required client contract' misses the fact that internal load balancing exposes a private address; a public frontend changes exposure. 'Use an internal Azure Load Balancer with a private frontend IP' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Distribute eligible backends across supported zones with matching health-aware routing' solves another task because a resilient frontend is ineffective if all backend instances share one failed zone. For the situation where a database backend should be reachable by private subnet consumers but not the internet, this distractor misses the requirement that internal load balancing exposes a private address; a public frontend changes exposure. Unlike 'Distribute eligible backends across supported zones with matching health-aware routing', 'Use an internal Azure Load Balancer with a private frontend IP' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When an Azure Load Balancer backend pool exists but a new VM is never selected, the action 'Add the correct NIC/IP configuration to the intended backend pool' can be relevant: a backend VM does not join a load balancer merely by sharing its resource group. For the different problem of a database backend should be reachable by private subnet consumers but not the internet, 'Add the correct NIC/IP configuration to the intended backend pool' misses the mechanism that internal load balancing exposes a private address; a public frontend changes exposure. Choosing 'Add the correct NIC/IP configuration to the intended backend pool' would address that other need, whereas 'Use an internal Azure Load Balancer with a private frontend IP' is intended to solve the stated condition.

'Fix the load-balancing rule's backend port to match the service listener' applies to a different feature boundary because a healthy frontend can still deliver packets to the wrong backend port. In the stated scenario where a database backend should be reachable by private subnet consumers but not the internet, 'Fix the load-balancing rule's backend port to match the service listener' does not satisfy the mechanism that internal load balancing exposes a private address; a public frontend changes exposure. The necessary action is 'Use an internal Azure Load Balancer with a private frontend IP', which should be checked against this Azure resource's actual permissions and state.