Pass Your Microsoft AZ-104 Exam Easy!

'Use Azure Network Watcher packet capture with scoped duration/filters' solves another task because packet capture records traffic for targeted diagnosis; it is not a continuously running blanket audit. For the situation where a VM service port is denied despite its apparent NSG configuration, this distractor misses the requirement that individual rule lists can miss inherited subnet/NIC combinations and precedence. Unlike 'Use Azure Network Watcher packet capture with scoped duration/filters', 'Read effective NSG security rules and match the blocked five-tuple' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a route change is applied and network tests pass, so operations claim every application is healthy, the action 'Validate application-level transactions and dependencies after network recovery' can be relevant: a working route proves path reachability, not database, auth or application correctness. For the different problem of a VM service port is denied despite its apparent NSG configuration, 'Validate application-level transactions and dependencies after network recovery' misses the mechanism that individual rule lists can miss inherited subnet/NIC combinations and precedence. Choosing 'Validate application-level transactions and dependencies after network recovery' would address that other need, whereas 'Read effective NSG security rules and match the blocked five-tuple' is intended to solve the stated condition.

'Resolve DNS/name configuration separately from routing next-hop status' applies to a different feature boundary because correct routes do not make a missing DNS record resolve to an IP address. In the stated scenario where a VM service port is denied despite its apparent NSG configuration, 'Resolve DNS/name configuration separately from routing next-hop status' does not satisfy the mechanism that individual rule lists can miss inherited subnet/NIC combinations and precedence. The necessary action is 'Read effective NSG security rules and match the blocked five-tuple', which should be checked against this Azure resource's actual permissions and state.

When connection Monitor reports failures only from one source agent among several regions, the action 'Inspect the failing test group's source endpoint, network path and destinations' can be relevant: a localized source failure need not imply every application client lost connectivity. For the different problem of a user reports a timeout, but Next hop points correctly while DNS lookup returns NXDOMAIN, 'Inspect the failing test group's source endpoint, network path and destinations' misses the mechanism that correct routes do not make a missing DNS record resolve to an IP address. Choosing 'Inspect the failing test group's source endpoint, network path and destinations' would address that other need, whereas 'Resolve DNS/name configuration separately from routing next-hop status' is intended to solve the stated condition.

'Read effective NSG security rules and match the blocked five-tuple' applies to a different feature boundary because individual rule lists can miss inherited subnet/NIC combinations and precedence. In the stated scenario where a user reports a timeout, but Next hop points correctly while DNS lookup returns NXDOMAIN, 'Read effective NSG security rules and match the blocked five-tuple' does not satisfy the mechanism that correct routes do not make a missing DNS record resolve to an IP address. The necessary action is 'Resolve DNS/name configuration separately from routing next-hop status', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Validate application-level transactions and dependencies after network recovery' is associated with this separate need: a route change is applied and network tests pass, so operations claim every application is healthy. That is because a working route proves path reachability, not database, auth or application correctness. Here a user reports a timeout, but Next hop points correctly while DNS lookup returns NXDOMAIN, so 'Validate application-level transactions and dependencies after network recovery' misses the fact that correct routes do not make a missing DNS record resolve to an IP address. 'Resolve DNS/name configuration separately from routing next-hop status' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Use Azure Network Watcher packet capture with scoped duration/filters' solves another task because packet capture records traffic for targeted diagnosis; it is not a continuously running blanket audit. For the situation where a user reports a timeout, but Next hop points correctly while DNS lookup returns NXDOMAIN, this distractor misses the requirement that correct routes do not make a missing DNS record resolve to an IP address. Unlike 'Use Azure Network Watcher packet capture with scoped duration/filters', 'Resolve DNS/name configuration separately from routing next-hop status' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Validate application-level transactions and dependencies after network recovery' applies to a different feature boundary because a working route proves path reachability, not database, auth or application correctness. In the stated scenario where connection Monitor reports failures only from one source agent among several regions, 'Validate application-level transactions and dependencies after network recovery' does not satisfy the mechanism that a localized source failure need not imply every application client lost connectivity. The necessary action is 'Inspect the failing test group's source endpoint, network path and destinations', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Check Azure Monitor Agent and applicable data collection rule associations' is associated with this separate need: a VM Insights workbook displays missing guest metrics after an agent migration. That is because dashboard layout is not proof the required agent is emitting the expected data streams. Here connection Monitor reports failures only from one source agent among several regions, so 'Check Azure Monitor Agent and applicable data collection rule associations' misses the fact that a localized source failure need not imply every application client lost connectivity. 'Inspect the failing test group's source endpoint, network path and destinations' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When a site reliability team needs continuous tests from one Azure network location to a partner API, the action 'Configure Azure Network Watcher Connection Monitor test groups' can be relevant: connection Monitor tracks endpoint-to-endpoint reachability and latency over time. For the different problem of connection Monitor reports failures only from one source agent among several regions, 'Configure Azure Network Watcher Connection Monitor test groups' misses the mechanism that a localized source failure need not imply every application client lost connectivity. Choosing 'Configure Azure Network Watcher Connection Monitor test groups' would address that other need, whereas 'Inspect the failing test group's source endpoint, network path and destinations' is intended to solve the stated condition.

The nearby action 'Inspect the failing test group's source endpoint, network path and destinations' is associated with this separate need: connection Monitor reports failures only from one source agent among several regions. That is because a localized source failure need not imply every application client lost connectivity. Here a route change is applied and network tests pass, so operations claim every application is healthy, so 'Inspect the failing test group's source endpoint, network path and destinations' misses the fact that a working route proves path reachability, not database, auth or application correctness. 'Validate application-level transactions and dependencies after network recovery' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Use network reachability and connection diagnostics for packet-path failures' solves another task because Storage occupancy and transport reachability are distinct measurements and tools. For the situation where a route change is applied and network tests pass, so operations claim every application is healthy, this distractor misses the requirement that a working route proves path reachability, not database, auth or application correctness. Unlike 'Use network reachability and connection diagnostics for packet-path failures', 'Validate application-level transactions and dependencies after network recovery' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Configure Azure Network Watcher Connection Monitor test groups' applies to a different feature boundary because connection Monitor tracks endpoint-to-endpoint reachability and latency over time. In the stated scenario where a route change is applied and network tests pass, so operations claim every application is healthy, 'Configure Azure Network Watcher Connection Monitor test groups' does not satisfy the mechanism that a working route proves path reachability, not database, auth or application correctness. The necessary action is 'Validate application-level transactions and dependencies after network recovery', which should be checked against this Azure resource's actual permissions and state.

When a junior admin assumes a Backup vault and Recovery Services vault can protect the same workloads identically, the action 'Check the supported backup data-source matrix before choosing vault type' can be relevant: vault families support different workloads, backup policies and recovery capabilities. For the different problem of an organization must back up ordinary Azure virtual machines with scheduled recovery points, 'Check the supported backup data-source matrix before choosing vault type' misses the mechanism that VM backup workloads have a supported Recovery Services vault policy model. Choosing 'Check the supported backup data-source matrix before choosing vault type' would address that other need, whereas 'Use an eligible Recovery Services vault for Azure VM backup' is intended to solve the stated condition.

'Evaluate vault backup storage redundancy and supported cross-region restore conditions' applies to a different feature boundary because redundancy choices affect recovery capabilities and may be constrained after protection begins. In the stated scenario where an organization must back up ordinary Azure virtual machines with scheduled recovery points, 'Evaluate vault backup storage redundancy and supported cross-region restore conditions' does not satisfy the mechanism that VM backup workloads have a supported Recovery Services vault policy model. The necessary action is 'Use an eligible Recovery Services vault for Azure VM backup', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Select a supported vault type and workload-specific protection mechanism' is associated with this separate need: a workload is submitted to a vault type that does not support that data source. That is because Recovery Services and Backup vault capabilities are not interchangeable for every resource. Here an organization must back up ordinary Azure virtual machines with scheduled recovery points, so 'Select a supported vault type and workload-specific protection mechanism' misses the fact that VM backup workloads have a supported Recovery Services vault policy model. 'Use an eligible Recovery Services vault for Azure VM backup' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Use a Backup vault for a data source supported by that vault type' solves another task because vault selection must match workload support and policy capability, not name similarity. For the situation where an organization must back up ordinary Azure virtual machines with scheduled recovery points, this distractor misses the requirement that VM backup workloads have a supported Recovery Services vault policy model. Unlike 'Use a Backup vault for a data source supported by that vault type', 'Use an eligible Recovery Services vault for Azure VM backup' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Moving the eligible VM from subscription B into subscription A is unnecessary solely to satisfy Azure VM Backup vault selection. Microsoft permits a Recovery Services vault to protect eligible VMs in a different subscription when they belong to the same Microsoft Entra tenant and are deployed in the vault's region, subject to effective RBAC. The source and vault in this case are both in West Europe, and the operator already has required access. Moving the VM would introduce organizational disruption without addressing a missing backup prerequisite. Select the VM through the existing vault and verify the protection policy.

Geo-redundant storage controls redundancy and potential recovery behavior of backups, not eligibility to register an Azure VM located in a different region. For ordinary Azure VM Backup, Microsoft requires the Recovery Services vault and protected VM to reside in the same region even when the source VM belongs to another subscription. The described resources are already in West Europe, so creating a new vault in a different region would introduce an eligibility failure rather than solve cross-subscription protection. Use the existing region-matched vault with authorized access and verify that the second VM appears as a selectable protected resource.

A Backup vault supports specific data sources such as Azure Disk Backup, but ordinary scheduled Azure VM Backup uses a Recovery Services vault. A subscription boundary does not convert a whole-VM protection workflow into a disk-only workload or require a different vault family. The existing Recovery Services vault in West Europe already satisfies the workload type and region constraints. Confirm both subscriptions share the same tenant and that access is sufficient to configure protection, then enroll the eligible VM and verify the backup policy and resulting recovery point rather than switching vault products unnecessarily.

Subscription Owner is much broader than necessary and does not replace the fundamental compatibility checks for a protected Azure VM. The question already grants the operator the required access to the West Europe vault and the VM in subscription B. Microsoft documents that eligible VMs can be protected by a vault in another subscription if both are in the same tenant and region. Additional subscription-wide privileges would violate least privilege without making a different-region or unsupported workload valid. Select the existing vault and confirm that the second VM can be protected with the authorized role assignments.

The nearby action 'Align backup frequency and recovery-point coverage to the four-hour RPO' is associated with this separate need: the business will tolerate losing no more than four hours of data. That is because a daily backup may exceed the accepted data-loss window even when backup jobs succeed. Here a user can read VM information but Azure Backup denies restoring its data, so 'Align backup frequency and recovery-point coverage to the four-hour RPO' misses the fact that read access to a VM is distinct from authorization to perform recovery operations. 'Assign an appropriate backup/restore operator role at a narrow scope' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Use an eligible Recovery Services vault for Azure VM backup' solves another task because VM backup workloads have a supported Recovery Services vault policy model. For the situation where a user can read VM information but Azure Backup denies restoring its data, this distractor misses the requirement that read access to a VM is distinct from authorization to perform recovery operations. Unlike 'Use an eligible Recovery Services vault for Azure VM backup', 'Assign an appropriate backup/restore operator role at a narrow scope' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Splitting a read-only VM role assignment into smaller scopes can reduce viewing breadth, but it does not add the Microsoft.RecoveryServices authorization needed to restore data. Azure Backup protects and restores through vault-specific role actions, separately from the ability to inspect a VM in Azure Resource Manager. The target resource-group and VM permissions were already verified in the scenario; changing those Reader scopes cannot resolve a documented vault restore denial. Assign an approved vault-side Backup Operator capability instead of duplicating unrelated VM visibility.

Selecting a Recovery Services vault is a prerequisite for protecting ordinary Azure VMs, but the scenario already states a vault with backup data exists. Merely naming the correct vault family does not determine whether its data is copied to a paired region or whether administrators may restore there in a healthy primary region. Those outcomes depend on backup storage redundancy, workload support and Cross Region Restore enablement. A VM can be correctly protected in a Recovery Services vault and still lack a secondary-region recovery point appropriate for an auditor's drill.

Choosing a vault in a supported location matters for protecting a source VM or related workload, but it does not by itself make an LRS or ZRS vault's recovery points available in another geographic region. The question asks specifically whether cross-region restore follows from arbitrary redundancy choices; it does not. Verify GRS/paired-region replication, the protected data source's CRR support and whether the feature is enabled. Vault region planning is a separate design issue, and unsupported location pairs cannot be repaired by a broad assumption that any backup is geo-restorable.

Different Azure Backup vault families protect different data sources. However, this scenario already identifies a Recovery Services vault that contains protected backups, so changing the vault family is not the missing cross-region requirement. A Backup vault does not make every Recovery Services backup recoverable in an Azure paired region. Within the existing supported Recovery Services design, inspect GRS rather than LRS/ZRS, the Cross Region Restore setting, regional/workload support, and actual secondary recovery point availability before declaring that regional recovery is possible.

A workload-support matrix is useful before selecting between Backup vault and Recovery Services vault, but it does not alone answer whether a currently configured Recovery Services vault supports restoring its existing data in a second region. The scenario's false assumption concerns redundancy and Cross Region Restore capability, not initial vault selection. Check whether backup storage uses geo-redundant replication and whether the specific workload, paired region and CRR setting allow secondary-region restores. Also validate real recovery points because asynchronous replication can lag and secondary copies are not interchangeable with primary recovery points.

Backup vault and Recovery Services vault do not have identical supported data-source matrices. If Azure reports that the chosen vault type does not protect the submitted workload, a repeated request against the same unsupported pairing cannot make it valid. Confirm workload-specific support, select an eligible vault/protection mechanism and check recovery/region requirements. The problem is product compatibility, not merely a transient configuration delay.

When a disaster-recovery administrator creates a vault far from the protected workloads without checking requirements, the action 'Choose a supported vault region aligned to the protected source workload and recovery design' can be relevant: backup/restore support often has regional association and workload residency constraints. For the different problem of a workload is submitted to a vault type that does not support that data source, 'Choose a supported vault region aligned to the protected source workload and recovery design' misses the mechanism that Recovery Services and Backup vault capabilities are not interchangeable for every resource. Choosing 'Choose a supported vault region aligned to the protected source workload and recovery design' would address that other need, whereas 'Select a supported vault type and workload-specific protection mechanism' is intended to solve the stated condition.

The nearby action 'Use an eligible Recovery Services vault for Azure VM backup' is associated with this separate need: an organization must back up ordinary Azure virtual machines with scheduled recovery points. That is because VM backup workloads have a supported Recovery Services vault policy model. Here a workload is submitted to a vault type that does not support that data source, so 'Use an eligible Recovery Services vault for Azure VM backup' misses the fact that Recovery Services and Backup vault capabilities are not interchangeable for every resource. 'Select a supported vault type and workload-specific protection mechanism' is the more defensible action; confirm its behavior in the target service before calling the task complete.

The workload and protected data still need a vault capable of supporting the required source, but that decision does not address the explicit absence of recoverability safeguards. Role scoping is already in place, and selecting a different class on that basis alone neither enforces retention nor protects a vaulted backup from deliberate deletion. The administrator should evaluate the current vault security configuration, enable supported deletion protections, and validate protected recovery points before relying on the deployment for regulated production recovery.

Encryption of a VM disk protects confidentiality of that disk at rest; it does not stop a separately authorized or compromised backup administrator from deleting vault retention objects. These are different controls: encrypted source disks do not extend the retention period after backup deletion, establish vault immutability or enforce multi-user authorization. Because the question states that deletion safeguards are missing, treating encryption as their substitute leaves a material recoverability gap. Validate backup vault security features and recovery behavior directly.

Subscription Owner adds broad rights to configure or manage many unrelated resources, and it cannot recreate backup recovery points that were permanently deleted outside the protected retention window. Granting wider privileges is the opposite of a defense against privileged destructive operations, especially when the operators already have scoped access. Soft delete, immutability and multi-user authorization are the relevant independent protections; confirm their supported configurations and intended retention rather than increasing the number of high-privilege identities.

The nearby action 'Use an eligible Recovery Services vault for Azure VM backup' is associated with this separate need: an organization must back up ordinary Azure virtual machines with scheduled recovery points. That is because VM backup workloads have a supported Recovery Services vault policy model. Here an administrator needs a current Azure Backup workload that explicitly uses Backup vault, not classic Azure VM protection, so 'Use an eligible Recovery Services vault for Azure VM backup' misses the fact that vault selection must match workload support and policy capability, not name similarity. 'Use a Backup vault for a data source supported by that vault type' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Check matching source/vault region requirements and supported backup policy' solves another task because regional compatibility can limit protection; policy creation doesn't guarantee a workload can be enrolled. For the situation where an administrator needs a current Azure Backup workload that explicitly uses Backup vault, not classic Azure VM protection, this distractor misses the requirement that vault selection must match workload support and policy capability, not name similarity. Unlike 'Check matching source/vault region requirements and supported backup policy', 'Use a Backup vault for a data source supported by that vault type' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a disaster-recovery administrator creates a vault far from the protected workloads without checking requirements, the action 'Choose a supported vault region aligned to the protected source workload and recovery design' can be relevant: backup/restore support often has regional association and workload residency constraints. For the different problem of an administrator needs a current Azure Backup workload that explicitly uses Backup vault, not classic Azure VM protection, 'Choose a supported vault region aligned to the protected source workload and recovery design' misses the mechanism that vault selection must match workload support and policy capability, not name similarity. Choosing 'Choose a supported vault region aligned to the protected source workload and recovery design' would address that other need, whereas 'Use a Backup vault for a data source supported by that vault type' is intended to solve the stated condition.