Microsoft Azure Administrator Associate (AZ-104)

B is correct.

Explanation: If you want to change a virtual network's address range, you need to delete the peering first, update the address space, and then set up the peering again.

A is incorrect: Peering creation fails if address ranges overlap, and you cannot change the address space while the peering is active.

C is incorrect: Gateway transit allows peered virtual networks to share a gateway, but it does not allow you to modify the address space of a peered network.

D is incorrect: Configuring a Private DNS zone provides name resolution but does not allow you to bypass the address space modification restrictions.

D is correct.

Explanation: If multiple routes are available in a route table, Azure uses the route with the longest prefix match. The 10.0.0.0/24 prefix is more specific than 10.0.0.0/16.

A is incorrect: Azure selects the route with the longest prefix match, not the one that covers more addresses.

B is incorrect: Overlapping prefixes are allowed, and Azure resolves them by selecting the longest prefix match.

C is incorrect: Route selection is based on prefix length and route type priority, not creation order.

C is correct.

Explanation: Each network security group (NSG) is evaluated independently. If you have a subnet or network interface in your NSG, you must define an allow rule at each level.

A is incorrect: Azure evaluates both NSGs independently; the subnet NSG does not override the network interface NSG.

B is incorrect: For inbound traffic, Azure first processes NSG rules for associated subnets and then associated network interfaces.

D is incorrect: You cannot remove the default security rules from an NSG.

A is correct.

Explanation: Static IP addresses do not change and are best for role-based virtual machines such as Domain Controllers and DNS servers.

B is incorrect: Temporary batch processing virtual machines do not typically require static IP addresses.

C is incorrect: Virtual Machine Scale Set instances generally use dynamic IP addresses to scale efficiently.

D is incorrect: Testing environments typically use dynamic IP addresses unless a specific static IP scenario is being tested.

C is correct.

Explanation: Azure Private Link enables you to access Azure PaaS Services over a Private Endpoint in your virtual network, replacing the resource's public endpoint with a private network interface.

A is incorrect: Virtual network service endpoints secure access to an Azure service's public endpoint, but the service itself still uses a public IP.

B is incorrect: Service endpoint policies allow you to filter virtual network traffic to specific Azure resources over service endpoints, but they do not remove the public endpoint.

D is incorrect: A public endpoint with an NSG outbound rule still leaves the resource exposed to the internet via its public IP address.

A is correct.

Explanation: Azure Application Gateway provides a web application firewall to block SQL injection, supports TLS termination, maintains session affinity, and can route traffic to on-premises servers.

B is incorrect: Azure Load Balancer operates at Layer 4 and does not include a web application firewall or TLS termination.

C is incorrect: Azure Traffic Manager is a DNS-based traffic load balancer and does not provide a web application firewall or TLS termination.

D is incorrect: Azure Network Watcher provides tools to monitor and diagnose network performance, not to route traffic or provide a firewall.

B is correct.

Explanation: Azure alias records enable a zone apex domain to reference other Azure resources, such as a public IP resource. Alias records ensure that changes to the target resource's IP address are automatically applied to the DNS zone.

A is incorrect: An A record with a static IP address can become a dangling DNS record if the underlying IP address of the load balancer changes.

C is incorrect: CNAME records are not supported at the zone apex level.

D is incorrect: A TXT record is used to associate text strings with a domain name, not to resolve a domain name to an IP address.

A is correct.

Explanation: If there are multiple routes with the same address prefix, Azure selects the route based on the type in the following order of priority: User-defined routes, BGP routes, and System routes.

B is incorrect: BGP routes have a lower priority than user-defined routes.

C is incorrect: System routes have the lowest priority among the three types.

D is incorrect: Route selection is based on route type priority, not the order of creation.

C is correct.

Explanation: The Standard SKU adds native client support and IP-based connections, which are required for this scenario.

A is incorrect: The Developer SKU does not support native clients or IP-based connections.

B is incorrect: The Basic SKU provides browser-based access only and does not support native clients.

D is incorrect: The Premium SKU includes session recording, which is not required for this scenario, making Standard the minimum SKU.

D is correct.

Explanation: Virtual network peering is nontransitive. To enable communication between virtual networks A and C, you must either peer them directly or configure user-defined routes (UDRs) to point to a network virtual appliance (NVA) in virtual network B (service chaining).

A is incorrect: Virtual network peering is nontransitive, meaning traffic does not automatically route through an intermediate peered network.

B is incorrect: Extending the address space of virtual network B does not enable transitive routing between A and C.

C is incorrect: Changing the peering type from regional to global does not change the nontransitive nature of virtual network peering.