Topic 10 Practice Test 2 covers Azure App Service for Microsoft Azure Administrator AZ-104 and maps to the objective: Create and configure Azure App Service. For broader exam preparation, review the Microsoft AZ-104 Exam Dumps. Every option includes focused technical reasoning explaining both the Azure concept and its fit to the scenario.
Question 1
At Adventure Works, the organization needs deployment slots and backup features that are not available in the current low pricing tier. What should be configured? Choose ONE.
- Scale up the App Service plan to a larger pricing tier
- Scale out the App Service plan to more instances
- Configure autoscale rules for the App Service plan
- Place compatible apps in the same App Service plan
Correct Answer: A
Correct Answer
Answer A is correct because Scaling up changes the App Service plan SKU to provide more CPU, memory, storage, or tier-gated features such as deployment slots, backups, and autoscaling. Adventure Works must give an existing App Service plan more CPU, memory, or tier-gated platform features by changing its SKU. This is the precise operational fit.
Incorrect Answers
Answer B is incorrect because Scaling out increases the number of worker instances in the App Service plan so application load can be distributed horizontally. Adventure Works must give an existing App Service plan more CPU, memory, or tier-gated platform features by changing its SKU. This is not the requested capability.
Answer C is incorrect because Autoscale changes the instance count in response to configured metrics and thresholds, within minimum, maximum, and default capacity settings. Adventure Works must give an existing App Service plan more CPU, memory, or tier-gated platform features by changing its SKU. Its purpose differs from that need.
Answer D is incorrect because Apps in the same App Service plan share the plan worker instances and the plan defines operating system, region, VM size, instance count, and pricing tier. Adventure Works must give an existing App Service plan more CPU, memory, or tier-gated platform features by changing its SKU. That behavior does not fit here.
Question 2
Proseware needs to distribute a sustained increase in HTTP load across more identical workers. Choose the best change. Choose ONE.
- Scale up the App Service plan to a larger pricing tier
- Scale out the App Service plan to more instances
- Configure autoscale rules for the App Service plan
- Place compatible apps in the same App Service plan
Correct Answer: B
Correct Answer
Answer B is correct because Scaling out increases the number of worker instances in the App Service plan so application load can be distributed horizontally. Proseware must increase the number of App Service worker instances without changing the worker size. That capability fits the scenario directly.
Incorrect Answers
Answer A is incorrect because Scaling up changes the App Service plan SKU to provide more CPU, memory, storage, or tier-gated features such as deployment slots, backups, and autoscaling. Proseware must increase the number of App Service worker instances without changing the worker size. It would leave the requirement unmet.
Answer C is incorrect because Autoscale changes the instance count in response to configured metrics and thresholds, within minimum, maximum, and default capacity settings. Proseware must increase the number of App Service worker instances without changing the worker size. Its function is different in this case.
Answer D is incorrect because Apps in the same App Service plan share the plan worker instances and the plan defines operating system, region, VM size, instance count, and pricing tier. Proseware must increase the number of App Service worker instances without changing the worker size. The feature solves a different problem.
Question 3
A cloud engineer at A. Datum is working with an environment that is addressing horizontal capacity rather than a need for larger individual workers. Select the correct configuration. Choose ONE.
- Scale up the App Service plan to a larger pricing tier
- Configure autoscale rules for the App Service plan
- Scale out the App Service plan to more instances
- Place compatible apps in the same App Service plan
Correct Answer: C
Correct Answer
Answer C is correct because Scaling out increases the number of worker instances in the App Service plan so application load can be distributed horizontally. A. Datum must increase the number of App Service worker instances without changing the worker size. It therefore matches the requested outcome.
Incorrect Answers
Answer A is incorrect because Scaling up changes the App Service plan SKU to provide more CPU, memory, storage, or tier-gated features such as deployment slots, backups, and autoscaling. A. Datum must increase the number of App Service worker instances without changing the worker size. That behavior does not fit here.
Answer B is incorrect because Autoscale changes the instance count in response to configured metrics and thresholds, within minimum, maximum, and default capacity settings. A. Datum must increase the number of App Service worker instances without changing the worker size. The option targets another design goal.
Answer D is incorrect because Apps in the same App Service plan share the plan worker instances and the plan defines operating system, region, VM size, instance count, and pricing tier. A. Datum must increase the number of App Service worker instances without changing the worker size. This does not satisfy that condition.
Question 4
In Contoso’s Azure environment, the organization must maintain configured minimum and maximum instances while scaling according to demand. What is required? Choose ONE.
- Scale out the App Service plan to more instances
- Scale up the App Service plan to a larger pricing tier
- Place compatible apps in the same App Service plan
- Configure autoscale rules for the App Service plan
Correct Answer: D
Correct Answer
Answer D is correct because Autoscale changes the instance count in response to configured metrics and thresholds, within minimum, maximum, and default capacity settings. Contoso must change the App Service instance count automatically in response to a monitored workload metric. It is the strongest fit here.
Incorrect Answers
Answer A is incorrect because Scaling out increases the number of worker instances in the App Service plan so application load can be distributed horizontally. Contoso must change the App Service instance count automatically in response to a monitored workload metric. The feature solves a different problem.
Answer B is incorrect because Scaling up changes the App Service plan SKU to provide more CPU, memory, storage, or tier-gated features such as deployment slots, backups, and autoscaling. Contoso must change the App Service instance count automatically in response to a monitored workload metric. This is not the requested capability.
Answer C is incorrect because Apps in the same App Service plan share the plan worker instances and the plan defines operating system, region, VM size, instance count, and pricing tier. Contoso must change the App Service instance count automatically in response to a monitored workload metric. Its purpose differs from that need.
Question 5
Adventure Works wants to warm the next release and then exchange it with production without redeploying production directly. Which Azure feature fits? Choose ONE.
- Deploy the new version to a staging deployment slot and swap it into production
- Scale up the App Service plan to a larger pricing tier
- Configure App Service backup and a backup schedule
- Route a small percentage of production traffic to the staging slot
Correct Answer: A
Correct Answer
Answer A is correct because Deployment slots let an App Service app warm and validate a new version separately before swapping the selected slot with production. Adventure Works must validate a new App Service release in an isolated warm environment before making it the production version. The service behavior matches the constraint.
Incorrect Answers
Answer B is incorrect because Scaling up changes the App Service plan SKU to provide more CPU, memory, storage, or tier-gated features such as deployment slots, backups, and autoscaling. Adventure Works must validate a new App Service release in an isolated warm environment before making it the production version. This does not satisfy that condition.
Answer C is incorrect because App Service backup captures supported app content and configuration to a storage account according to the configured schedule and retention settings, enabling later restore. Adventure Works must validate a new App Service release in an isolated warm environment before making it the production version. It would leave the requirement unmet.
Answer D is incorrect because App Service traffic routing can send a controlled percentage of client traffic to a nonproduction slot for gradual validation before a full swap. Adventure Works must validate a new App Service release in an isolated warm environment before making it the production version. Its function is different in this case.
Question 6
Proseware has a production database setting that must not move when a validated staging build is swapped into production. Which action fits? Choose TWO.
- Leave the app setting as a normal swappable setting
- Mark the environment-specific app setting as a deployment slot setting
- Configure App Service backup and a backup schedule
- Deploy the new version to a staging deployment slot and swap it into production
- Scale out the App Service plan to more instances
Correct Answers: B, D
Correct Answers
Answer B is correct because A deployment slot setting stays with its slot during a swap, which is appropriate for environment-specific values that must not move between staging and production. Proseware must keep the production-only configuration value in production while using a staging slot for the release. This meets the stated administration goal.
Answer D is correct because Deployment slots let an App Service app warm and validate a new version separately before swapping the selected slot with production. Proseware must keep the production-only configuration value in production while using a staging slot for the release. It therefore matches the requested outcome.
Incorrect Answers
Answer A is incorrect because Normal app settings generally move with application content during a slot swap unless they are explicitly configured to stick to a slot. Proseware must keep the production-only configuration value in production while using a staging slot for the release. That behavior does not fit here.
Answer C is incorrect because App Service backup captures supported app content and configuration to a storage account according to the configured schedule and retention settings, enabling later restore. Proseware must keep the production-only configuration value in production while using a staging slot for the release. The option targets another design goal.
Answer E is incorrect because Scaling out increases the number of worker instances in the App Service plan so application load can be distributed horizontally. Proseware must keep the production-only configuration value in production while using a staging slot for the release. This does not satisfy that condition.
Question 7
An Azure administrator at A. Datum learns that the organization needs to preserve environment-specific configuration during repeated staging-to-production swaps. What should the administrator do? Choose TWO.
- Mark the environment-specific app setting as a deployment slot setting
- Leave the app setting as a normal swappable setting
- Configure App Service backup and a backup schedule
- Deploy the new version to a staging deployment slot and swap it into production
- Scale out the App Service plan to more instances
Correct Answers: A, D
Correct Answers
Answer A is correct because A deployment slot setting stays with its slot during a swap, which is appropriate for environment-specific values that must not move between staging and production. A. Datum must keep the production-only configuration value in production while using a staging slot for the release. It aligns with the required Azure outcome.
Answer D is correct because Deployment slots let an App Service app warm and validate a new version separately before swapping the selected slot with production. A. Datum must keep the production-only configuration value in production while using a staging slot for the release. It is the strongest fit here.
Incorrect Answers
Answer B is incorrect because Normal app settings generally move with application content during a slot swap unless they are explicitly configured to stick to a slot. A. Datum must keep the production-only configuration value in production while using a staging slot for the release. The feature solves a different problem.
Answer C is incorrect because App Service backup captures supported app content and configuration to a storage account according to the configured schedule and retention settings, enabling later restore. A. Datum must keep the production-only configuration value in production while using a staging slot for the release. This is not the requested capability.
Answer E is incorrect because Scaling out increases the number of worker instances in the App Service plan so application load can be distributed horizontally. A. Datum must keep the production-only configuration value in production while using a staging slot for the release. Its purpose differs from that need.
Question 8
Contoso is replacing direct use of the azurewebsites.net hostname with a branded subdomain. Which option is appropriate? Choose ONE.
- Create the required asuid TXT record for domain ownership validation
- Create an App Service managed certificate and bind it to the custom hostname
- Enable HTTPS Only and configure an appropriate minimum TLS version
- Create a CNAME record from the subdomain to the app hostname
Correct Answer: D
Correct Answer
Answer D is correct because For a subdomain, a CNAME can map the custom name to the App Service default hostname while App Service validates and binds the custom domain. Contoso must map a custom subdomain such as app.contoso.com to the App Service default hostname. The option supplies the needed behavior.
Incorrect Answers
Answer A is incorrect because The asuid TXT record is used by App Service to validate ownership of a custom domain and helps protect the mapping against domain takeover scenarios. Contoso must map a custom subdomain such as app.contoso.com to the App Service default hostname. The option targets another design goal.
Answer B is incorrect because App Service can issue and manage a certificate for supported custom domains, reducing certificate renewal administration while enabling TLS on that hostname. Contoso must map a custom subdomain such as app.contoso.com to the App Service default hostname. This does not satisfy that condition.
Answer C is incorrect because HTTPS Only redirects HTTP requests to HTTPS, while the minimum TLS setting controls the oldest TLS protocol version accepted by the app endpoint. Contoso must map a custom subdomain such as app.contoso.com to the App Service default hostname. It would leave the requirement unmet.
Question 9
A cloud engineer at Adventure Works is working with an environment that wants to protect a domain mapping against takeover by keeping the App Service verification record present. Select the correct configuration. Choose ONE.
- Create the required asuid TXT record for domain ownership validation
- Create a CNAME record from the subdomain to the app hostname
- Create an App Service managed certificate and bind it to the custom hostname
- Enable HTTPS Only and configure an appropriate minimum TLS version
Correct Answer: A
Correct Answer
Answer A is correct because The asuid TXT record is used by App Service to validate ownership of a custom domain and helps protect the mapping against domain takeover scenarios. Adventure Works must prove ownership of the custom domain to App Service using the asuid validation record. This is the precise operational fit.
Incorrect Answers
Answer B is incorrect because For a subdomain, a CNAME can map the custom name to the App Service default hostname while App Service validates and binds the custom domain. Adventure Works must prove ownership of the custom domain to App Service using the asuid validation record. This is not the requested capability.
Answer C is incorrect because App Service can issue and manage a certificate for supported custom domains, reducing certificate renewal administration while enabling TLS on that hostname. Adventure Works must prove ownership of the custom domain to App Service using the asuid validation record. Its purpose differs from that need.
Answer D is incorrect because HTTPS Only redirects HTTP requests to HTTPS, while the minimum TLS setting controls the oldest TLS protocol version accepted by the app endpoint. Adventure Works must prove ownership of the custom domain to App Service using the asuid validation record. That behavior does not fit here.
Question 10
In Proseware’s Azure environment, the organization needs a platform-managed certificate for a standard custom web hostname. What is required? Choose ONE.
- Enable HTTPS Only and configure an appropriate minimum TLS version
- Create an App Service managed certificate and bind it to the custom hostname
- Create the required asuid TXT record for domain ownership validation
- Create a CNAME record from the subdomain to the app hostname
Correct Answer: B
Correct Answer
Answer B is correct because App Service can issue and manage a certificate for supported custom domains, reducing certificate renewal administration while enabling TLS on that hostname. Proseware must enable TLS on a supported App Service custom hostname without operating an external certificate renewal process. That capability fits the scenario directly.
Incorrect Answers
Answer A is incorrect because HTTPS Only redirects HTTP requests to HTTPS, while the minimum TLS setting controls the oldest TLS protocol version accepted by the app endpoint. Proseware must enable TLS on a supported App Service custom hostname without operating an external certificate renewal process. It would leave the requirement unmet.
Answer C is incorrect because The asuid TXT record is used by App Service to validate ownership of a custom domain and helps protect the mapping against domain takeover scenarios. Proseware must enable TLS on a supported App Service custom hostname without operating an external certificate renewal process. Its function is different in this case.
Answer D is incorrect because For a subdomain, a CNAME can map the custom name to the App Service default hostname while App Service validates and binds the custom domain. Proseware must enable TLS on a supported App Service custom hostname without operating an external certificate renewal process. The feature solves a different problem.
Question 11
At A. Datum, the organization has completed DNS mapping and now wants a managed TLS certificate bound to the custom name. What should be configured? Choose ONE.
- Enable HTTPS Only and configure an appropriate minimum TLS version
- Create the required asuid TXT record for domain ownership validation
- Create an App Service managed certificate and bind it to the custom hostname
- Create a CNAME record from the subdomain to the app hostname
Correct Answer: C
Correct Answer
Answer C is correct because App Service can issue and manage a certificate for supported custom domains, reducing certificate renewal administration while enabling TLS on that hostname. A. Datum must enable TLS on a supported App Service custom hostname without operating an external certificate renewal process. It therefore matches the requested outcome.
Incorrect Answers
Answer A is incorrect because HTTPS Only redirects HTTP requests to HTTPS, while the minimum TLS setting controls the oldest TLS protocol version accepted by the app endpoint. A. Datum must enable TLS on a supported App Service custom hostname without operating an external certificate renewal process. That behavior does not fit here.
Answer B is incorrect because The asuid TXT record is used by App Service to validate ownership of a custom domain and helps protect the mapping against domain takeover scenarios. A. Datum must enable TLS on a supported App Service custom hostname without operating an external certificate renewal process. The option targets another design goal.
Answer D is incorrect because For a subdomain, a CNAME can map the custom name to the App Service default hostname while App Service validates and binds the custom domain. A. Datum must enable TLS on a supported App Service custom hostname without operating an external certificate renewal process. This does not satisfy that condition.
Question 12
Contoso wants App Service to reject clients that only support TLS versions older than the policy permits. Choose the best change. Choose ONE.
- Create an App Service managed certificate and bind it to the custom hostname
- Create a CNAME record from the subdomain to the app hostname
- Create the required asuid TXT record for domain ownership validation
- Enable HTTPS Only and configure an appropriate minimum TLS version
Correct Answer: D
Correct Answer
Answer D is correct because HTTPS Only redirects HTTP requests to HTTPS, while the minimum TLS setting controls the oldest TLS protocol version accepted by the app endpoint. Contoso must force clients to use HTTPS and prevent negotiation of older TLS protocol versions below the configured minimum. It is the strongest fit here.
Incorrect Answers
Answer A is incorrect because App Service can issue and manage a certificate for supported custom domains, reducing certificate renewal administration while enabling TLS on that hostname. Contoso must force clients to use HTTPS and prevent negotiation of older TLS protocol versions below the configured minimum. The feature solves a different problem.
Answer B is incorrect because For a subdomain, a CNAME can map the custom name to the App Service default hostname while App Service validates and binds the custom domain. Contoso must force clients to use HTTPS and prevent negotiation of older TLS protocol versions below the configured minimum. This is not the requested capability.
Answer C is incorrect because The asuid TXT record is used by App Service to validate ownership of a custom domain and helps protect the mapping against domain takeover scenarios. Contoso must force clients to use HTTPS and prevent negotiation of older TLS protocol versions below the configured minimum. Its purpose differs from that need.
Question 13
An Azure administrator at Adventure Works learns that the organization has an app that needs outbound connectivity to an internal API without making the app inbound endpoint private. What should the administrator do? Choose ONE.
- Configure App Service virtual network integration
- Create an App Service private endpoint and configure private DNS
- Configure App Service access restrictions for the public endpoint
- Use a private endpoint and disable public network access
Correct Answer: A
Correct Answer
Answer A is correct because App Service virtual network integration provides outbound access from the app into resources reachable through an Azure virtual network; it does not make the app inbound endpoint private by itself. Adventure Works must give the App Service application outbound access to resources reachable through an Azure virtual network. The service behavior matches the constraint.
Incorrect Answers
Answer B is incorrect because An App Service private endpoint provides inbound connectivity through a private IP in the virtual network; DNS must resolve the app hostname to that private endpoint address. Adventure Works must give the App Service application outbound access to resources reachable through an Azure virtual network. This does not satisfy that condition.
Answer C is incorrect because App Service access restrictions control inbound requests to the public app endpoint using ordered allow and deny rules based on network sources and related criteria. Adventure Works must give the App Service application outbound access to resources reachable through an Azure virtual network. It would leave the requirement unmet.
Answer D is incorrect because A private endpoint can coexist with public access; disabling public network access is the additional step that makes private connectivity the only supported inbound path. Adventure Works must give the App Service application outbound access to resources reachable through an Azure virtual network. Its function is different in this case.
Question 14
Proseware has internal clients that must reach the web app without traversing its public endpoint. Which option is appropriate? Choose ONE.
- Configure App Service virtual network integration
- Create an App Service private endpoint and configure private DNS
- Configure App Service access restrictions for the public endpoint
- Use a private endpoint and disable public network access
Correct Answer: B
Correct Answer
Answer B is correct because An App Service private endpoint provides inbound connectivity through a private IP in the virtual network; DNS must resolve the app hostname to that private endpoint address. Proseware must provide inbound App Service access through a private IP address in a virtual network and resolve the app hostname privately. This meets the stated administration goal.
Incorrect Answers
Answer A is incorrect because App Service virtual network integration provides outbound access from the app into resources reachable through an Azure virtual network; it does not make the app inbound endpoint private by itself. Proseware must provide inbound App Service access through a private IP address in a virtual network and resolve the app hostname privately. Its purpose differs from that need.
Answer C is incorrect because App Service access restrictions control inbound requests to the public app endpoint using ordered allow and deny rules based on network sources and related criteria. Proseware must provide inbound App Service access through a private IP address in a virtual network and resolve the app hostname privately. That behavior does not fit here.
Answer D is incorrect because A private endpoint can coexist with public access; disabling public network access is the additional step that makes private connectivity the only supported inbound path. Proseware must provide inbound App Service access through a private IP address in a virtual network and resolve the app hostname privately. The option targets another design goal.
Question 15
- Datum must expose the app privately to connected networks through a private endpoint rather than only restricting public IP ranges. Which Azure feature fits? Choose ONE.
- Configure App Service virtual network integration
- Configure App Service access restrictions for the public endpoint
- Create an App Service private endpoint and configure private DNS
- Use a private endpoint and disable public network access
Correct Answer: C
Correct Answer
Answer C is correct because An App Service private endpoint provides inbound connectivity through a private IP in the virtual network; DNS must resolve the app hostname to that private endpoint address. A. Datum must provide inbound App Service access through a private IP address in a virtual network and resolve the app hostname privately. It aligns with the required Azure outcome.
Incorrect Answers
Answer A is incorrect because App Service virtual network integration provides outbound access from the app into resources reachable through an Azure virtual network; it does not make the app inbound endpoint private by itself. A. Datum must provide inbound App Service access through a private IP address in a virtual network and resolve the app hostname privately. Its function is different in this case.
Answer B is incorrect because App Service access restrictions control inbound requests to the public app endpoint using ordered allow and deny rules based on network sources and related criteria. A. Datum must provide inbound App Service access through a private IP address in a virtual network and resolve the app hostname privately. The feature solves a different problem.
Answer D is incorrect because A private endpoint can coexist with public access; disabling public network access is the additional step that makes private connectivity the only supported inbound path. A. Datum must provide inbound App Service access through a private IP address in a virtual network and resolve the app hostname privately. This is not the requested capability.
Question 16
Contoso is replacing ad hoc file copies with the App Service backup feature. Which action fits? Choose ONE.
- Restore the App Service app from a selected backup
- Deploy the new version to a staging deployment slot and swap it into production
- Scale up the App Service plan to a larger pricing tier
- Configure App Service backup and a backup schedule
Correct Answer: D
Correct Answer
Answer D is correct because App Service backup captures supported app content and configuration to a storage account according to the configured schedule and retention settings, enabling later restore. Contoso must capture App Service content and supported configuration on a recurring schedule for later recovery. The option supplies the needed behavior.
Incorrect Answers
Answer A is incorrect because Restoring from an App Service backup returns supported backed-up content and configuration to the chosen app or slot according to the restore operation. Contoso must capture App Service content and supported configuration on a recurring schedule for later recovery. The option targets another design goal.
Answer B is incorrect because Deployment slots let an App Service app warm and validate a new version separately before swapping the selected slot with production. Contoso must capture App Service content and supported configuration on a recurring schedule for later recovery. This does not satisfy that condition.
Answer C is incorrect because Scaling up changes the App Service plan SKU to provide more CPU, memory, storage, or tier-gated features such as deployment slots, backups, and autoscaling. Contoso must capture App Service content and supported configuration on a recurring schedule for later recovery. It would leave the requirement unmet.
Question 17
At Adventure Works, the organization must return a web app to the content and supported configuration captured in a selected recovery point. What should be configured? Choose ONE.
- Restore the App Service app from a selected backup
- Configure App Service backup and a backup schedule
- Deploy the new version to a staging deployment slot and swap it into production
- Scale up the App Service plan to a larger pricing tier
Correct Answer: A
Correct Answer
Answer A is correct because Restoring from an App Service backup returns supported backed-up content and configuration to the chosen app or slot according to the restore operation. Adventure Works must recover the App Service application from a previously created App Service backup. This is the precise operational fit.
Incorrect Answers
Answer B is incorrect because App Service backup captures supported app content and configuration to a storage account according to the configured schedule and retention settings, enabling later restore. Adventure Works must recover the App Service application from a previously created App Service backup. This is not the requested capability.
Answer C is incorrect because Deployment slots let an App Service app warm and validate a new version separately before swapping the selected slot with production. Adventure Works must recover the App Service application from a previously created App Service backup. Its purpose differs from that need.
Answer D is incorrect because Scaling up changes the App Service plan SKU to provide more CPU, memory, storage, or tier-gated features such as deployment slots, backups, and autoscaling. Adventure Works must recover the App Service application from a previously created App Service backup. That behavior does not fit here.
Question 18
Proseware must allow the corporate egress addresses while denying other traffic to the public app endpoint. Choose the best change. Choose ONE.
- Create an App Service private endpoint and configure private DNS
- Configure App Service access restrictions for the public endpoint
- Configure App Service virtual network integration
- Use a private endpoint and disable public network access
Correct Answer: B
Correct Answer
Answer B is correct because App Service access restrictions control inbound requests to the public app endpoint using ordered allow and deny rules based on network sources and related criteria. Proseware must restrict requests arriving at the App Service public endpoint according to ordered network-source rules. That capability fits the scenario directly.
Incorrect Answers
Answer A is incorrect because An App Service private endpoint provides inbound connectivity through a private IP in the virtual network; DNS must resolve the app hostname to that private endpoint address. Proseware must restrict requests arriving at the App Service public endpoint according to ordered network-source rules. It would leave the requirement unmet.
Answer C is incorrect because App Service virtual network integration provides outbound access from the app into resources reachable through an Azure virtual network; it does not make the app inbound endpoint private by itself. Proseware must restrict requests arriving at the App Service public endpoint according to ordered network-source rules. Its function is different in this case.
Answer D is incorrect because A private endpoint can coexist with public access; disabling public network access is the additional step that makes private connectivity the only supported inbound path. Proseware must restrict requests arriving at the App Service public endpoint according to ordered network-source rules. The feature solves a different problem.
Question 19
A cloud engineer at A. Datum is working with an environment that needs an ordered public-endpoint network policy rather than outbound virtual network integration. Select the correct configuration. Choose ONE.
- Create an App Service private endpoint and configure private DNS
- Configure App Service virtual network integration
- Configure App Service access restrictions for the public endpoint
- Use a private endpoint and disable public network access
Correct Answer: C
Correct Answer
Answer C is correct because App Service access restrictions control inbound requests to the public app endpoint using ordered allow and deny rules based on network sources and related criteria. A. Datum must restrict requests arriving at the App Service public endpoint according to ordered network-source rules. It therefore matches the requested outcome.
Incorrect Answers
Answer A is incorrect because An App Service private endpoint provides inbound connectivity through a private IP in the virtual network; DNS must resolve the app hostname to that private endpoint address. A. Datum must restrict requests arriving at the App Service public endpoint according to ordered network-source rules. That behavior does not fit here.
Answer B is incorrect because App Service virtual network integration provides outbound access from the app into resources reachable through an Azure virtual network; it does not make the app inbound endpoint private by itself. A. Datum must restrict requests arriving at the App Service public endpoint according to ordered network-source rules. The option targets another design goal.
Answer D is incorrect because A private endpoint can coexist with public access; disabling public network access is the additional step that makes private connectivity the only supported inbound path. A. Datum must restrict requests arriving at the App Service public endpoint according to ordered network-source rules. This does not satisfy that condition.
Question 20
In Contoso’s Azure environment, the organization is validating production behavior by routing a small share of requests to the new version. What is required? Choose ONE.
- Deploy the new version to a staging deployment slot and swap it into production
- Scale out the App Service plan to more instances
- Configure App Service backup and a backup schedule
- Route a small percentage of production traffic to the staging slot
Correct Answer: D
Correct Answer
Answer D is correct because App Service traffic routing can send a controlled percentage of client traffic to a nonproduction slot for gradual validation before a full swap. Contoso must send only a small controlled percentage of production client traffic to a nonproduction deployment slot. It is the strongest fit here.
Incorrect Answers
Answer A is incorrect because Deployment slots let an App Service app warm and validate a new version separately before swapping the selected slot with production. Contoso must send only a small controlled percentage of production client traffic to a nonproduction deployment slot. The feature solves a different problem.
Answer B is incorrect because Scaling out increases the number of worker instances in the App Service plan so application load can be distributed horizontally. Contoso must send only a small controlled percentage of production client traffic to a nonproduction deployment slot. This is not the requested capability.
Answer C is incorrect because App Service backup captures supported app content and configuration to a storage account according to the configured schedule and retention settings, enabling later restore. Contoso must send only a small controlled percentage of production client traffic to a nonproduction deployment slot. Its purpose differs from that need.
