Microsoft AZ-104 Exam With Confidence Using Practice Dumps

As App1 is public-facing we need an incoming security rule, related to the access of the web servers.

Scenario: You have a public-facing application named App1. App1 is comprised of the following three tiers: a SQL database, a web front end, and a processing middle tier.

Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.

You must identify the correct storage account for flow logging of IP traffic from VM5 that satisfies the retention requirement of eight months.

Step 1 — Review the Requirements

Flow logs are stored in a StorageV2 (general purpose v2) account.

The selected storage account must support Network Watcher flow logs.

Data must be retained for eight months (≈ 240 days).

Step 2 — Evaluate Each Storage Account

Storage Account

Kind

Region

Remarks

storage1

Storage (general purpose v1)

West US

Does not support flow logs (deprecated type).

storage2

StorageV2 (general purpose v2)

East US

Fully supports flow logs and lifecycle management.

storage3

BlobStorage

East US 2

Not suitable — supports blobs only, not log structure or lifecycle retention.

storage4

FileStorage

Central US

File-only — cannot store flow logs.

Step 3 — Compliance with Flow Log Retention

Flow logs for Network Watcher NSG flow logging are supported only by StorageV2 accounts. You can use Azure Storage lifecycle management to automatically delete logs after a set period — such as 240 days (8 months) — to comply with retention requirements.

Official Microsoft Note:

“Network security group (NSG) flow logs are stored in Azure StorageV2 (General Purpose v2) accounts, which support lifecycle management for log retention.” — Azure Network Watcher documentation.

Conclusion

storage2 is the only StorageV2 account.

It’s located in East US, matching VM5’s region (East US) — this satisfies performance and compliance requirements.

You can add a virtual network link only to zone3.com , the Azure Private DNS zone. Microsoft states that after creating a private DNS zone in Azure, you link a virtual network to it so that virtual machines hosted in that virtual network can resolve records in the private DNS zone. The documentation further explains that every private DNS zone has a collection of virtual network link child resources, where each link represents a connection to a virtual network.

The standard primary DNS zone zone1.com is hosted inside the Windows Server DNS role on VM1. It is not an Azure Private DNS zone resource and therefore does not support Azure virtual network links. The Azure DNS zone zone2.com is a public DNS zone, used for authoritative public DNS hosting, and it is not linked to VNets by using private DNS virtual network links. Only Azure Private DNS zones provide VNet linking for private name resolution and optional autoregistration. This maps to AZ-104 Configure and manage virtual networking , specifically DNS name resolution, Azure DNS, Azure Private DNS zones, and virtual network links.