Free Microsoft AZ-104 Practice Exam with Questions & Answers | Set: 2

https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-create-new-alert-rule

You create an alert rule by combining:

- The resources to be monitored.

- The signal or telemetry from the resource.

- Conditions.

Then you define these elements for the resulting alert actions by using:

- Alert processing rules

- Action groups

Moving a virtual machine (VM) to a different host immediately in Azure is related to host-level maintenance mitigation, not to resource organization.

In this scenario, VM1 is affected by planned maintenance, and the goal is to move VM1 to a different host immediately.

According to Microsoft Azure Administrator documentation:

Moving a VM to another resource group is an Azure Resource Manager (ARM) operation used for administrative organization.

A resource group move does not change:

The physical host

The datacenter

The availability zone

The underlying hardware

Therefore, moving VM1 to another resource group does not relocate the VM to a different host and does not avoid maintenance.

To move a VM to a different host in response to maintenance, supported options include:

Redeploying the VM (which moves it to a new node)

Using Availability Sets or Availability Zones

Using Azure Scheduled Events to prepare workloads

Microsoft documentation explicitly states:

“Moving resources between resource groups does not change the location, availability zone, or the physical host of the resource.”

Because the proposed solution does not move the VM to a new host, it does not meet the goal.

The planned change specifies that you must configure a Data Collection Rule (DCR) to collect only system events with Event ID 4648 from VM2 and VM4.

A Data Collection Rule (DCR) in Azure Monitor defines how data is collected from resources, filtered, and sent to destinations like Log Analytics workspaces. To define or query this data within Azure Monitor Logs or Log Analytics, you use Kusto Query Language (KQL).

From the Microsoft Learn: Azure Monitor Logs Documentation:

“Log queries in Azure Monitor are written in Kusto Query Language (KQL), the same query language used by Azure Data Explorer.”

“KQL is optimized for querying large datasets, filtering by event IDs, sources, and event types.”

Other options:

WQL (WMI Query Language) – used for on-prem Windows event querying, not for Azure DCR.

T-SQL (Transact-SQL) – used for Azure SQL Database queries, not for monitoring data.

XPath – used in Event Viewer or XML-based event filtering, not within Azure Monitor DCR configuration.

Therefore, when you configure DCR1 to collect system events (Event ID 4648) from the specified VMs, the Kusto Query Language (KQL) is the correct and verified method to filter and process these events.

Example of a valid KQL expression for this requirement:

SecurityEvent

| where EventID == 4648

| where Computer in ( " VM2 " , " VM4 " )

This aligns with the Azure Monitor and Log Analytics query methodology covered in AZ-104 official exam guide (Implement and manage monitoring).

In Microsoft Entra ID (Azure Active Directory), creating guest user accounts for external users involves the B2B collaboration invitation process, not the Bulk create user operation. The Bulk create user feature in the Azure portal is used exclusively for creating member users (internal accounts) within your tenant — users that belong directly to your organization.

The Microsoft Azure Administrator official study guide and documentation specify that to onboard external users (guests), you must invite them using the B2B invitation mechanism. This process creates user objects with userType = Guest in your directory. The correct method to achieve this in bulk is by using the PowerShell cmdlet New-AzureADMSInvitation or Microsoft Graph API to send invitations automatically to all external users listed in your CSV file.

Bulk create user operation does not support adding guest accounts because it doesn’t generate the B2B invitation link or email, which is required for the external user to accept and authenticate using their own identity provider (e.g., Microsoft account, Google, or another Entra tenant).

Therefore, the proposed solution fails to meet the requirement of creating guest accounts for the 500 external users in the contoso.com tenant. The correct solution would be to use PowerShell with the New-AzureADMSInvitation command or the Azure AD portal’s “Invite external users” bulk import option designed specifically for guest creation.

Azure Recovery Services vaults are used to store backup data and recovery points for supported workloads such as Azure VMs, Azure Files, and on-premises workloads. However, the configuration rules are strictly defined based on region and supported resource type.

From Microsoft Azure Administrator documentation and the official Azure Backup architecture, the following principles apply:

Backup Region Dependency – A Recovery Services vault can only back up resources located in the same Azure region. For example, a vault in Central US can only back up Azure VMs, storage accounts, or workloads in Central US. It cannot back up resources in West US or East US.

Vault1 (Central US, RG1)

Located in Central US and can therefore back up only resources in Central US.

From the table: VM1 is in Central US, and is eligible.

storage1 (West US) and SQL1 (East US) cannot be backed up to Vault1 due to cross-region restrictions.

✅ Therefore, Vault1 can back up VM1 only.

Vault2 (West US, RG2)

Located in West US, and can only back up resources in West US.

In West US, the only relevant resource is storage1, which contains a file share named share1. Azure Backup supports Azure File share backup via Recovery Services vaults.

Vault2 cannot back up VM1 (Central US) or SQL1 (East US) since they reside in different regions.

✅ Therefore, Vault2 can back up share1 only.

Azure Backup Limitations Summary (From Microsoft Docs):

Azure VMs → must be backed up to a vault in the same region.

Azure File Shares → can be backed up using Recovery Services vaults in the same region as the storage account.

Azure SQL Database → uses its own automated backup mechanism, not Recovery Services vaults.

Hence, by Azure documentation compliance and AZ-104 study guide principles:

Vault1 backs up VM1 only.

Vault2 backs up share1 only.

Final Verified Answer:

✅ Vault1 – VM1 only

✅ Vault2 – share1 only

Box 1: Yes

User1 is a Cloud Device Administrator.

Device2 is Azure AD joined.

Group1 has the assigned to join type. User1 is the owner of Group1.

Note: Assigned groups - Manually add users or devices into a static group.

Azure AD joined or hybrid Azure AD joined devices utilize an organizational account in Azure AD

Box 2: No

User2 is a User Administrator.

Device1 is Azure AD registered.

Group1 has the assigned join type, and the owner is User1.

Note: Azure AD registered devices utilize an account managed by the end user, this account is either a Microsoft account or another locally managed credential.

Box 3: Yes

User2 is a User Administrator.

Device2 is Azure AD joined.

Group2 has the Dynamic Device join type, and the owner is User2.

WebApp1 can communicate with VM2. No, this is not correct. According to the tables, WebApp1 is integrated with VNet1, which has a peering connection with VNet2. However, VM2 is in VNet3, which is not peered with VNet1 or VNet2. Therefore, WebApp1 cannot communicate with VM2 across different virtual networks1.

NSG1 controls inbound traffic to WebApp1. No, this is not correct. According to the tables, NSG1 is associated with Subnet1 in VNet1, which is integrated with WebApp1. However, network security groups only control outbound traffic from App Service apps to virtual networks, not inbound traffic to App Service apps from virtual networks2. Therefore, NSG1 does not control inbound traffic to WebApp1.

WebApp2 can communicate with VM1. Yes, this is correct. According to the tables, WebApp2 is integrated with VNet3, which has a peering connection with VNet2. VM1 is in Subnet2 in VNet2, which has a network security group named NSG2 that allows inbound traffic from any source on port 803. Therefore, WebApp2 can communicate with VM1 on port 80 across peered virtual networks.

User : User 1, User2 , User 3 and User 4 (Explain : You can deleted all users with licence then what happend ? Only free the licence and storage en some part ) Group : Group 2 and Group 4 (Groups with active license assignments cannot be deleted. You get an error) https://techcommunity.microsoft.com/t5/microsoft-365-admin-center/reclaiming-licenses-from-deleted-users/m-p/116488

In Azure Container Registry (ACR), the admin user account provides a simple authentication mechanism using a username and password. Enabling the admin account and retrieving its credentials is done exclusively through the Access keys blade.

According to Azure Container Registry documentation:

The admin user is enabled/disabled from Access keys

The passwords (primary and secondary) are displayed and regenerated there

Other blades such as Networking, Properties, or Identity do not manage admin credentials

Final Answer:

D. Access keys