AZ-104 Exam Dumps - Microsoft Azure Administrator Associate Questions and Answers

The planned change specifies that you must configure a Data Collection Rule (DCR) to collect only system events with Event ID 4648 from VM2 and VM4.

A Data Collection Rule (DCR) in Azure Monitor defines how data is collected from resources, filtered, and sent to destinations like Log Analytics workspaces. To define or query this data within Azure Monitor Logs or Log Analytics, you use Kusto Query Language (KQL).

From the Microsoft Learn: Azure Monitor Logs Documentation:

“Log queries in Azure Monitor are written in Kusto Query Language (KQL), the same query language used by Azure Data Explorer.”

“KQL is optimized for querying large datasets, filtering by event IDs, sources, and event types.”

Other options:

WQL (WMI Query Language) – used for on-prem Windows event querying, not for Azure DCR.

T-SQL (Transact-SQL) – used for Azure SQL Database queries, not for monitoring data.

XPath – used in Event Viewer or XML-based event filtering, not within Azure Monitor DCR configuration.

Therefore, when you configure DCR1 to collect system events (Event ID 4648) from the specified VMs, the Kusto Query Language (KQL) is the correct and verified method to filter and process these events.

Example of a valid KQL expression for this requirement:

SecurityEvent

| where EventID == 4648

| where Computer in ("VM2", "VM4")

This aligns with the Azure Monitor and Log Analytics query methodology covered in AZ-104 official exam guide (Implement and manage monitoring).

Microsoft Entra ID supports bulk user creation through the Azure portal by uploading a CSV file that contains user attributes such as UserPrincipalName, DisplayName, Department, and JobTitle. This method is explicitly documented as the supported approach for bulk importing users and minimizes administrative effort compared to scripting or manual creation.

To ensure that users are automatically added to a group based on their department, Microsoft Entra ID provides Dynamic User groups. Dynamic User membership allows administrators to define membership rules that evaluate user attributes (for example, user.department -eq "Finance"). Once users are imported with the correct department attribute, Entra ID automatically evaluates the rules and adds users to the appropriate group without manual intervention.

Assigned membership groups require administrators to manually add users, and PowerShell scripting increases complexity and maintenance overhead. XML files are not supported for bulk user import in the Azure portal.

By combining Dynamic User membership groups with a CSV import containing department attributes, the solution ensures automation, accuracy, and minimal administrative effort, exactly as required.

Final Answers:

B. Create groups that use the Dynamic User membership type

E. Create a CSV file that contains user information and the appropriate attributes

When Microsoft schedules maintenance for an Azure virtual machine (VM), the affected VM may experience a short downtime or host migration. In some cases, administrators can proactively move the VM to a new physical host before maintenance begins to minimize disruption.

According to the Microsoft Azure Administrator documentation, the only supported method to proactively move a VM to a new host is to use the Redeploy feature available under VM → Redeploy + reapply in the Azure portal or through PowerShell (Set-AzVM -Redeploy).

The Redeploy operation stops the VM, moves it to a new physical host within the same region, and then restarts it automatically. This ensures the VM is placed on healthy hardware immediately, mitigating any pending maintenance impact.

In contrast, moving a VM to a different subscription:

Is a metadata-level operation, not a host-level migration.

Requires the VM to be in a deallocated state before the move.

Does not cause the VM to change its underlying physical host.

Is typically used for billing or management reorganization, not to mitigate maintenance events.

Therefore, moving the VM to another subscription does not achieve the goal of moving VM1 to a different physical host. The VM remains on the same compute node until redeployed or maintenance is automatically performed by Azure.

The correct solution in this scenario is to use “Redeploy” from the VM blade, which explicitly triggers host relocation.

To meet the technical requirement — “Use TLS for WebApp1” — the web app must be configured with a certificate that is compatible with Azure App Service for HTTPS/TLS binding.

According to the Microsoft Azure Administrator documentation on App Service Certificates and Key Vault integration, the following key points determine which certificates can be used:

Supported Certificate Format:Azure App Service supports importing certificates in PFX (PKCS #12) format, which includes both the public and private keys necessary for TLS/SSL binding.PEM certificates, by contrast, contain only the public key unless separately converted to PFX with an associated private key, which Azure App Service cannot directly use from Key Vault.

Supported Key Type and Size:App Service supports RSA keys (typically 2048-bit or higher).Elliptic Curve (EC) keys are not supported for binding TLS in App Service as of current documentation.

Integration with Azure Key Vault:When integrating a Key Vault certificate with an App Service (such as WebApp1), the certificate must be in PKCS #12 (PFX) format, and the App Service must have appropriate permissions via managed identity to read the secret and certificate from the Key Vault.

From the Vault1 data provided in your scenario:

Name

Content type

Key type

Key size

Cert1

PKCS #12

RSA

2048

Cert2

PKCS #12

RSA

4096

Cert3

PEM

RSA

2048

Cert4

PEM

RSA

4096

Analysis:

Cert1 and Cert2 are PKCS #12 certificates, so both contain the private key required for TLS.

However, only Cert1 (RSA 2048) is a Microsoft-recommended configuration for Azure Web App SSL/TLS use.

Cert2 has a 4096-bit RSA key. Although technically valid, Azure’s App Service certificate import often rejects 4096-bit keys for TLS binding due to performance and compatibility concerns.

Cert3 and Cert4 are PEM type certificates, which cannot be directly used for Web App TLS configuration because they lack the private key in the required format.

Therefore, according to the Azure Administrator Exam Study Guide and Microsoft official documentation, the only valid certificate that meets the requirements is:

✅ Cert1 only

Final Verified Answer: ✅ A. Cert1 only

Traffic Analytics analyzes the network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud1. NSG flow logs are a feature of Network Watcher that allows you to view information about ingress and egress IP traffic through an NSG2. To use Traffic Analytics, you need to enable NSG flow logs for the network security groups you want to monitor1.

Diagnostic settings for VM1 or NSG1 are not required for Traffic Analytics. Diagnostic settings are used to stream log data from an Azure resource to different destinations such as Log Analytics workspace, Event Hubs, or Storage account3. Insights for VM1 are also not required for Traffic Analytics. Insights are a feature of Azure Monitor that provide analysis of the performance and health of an Azure resource4.

According to the Microsoft Azure Administrator (AZ-104) official documentation and study guides, when a virtual machine (VM) in Azure is scheduled for maintenance, you can proactively move the VM to another host to minimize downtime. This process is called a self-service maintenance move.

When Azure schedules maintenance events that could affect the underlying host hardware, customers have the option to move their virtual machines within the same region and subscription to a healthy host by using either the Azure portal, PowerShell, or the Azure CLI. The operation that performs this action is called Redeploy or Maintenance Redeploy.

In this scenario, the proposed action — moving the VM to another subscription from the resource group blade — does not satisfy the requirement. Moving a VM between subscriptions involves deallocation and redeployment, which does not guarantee that the VM will move to a new host to avoid maintenance. In fact, the VM will remain unavailable during the move process and may need to be reconfigured.

The correct solution to move a VM to another host immediately is to perform a self-service maintenance operation or redeploy the VM. This can be done by selecting the VM in the Azure portal, navigating to Help + support → Maintenance, and choosing “Move to a different host”, or by using the Redeploy button under the VM settings.

Thus, moving the VM to another subscription does not meet the maintenance mitigation goal.

Box 1: An Azure Log Analytics workspace

In the Azure portal you can set up a Log Analytics workspace, which is a unique Log Analytics environment with its own data repository, data sources, and solutions.

Box 2: NSG1

NSG flow logs allow viewing information about ingress and egress IP traffic through a Network security group. Through this, the IP addresses that connect to the ILB can be monitored when the diagnostics are enabled on a Network Security Group.

We cannot enable diagnostics on an internal load balancer to check for the IP addresses.

As for Internal LB, it is basic one. Basic can only connect to storage account. Also, Basic LB has only activity logs, which doesn't include the connectivity workflow. So, we need to use NSG to meet the mentioned requirements.

When a public Azure DNS zone is created, Azure automatically assigns a set of authoritative name servers (NS records) to the zone. However, simply creating the DNS zone in Azure does not make it resolvable from the internet. For external resolution to work, the domain registrar must delegate authority to Azure DNS.

Microsoft Azure documentation clearly states that to make DNS records resolvable publicly, you must update the domain registrar’s NS records to point to the Azure-assigned name servers. This action establishes Azure DNS as the authoritative DNS provider for the domain.

Creating NS or SOA records within the Azure DNS zone itself does not affect external resolution unless the registrar delegation is completed. The SOA record is automatically created and managed by Azure DNS and must not be modified at the registrar.

1 - storage1, storage2, storage3

2 - storage2

Box 1: Access Control (IAM)

Since the App1 uses Managed Identity, App1 can access the Storage Account via IAM. As per requirement, we need to minimize the number of secrets used, so Access keys is not ideal.

Box 2: Shared access signatures (SAS)

We need temp access for App2, so we need to use SAS.

A shared access signature (SAS) provides secure delegated access to resources in your storage account without compromising the security of your data. With a SAS, you have granular control over how a client can access your data. You can control what resources the client may access, what permissions they have on those resources, and how long the SAS is valid, among other parameters.