Microsoft Azure Administrator AZ-104 Exam Questions

Answer : B, D

Traffic Analytics is a feature within Azure Network Watcher that provides insights into network traffic patterns, security threats, and performance using NSG flow logs. To enable Traffic Analytics, two key resources are required:

A Log Analytics Workspace -- This is where Azure Network Watcher sends and stores the processed flow log data for analysis.

A Storage Account -- Network Security Group (NSG) flow logs are first written to a designated storage account before they are ingested by Traffic Analytics for processing.

According to Microsoft Azure Administrator documentation, under ''Enable Traffic Analytics'':

''Traffic Analytics uses Network Watcher NSG flow logs, which must be stored in a storage account. These logs are then processed and analyzed in a Log Analytics workspace to provide insights into network activity.''

Workflow:

NSG flow logs stored in Azure Storage Account

Logs are processed by Azure Monitor ingested into Log Analytics workspace

Traffic Analytics visualizes and analyzes the data

Other options such as Azure Monitor workbooks or Sentinel workspaces are not mandatory to activate Traffic Analytics.

Thus, to use Traffic Analytics, you must create: A Storage Account to store flow logs A Log Analytics Workspace to process and visualize them

Answer : C

Answer : D

The screenshot shows the Schedule Backup Wizard (Files and Folders), which is the Microsoft Azure Recovery Services (MARS) agent experience. This is file/folder backup to a Recovery Services vault, not an ''Azure VM backup'' policy-based backup. In Microsoft's Azure Backup guidance, the MARS agent protects files and folders on a Windows machine by uploading encrypted backup data to the Recovery Services vault. The encryption is controlled by a customer-managed passphrase, and Azure does not store that passphrase.

Because MARS backups are agent-based, restore is not limited to the original VM or to the VM's region. Microsoft documentation for MARS restore describes restoring to the original location or to an alternate location, including another server, as long as the target machine is registered to the same vault and you provide the same passphrase used to encrypt the backups. The presence of VM2 in West US does not block restore for MARS-protected files/folders; region coupling is a constraint for Azure VM backup (vault and VM must be in the same region), not for MARS agent file/folder backup.

So, after redeploying or on another VM, you install and register the MARS agent to Vault1, then perform a restore of Folder1 using the correct passphrase---VM2 is a valid restore target.

Answer : D

Azure Storage Explorer is a free tool from Microsoft that allows you to work with Azure Storage data on Windows, macOS, and Linux. You can use it to upload and download data from Azure blob storage.

Scenario:

Planned Changes include: move the existing product blueprint files to Azure Blob storage.

Technical Requirements include: Copy the blueprint files to Azure over the Internet.

Answer : B

In Microsoft Azure Active Directory (Azure AD), there is a clear distinction between internal users (members) and external users (guests). When you need to add a large number of external users (B2B collaborators) --- such as those listed in a CSV file --- you must use Azure AD B2B invitation processes, not the Bulk create user operation.

According to the Microsoft Azure Administrator Study Guide and Azure AD documentation, the Bulk create user operation in the Azure portal is designed only for internal user accounts within the organization's directory. It cannot be used to create guest user accounts. Guest users must be invited to the directory using either:

The New-AzureADMSInvitation PowerShell cmdlet, which sends invitations to external users' email addresses and creates guest accounts (userType = ''Guest'').

The Azure AD portal ''Bulk invite'' feature, which allows uploading a CSV file containing email addresses of external users to automate guest account creation.

The documentation explicitly states:

''To invite external users (B2B collaboration users) in bulk, you must use the Bulk invite feature or PowerShell with the New-AzureADMSInvitation cmdlet. The Bulk create operation is only supported for member users.'' (Source: Microsoft Learn -- Azure Active Directory B2B collaboration and bulk operations guide)

Therefore, since the scenario uses Bulk create user, it does not meet the goal of creating guest accounts for external users.

Answer : C

As App1 is public-facing we need an incoming security rule, related to the access of the web servers.

Scenario: You have a public-facing application named App1. App1 is comprised of the following three tiers: a SQL database, a web front end, and a processing middle tier.

Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.

Answer : B

Azure Backup uses the Recovery Services vault to protect virtual machines by creating restore points stored in Azure. Before a virtual machine can be backed up, it must have the Azure Backup extension (also called VMBackup extension) properly installed and configured on the VM.

According to Microsoft Learn -- ''Back up and restore encrypted virtual machines'' and ''Back up Azure VMs with the Azure Backup service'', the backup process for a VM requires the following:

''When you enable backup for an Azure virtual machine, the Azure Backup service installs an extension on the VM to coordinate the snapshot and backup process. If the extension is missing or not installed properly, backups cannot be triggered for that VM.''

Explanation of the Scenario

You already have a Recovery Services vault protecting VM1 and VM2. You now need to add VM3 and VM4 to the same vault for protection.

Before they can be added, you must ensure that:

The VMs are running in the same region as the Recovery Services vault (because a vault can only protect resources within its region).

The VMBackup extension is installed and registered on each VM.

If the backup extension is missing or not configured correctly, Azure Backup cannot communicate with the VM to take snapshots or register it in the vault.

Once the extension is properly configured, you can then enable backup from the Recovery Services vault without needing to create a new vault, policy, or storage account --- because all those resources already exist and can be reused.

Other Options Explained

A . Create a new Recovery Services vault: Not necessary unless the new VMs are in a different region from the existing vault.

C . Create a storage account: Azure Backup automatically manages backup storage within the vault; no separate storage account is required.

D . Create a new backup policy: Not needed unless you want a different backup schedule or retention. You can use the existing policy.

Final Verified Answe r: B. Configure the extensions for VM3 and VM4.

Microsoft Learn Extract (Supporting Documentation):

''To enable Azure Backup for virtual machines, the Azure Backup extension must be installed. This extension coordinates the snapshot and backup process and is installed automatically when backup is enabled.'' ''If the extension is not installed, you must configure it before enabling protection.'' (Source: Microsoft Learn --- Back up Azure VMs with the Azure Backup service, Azure Recovery Services vault overview)