AZ-104 Exam Dumps - Microsoft Azure Administrator

Scenario: Create a workflow to send an email message when the settings of VM4 are modified.

You can start an automated logic app workflow when specific events happen in Azure resources or third-party resources. These resources can publish those events to an Azure event grid. In turn, the event grid pushes those events to subscribers that have queues, webhooks, or event hubs as endpoints. As a subscriber, your logic app can wait for those events from the event grid before running automated workflows to perform tasks - without you writing any code.

The question asks which storage account type should be created for storage5 and which existing storage account should be configured as the destination for replication — while supporting the planned changes.

Step 1: Planned Change Requirement

From the case study:

“Create a storage account named storage5 and configure storage replication for the Blob service.”

This indicates that storage5 will act as a secondary (destination) account to receive geo-replicated blobs (as part of RA-GRS or GRS replication configuration).

Therefore, the new storage5 must support Blob service replication features.

Step 2: Determining Correct Account Type

According to Microsoft Azure Administrator Documentation (Microsoft Learn: “Types of storage accounts”):

Account Type

Blob Support

File Share Support

Recommended Use

Storage (general purpose v1)

✅ Basic blob

Limited

Legacy use, lacks advanced features

StorageV2 (general purpose v2)

✅ Full blob, file, queue, table support

✅

Supports replication (GRS, RA-GRS, ZRS) and access tiers

BlobStorage

✅ Blob only

❌ No file shares

Used only for block and append blobs

BlockBlobStorage

✅ Blob only (premium tier)

❌ No file shares

High-performance workloads only

Therefore, the correct type for storage5 must be StorageV2, as it supports both:

Blob service replication (GRS, RA-GRS, ZRS, LRS)

All tiers (Hot, Cool, Archive)

This meets the planned change and ensures the account supports replication for Blob service.

Step 3: Determining the Correct Destination Storage Account

The question also requires identifying which existing storage account should act as the destination for replication configuration.

In Azure, Blob service replication (for example, geo-redundant replication or object replication) requires:

Both storage accounts to be StorageV2.

Both to be in the same region pair and have object replication enabled.

Looking at the table:

Storage Account

Kind

Location

File Share

Identity-based Access

storage1

Storage (general purpose v1)

West US

sharea

Azure AD DS

storage2

StorageV2 (general purpose v2)

East US

shareb, sharec

Disabled

storage3

BlobStorage

East US 2

N/A

N/A

storage4

FileStorage

Central US

shared

Azure AD DS

Only storage2 meets all of the following conditions:

✅ Type: StorageV2

✅ Region: East US (a valid replication pair for East US 2 or secondary region)

✅ Blob Service supported

Hence, storage2 is the correct destination storage account to configure for replication from storage5.

Step 4: Supporting Microsoft Azure Documentation Extracts

From Microsoft Learn – Azure Storage account overview:

“General-purpose v2 accounts support all Azure Storage features, including blob, file, queue, and table storage. They are recommended for most scenarios.”

“Object replication requires both source and destination accounts to be of the same type (StorageV2) and in regions that are geo-paired.”

“Blob and StorageV2 accounts support replication options such as LRS, ZRS, GRS, and RA-GRS.”

1️⃣ Create a Log Analytics workspace.

2️⃣ Collect Windows performance counters from the Log Analytics agents.

3️⃣ Create an alert rule.

The question states:

“You need to configure the alerts for VM1 and VM2 to meet the technical requirements.”

The technical requirement from the case study specifies:

“Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.”

This requirement involves monitoring performance metrics (disk space) and generating alerts based on those metrics. According to Microsoft Azure monitoring and management documentation, the process to configure such alerts involves using Azure Monitor and Log Analytics.

Step-by-Step Verified Solution:

Step 1: Create a Log Analytics workspace

A Log Analytics workspace is required to store and analyze logs and performance data collected from virtual machines.

Azure Monitor uses this workspace as the central repository for performance counters, events, and logs from connected agents.

From the Microsoft Documentation:

“Before you can collect and query data from virtual machines, you must create a Log Analytics workspace in your subscription.”

(Source: Azure Monitor and Log Analytics Guide)

Step 2: Collect Windows performance counters from the Log Analytics agents

After creating the workspace, you must connect VM1 and VM2 to the workspace and configure the Windows performance counters that you want to monitor.

In this case, you would collect the LogicalDisk(%) Free Space counter for C: drive.

Azure Monitor agent or Log Analytics agent collects these metrics and sends them to the workspace for analysis.

“To monitor system performance, configure the agent to collect performance counters such as available memory or free disk space.”

(Source: Azure Monitor Performance Counters Documentation)

Step 3: Create an alert rule

Once performance data is being collected, you can create an alert rule in Azure Monitor based on a Kusto query or metric threshold.

You would define a condition such as:

LogicalDisk | where FreeSpaceMB < 20480

and configure it to trigger an alert when free space on volume C drops below 20 GB.

This alert can notify via email, action group, or automation runbook.

“Alerts in Azure Monitor proactively notify you when important conditions are found in your monitoring data. Alerts can trigger automated actions or notifications.”

(Source: Azure Monitor Alerts Overview)

Incorrect Options (Eliminated):

Configure the Diagnostic settings:

Used for collecting activity logs or resource logs, not performance counters from VMs.

Create an Azure SQL database:

Not relevant to the scenario of monitoring disk space.

Explanation

Scenario:

1. Web administrators will deploy Azure web apps for the marketing department.

2. Each web app will be added to a separate resource group.

3. The initial configuration of the web apps will be identical.

4. The web administrators have permission to deploy web apps to resource groups.

Steps:

1 --> Create a resource group, and then deploy a web app to the resource group.

2 --> From the Automation script blade of the resource group , click Add to Library.

3 --> From the Templates service, select the template, and then share the template to the web administrators .

https://docs.microsoft.com/en-us/azure/role-based-access-control/tutorial-custom-role-powershell

Get-AzRoleDefinition -Name "Reader" | ConvertTo-Json

https://docs.microsoft.com/en-us/powershell/module/az.resources/get-azroledefinition?view=azps-5.9.0

https://docs.microsoft.com/en-us/azure/role-based-access-control/tutorial-custom-role-powershell

https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/convertto-json?view=powershell-7.1

https://docs.microsoft.com/en-us/powershell/module/azuread/get-azureaddirectoryrole?view=azureadps-2.0

Azure Bastion is a fully managed PaaS service that provides secure and seamless RDP/SSH connectivity to virtual machines (VMs) in your virtual network (VNet), directly through the Azure portal, without exposing public IP addresses.

🔹 Scenario Breakdown

From the question:

You have several resources connected to a single VNet1, including:

VM1 – a virtual machine

App1 – likely an Azure App Service or web app

contoso.com – a custom domain or DNS zone

You plan to deploy an Azure Bastion host named Bastion1 into VNet1.

🔹 What Azure Bastion Protects

According to Microsoft Learn (“What is Azure Bastion?”):

“Azure Bastion provides secure RDP and SSH connectivity to virtual machines in your virtual network directly from the Azure portal, without requiring a public IP address on your virtual machines.”

Key characteristics:

Works only with VMs (Windows or Linux) deployed inside the same virtual network or peered virtual networks.

Enables RDP/SSH sessions through the browser.

Does not apply to App Services, DNS zones, Azure AD, storage accounts, or any PaaS resources.

Does not provide protection for domain names or endpoints such as contoso.com.

🔹 Analysis of Options

Resource

Description

Can Bastion protect it?

Reason

VM1

Virtual Machine in VNet1

✅ Yes

Bastion provides RDP/SSH access without public IP

App1

Likely an Azure Web App / PaaS

❌ No

Web Apps are accessed via HTTPS, not RDP/SSH

contoso.com

Custom domain / DNS zone

❌ No

Not a networked compute resource

🔹 Correct Answer

✅ A. VM1 only

Because:

Bastion can only secure VMs through private IP connections for RDP (Windows) and SSH (Linux).

App1 (App Service) and contoso.com (custom domain) are not eligible for Bastion protection.

📘 Microsoft Official Documentation Extract (Azure Administrator Study Guide)

“Azure Bastion is a fully managed service that provides secure and seamless RDP and SSH connectivity to your virtual machines directly through the Azure portal over SSL. Bastion hosts are deployed per virtual network and support virtual machines within that network and any peered networks.”

“Azure Bastion cannot be used to connect to PaaS services such as App Service, SQL Database, or any resource that does not have a NIC inside the virtual network.”

✅ Final Verified Answer: A. VM1 only

Azure Bastion provides secure RDP/SSH access to VMs within the same VNet or peered VNets, but it does not apply to App Services or custom domains.

In Microsoft Entra ID (Azure Active Directory), creating guest user accounts for external users involves the B2B collaboration invitation process, not the Bulk create user operation. The Bulk create user feature in the Azure portal is used exclusively for creating member users (internal accounts) within your tenant — users that belong directly to your organization.

The Microsoft Azure Administrator official study guide and documentation specify that to onboard external users (guests), you must invite them using the B2B invitation mechanism. This process creates user objects with userType = Guest in your directory. The correct method to achieve this in bulk is by using the PowerShell cmdlet New-AzureADMSInvitation or Microsoft Graph API to send invitations automatically to all external users listed in your CSV file.

Bulk create user operation does not support adding guest accounts because it doesn’t generate the B2B invitation link or email, which is required for the external user to accept and authenticate using their own identity provider (e.g., Microsoft account, Google, or another Entra tenant).

Therefore, the proposed solution fails to meet the requirement of creating guest accounts for the 500 external users in the contoso.com tenant. The correct solution would be to use PowerShell with the New-AzureADMSInvitation command or the Azure AD portal’s “Invite external users” bulk import option designed specifically for guest creation.