Microsoft AZ-104 - Microsoft Azure Administrator

https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-create-new-alert-rule

You create an alert rule by combining:

- The resources to be monitored.

- The signal or telemetry from the resource.

- Conditions.

Then you define these elements for the resulting alert actions by using:

- Alert processing rules

- Action groups

1. Create a Recovery Services vault

2. Delegate permissions for the vault

3. Create a backup policy and configure the backup

When backing up a specific disk (like Disk2) of an Azure virtual machine using Azure Backup, the process involves the use of a Recovery Services vault — not an “Azure Backup vault.” The Recovery Services vault is the central management entity for backup policies, recovery points, and monitoring of backup operations.

According to Microsoft Azure Administrator (AZ-104) study documentation and Azure Backup official documentation, the correct sequential procedure is:

1️⃣ Create a Recovery Services vault

A Recovery Services vault stores backup data and recovery points. It is a required component before you can configure backups for any VM disks.

Extract from documentation:

“A Recovery Services vault is a storage entity in Azure that houses backup data for various workloads such as Azure VMs, SQL databases, and files.”

2️⃣ Delegate permissions for the vault

The Azure Backup service needs permission to access and manage the VM’s resources during backup operations. By default, this is handled through the Azure Backup service principal.

For custom scenarios (such as disk-level backup or managed identity use), proper permissions must be granted to allow access to both the vault and the VM’s disks.

Extract from documentation:

“Ensure that the Backup service has the necessary permissions on the vault and virtual machine resource group to configure backups and access data disks.”

3️⃣ Create a backup policy and configure the backup

Finally, create a backup policy (daily, weekly, etc.) and apply it to VM1, selecting Disk2 specifically for protection.

Extract from documentation:

“After the Recovery Services vault is created and permissions are delegated, configure a backup policy that defines the schedule and retention, then enable backup for the selected disks.”

This process ensures compliance with Azure Backup’s architecture and automation framework while using Azure Resource Manager (ARM) authorization flow.

✅ Final Verified Sequence Answer:

Create a Recovery Services vault

Delegate permissions for the vault

Create a backup policy and configure the backup

Box 1: storageaccount1 and storageaccount2 only

Box 2: All the storage accounts

Note: The three different storage account options are: General-purpose v2 (GPv2) accounts, General-purpose v1 (GPv1) accounts, and Blob storage accounts.

General-purpose v2 (GPv2) accounts are storage accounts that support all of the latest features for blobs, files, queues, and tables.

Blob storage accounts support all the same block blob features as GPv2, but are limited to supporting only block blobs.

General-purpose v1 (GPv1) accounts provide access to all Azure Storage services, but may not have the latest features or the lowest per gigabyte pricing.

In Azure, load balancer configurations must have consistent SKU compatibility between the load balancer and its associated backend pool members. The Standard SKU Load Balancer requires that all backend pool members — such as virtual machines, network interfaces, or virtual machine scale sets — use Standard SKU public IPs or Standard SKU configurations if external, and proper network interface associations if internal.

However, in this question:

LB1 is an internal Standard SKU load balancer.

Internal load balancers do not require or support public IP addresses on the backend virtual machines.

Backend pool members of an internal load balancer are identified by private IP addresses from the virtual network, not public IPs.

According to Microsoft Azure Load Balancer documentation (Azure Administrator Guide, “Configure Standard Load Balancer”),

“For a Standard internal load balancer, the backend pool can contain only virtual machines or NICs that are in the same virtual network as the load balancer. Public IP addresses are not required and not supported for backend members.”

To correctly meet the goal, the proper solution is to:

Ensure that VM1 and VM2 are deployed within the same virtual network (VNET1) and subnet as LB1.

Ensure that the NICs of both VMs are configured with Standard SKU (if public IPs are attached elsewhere) to match the load balancer SKU.

Add these NICs or virtual machines directly to the backend pool of LB1.

Creating and assigning Standard SKU public IP addresses to each VM is unnecessary and does not help connect them to the internal load balancer. In fact, it contradicts Azure’s design for internal load balancers, which only route traffic using private addresses within the virtual network scope.

Therefore, the given solution does not meet the goal.

A custom policy definition is a way to define your own rules for using Azure resources. You can use custom policies to enforce compliance, security, cost management, or organization-specific requirements. However, a custom policy definition alone is not enough to meet the goal of automatically blocking TCP port 8080 between the virtual networks. You also need to create a policy assignment that applies the custom policy definition to the scope of the subscription. A policy assignment is the link between a policy definition and an Azure resource. Without a policy assignment, the custom policy definition will not take effect. Therefore, the solution does not meet the goal.

Azure Firewall must be deployed in the same Azure region as the virtual network and into a dedicated subnet named AzureFirewallSubnet.

From the table:

VNET1 → West US → RG1 ✅

VNET4 → West US → RG2 ✅

VNET2 → Central US ❌

VNET3 → Central US ❌

Resource group location does not restrict deployment—only region alignment matters.

Microsoft documentation confirms:

“Azure Firewall must be deployed into a virtual network in the same region.”

In Azure, Virtual Network Peering connects two virtual networks (VNets) and allows traffic between them using private IP addresses, traversing the Microsoft backbone network rather than the public internet. For peering to function correctly, both sides of the connection must have a valid, reciprocal configuration (peering must be created from each VNet and accepted).

From the exhibit:

vNET6 has two peering configurations:

peering1 → vNET1 (Gateway Transit = Enabled)

peering2 → vNET2 (Gateway Transit = Disabled)Both are currently showing a status of “Disconnected”, meaning that the remote peering (from vNET1 and vNET2 back to vNET6) hasn’t been set up or accepted yet.

Because the peering links are disconnected, vNET6 cannot communicate with any other VNet—only internal communication within vNET6 is possible.

To fix the peering connection status for vNET1, you cannot directly edit an incomplete or mismatched configuration. Microsoft’s official documentation ( " Azure Virtual Network peering – requirements and constraints " ) states that you must delete and recreate the peering if the configuration is invalid or disconnected. Therefore, to establish a working connection to vNET1, you must first delete peering1 and then reconfigure it correctly on both VNets.

Azure Backup uses Recovery Services vaults (RSVs) to manage backup and restore operations for virtual machines. Each backup consists of:

Instant Restore Snapshots — retained for quick recovery (up to 5 days in this case).

Daily Recovery Points — stored in the Recovery Services vault based on the retention policy (14 days here).

In the scenario, VM1’s website was updated eight days ago, meaning the restore point required is eight days old — beyond the 5-day instant snapshot retention period but within the 14-day daily backup retention window.

According to the Azure Backup documentation, restoring from a vault-stored daily recovery point (not instant snapshot) involves creating a new virtual machine because it ensures a non-disruptive restore and minimal downtime.

Here’s how it works:

The backup is used to create a new VM in the same or different resource group.

Once the new VM is confirmed operational, you can redirect traffic or replace the original VM during a controlled maintenance window.

The “Replace existing” option, on the other hand, overwrites the current VM — leading to downtime and risk if validation fails.

Therefore, to restore VM1 to its state from eight days ago while minimizing downtime, you must first restore using the “Create new restore configuration” option, validate the restore, and then switch over seamlessly.

Resource Group is the correct answer: Admin user, password, vm size and os are the part of ARM templates. But resource group is not hence needs to be mentioned while deployment! Refer below sample ARM template for reference in which all above attributes passed in parameter. https://github.com/Azure/azure-quickstart-templates/blob/master/101-vm-simple-windows/azuredeploy.json

https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-policies

According to Microsoft Azure Resource Manager (ARM) and Azure Policy documentation used in the Microsoft Certified: Azure Administrator Associate (AZ-104) study guide, tags are name-value pairs applied to Azure resources to logically organize and manage them.

Tags can be manually applied or automatically enforced through Azure Policy. In this question, the assigned policy is “Apply tag and its default value”, scoped to Resource Group RG6. The policy parameters specify that the Tag name is “Label” and the Tag value is “Value1”.

Here’s how Azure applies tags in this context:

Tags applied at the resource group level are not inherited by resources within the group automatically. They must be manually set or enforced through a policy.

When you apply the “Apply tag and its default value” policy to a resource group, it automatically assigns the specified tag (“Label: Value1”) to all existing and new resources within that scope (RG6), unless the resource already has a tag with the same name.

The existing tag on VNET1 (Department: D1) remains unchanged because the policy does not overwrite existing tags—it only adds the new tag if it’s missing.

VNET2, which is deployed after the policy is assigned, inherits the “Label: Value1” tag automatically because it’s a newly created resource within RG6.

Since RG6 itself has a tag “RGroup: RG6”, that tag does not automatically apply to its resources because tag inheritance does not occur from resource groups unless enforced by a policy.

Therefore:

VNET1 retains its original tag “Department: D1” and receives the additional “Label: Value1” tag from the applied policy.

VNET2 only receives “Label: Value1” because that’s the policy-enforced tag for the resource group RG6.

Final Verified Answers:

✅ VNET1: Department: D1 and Label: Value1 only

✅ VNET2: Label: Value1 only