Microsoft Updated AZ-104 Exam Questions and Answers by milan

Azure Monitor for VM Insights is a feature of Azure Monitor that provides comprehensive monitoring and diagnostics for your Azure virtual machines and virtual machine scale sets. It collects performance data, process information, and network dependencies from your virtual machines and displays them in interactive charts and maps. You can use Azure Monitor for VM Insights to troubleshoot performance issues, optimize resource utilization, and identify network bottlenecks1.

To enable Azure Monitor for VM Insights, you need to install two agents on your virtual machines: the Azure Monitor agent (preview) and the Dependency agent. The Azure Monitor agent collects performance metrics and sends them to a Log Analytics workspace. The Dependency agent collects process information and network dependencies and sends them to the InsightsMetrics table in the same workspace2.

By default, the agents communicate with Azure Monitor over the public internet. However, if you want to ensure that all the virtual machines only communicate with Azure Monitor through a virtual network named VNet1, you need to configure private network access for the agents.

Private network access allows the agents to communicate with Azure Monitor using a private endpoint, which is a special network interface that connects your virtual network to an Azure service without exposing it to the public internet. A private endpoint uses a private IP address from your virtual network address space, so you can secure and control the network traffic between your virtual machines and Azure Monitor3.

To configure private network access for the agents, you need to create an Azure Monitor Private Link Scope (AMPIS) first. An AMPIS is a resource that groups one or more Log Analytics workspaces together and associates them with a private endpoint. An AMPIS allows you to manage the private connectivity settings for multiple workspaces in one place4.

After creating an AMPIS, you need to create a private endpoint in VNet1 and link it to the AMPIS. This will enable the agents on your virtual machines to send data to the Log Analytics workspaces in the AMPIS using the private IP address of the private endpoint5.

NET Core 3.0: Windows and Linux ASP .NET V4.7: Windows only PHP 7.3: Windows and Linux Ruby 2.6: Linux only Also, you can’t use Windows and Linux Apps in the same App Service Plan, because when you create a new App Service plan you have to choose the OS type. You can ' t mix Windows and Linux apps in the same App Service plan. So, you need 2 ASPs. Reference: https://docs.microsoft.com/en-us/azure/app-service/overview

When configuring an Azure App Service app (WebApp1), several hosting plans determine scaling capabilities and supported features such as custom domains, SSL, and auto-scaling.

According to Microsoft Azure Administrator Documentation:

Custom Domain Verification:To map a custom domain (like app.contoso.com) to an Azure Web App, Azure must verify that you own the domain.Microsoft documentation specifies:

“To verify a custom domain, create a TXT record in your DNS zone. The TXT record contains a verification token that Azure uses to confirm ownership of the domain before binding it to your App Service.”

(Source: Azure App Service – Map custom domain)

While an A record or CNAME record is eventually used to direct traffic to the app, the TXT record is used solely for domain verification.

Scaling Requirement (Up to 8 Instances):The Free and Shared App Service plans have significant limitations:

Free / Shared: No scaling (only 1 instance, no custom domain SSL support).

Basic: Supports up to 3 instances.

Standard: Supports up to 10 instances, includes auto-scaling, and supports custom domains and SSL.

Premium: Adds advanced scaling and isolation but is more expensive and unnecessary here.

Microsoft documentation states:

“The Standard pricing tier supports auto-scaling up to 10 instances and custom domains, offering a balance between cost and capability.”

(Source: Azure App Service Plan Tiers Overview)

Since the requirement includes automatic scaling up to eight instances and custom domain verification, the Standard plan is the minimum suitable tier — satisfying both performance and cost-efficiency conditions.

✅ Final Verified Answer:

Pricing plan: Standard

Record type: TXT

Justification Summary (from Microsoft Documentation):

Custom domain verification → Requires a TXT record.

Auto-scale up to 8 instances → Requires at least the Standard plan.

Minimize cost and effort → Standard plan is the optimal balance.

Azure Monitor metrics such as Network In and Network Out only provide aggregated performance data — i.e., the total volume of bytes entering or leaving a network interface card (NIC). These metrics are useful for monitoring throughput, trends, or network utilization but do not capture or inspect packet-level data between two virtual machines.

To inspect network traffic between two Azure VMs (such as between VM1 and VM2), you must use Azure Network Watcher’s Packet Capture or Connection Monitor feature.

According to the Microsoft Azure Administrator study guide and official documentation:

“Use Azure Network Watcher to monitor, diagnose, and view metrics for resources in a virtual network. The Packet Capture feature enables you to capture network traffic to and from a virtual machine and save it to an Azure Storage account for analysis.”

Therefore, simply creating metrics in Azure Monitor on Network In/Out will not meet the goal, because metrics do not provide detailed traffic inspection, only summary statistics.

To fulfill the requirement (“inspect all the network traffic from VM1 to VM2 for three hours”), the correct approach would be to use Network Watcher → Packet Capture, specifying VM1 as the target, capturing outbound traffic to VM2’s IP, and setting the session duration for 3 hours.

Hence, the given solution does not meet the goal.