"Encryption scopes enable you to manage encryption at the level of an individual blob or container."
https://learn.microsoft.com/en-us/azure/storage/blobs/encryption-scope-manage?tabs=portal

Explanation:
Box 1: Remove the public IP address from VM1
If the Public IP on VM1 is set to Dynamic, that means it is a Public IP with Basic SKU because Public IPs with Standard SKU have Static assignments by default, that cannot be changed. We cannot associate Basic SKUs IPs with Standard SKUs LBs. One cannot create a backend SLB pool if the VM to be associated has a Public IP. For Private IP it doesn't matter weather it is dynamic or static, still we can add the such VM into the SLB backend pool.
Box 2: Create and configure an NSG
Standard Load Balancer is built on the zero trust network security model at its core. Standard Load Balancer secure by default and is part of your virtual network. The virtual network is a private and isolated network.
This means Standard Load Balancers and Standard Public IP addresses are closed to inbound flows unless opened by Network Security Groups. NSGs are used to explicitly permit allowed traffic. If you do not have an NSG on a subnet or NIC of your virtual machine resource, traffic is not allowed to reach this resource. To learn more about NSGs and how to apply them for your scenario, see Network Security Groups. Basic Load Balancer is open to the internet by default.

Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/quickstart-load-balancer-standard-public-portal
https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview

The correct answer is a data collection endpoint . IIS logs are guest workload logs generated inside the Windows Server operating system, so they are collected through the Azure Monitor Agent collection pipeline rather than through platform diagnostic settings. Microsoft states that IIS logs can be collected by Azure Monitor Agent by using a data collection rule (DCR) with an IIS Logs data source, and the data is sent to a Log Analytics workspace where it is stored in the W3CIISLog table.
Among the listed choices, the endpoint component is the required first configuration element for the Azure Monitor Agent data ingestion path. Microsoft describes a data collection endpoint as including the components required to ingest data into Azure Monitor and send configuration files to Azure Monitor Agent.
After the endpoint/DCR collection path is established, the IIS Logs data source and Log Analytics destination are configured.
VM insights focuses on VM performance and dependency monitoring, not IIS log ingestion. Diagnostic settings route Azure platform logs and metrics, not IIS guest log files. Private endpoints and AMPLS are for private connectivity and network isolation, not the primary IIS log collection configuration. Study Guide reference: AZ-104 Monitor and back up Azure resources > Azure Monitor, Log Analytics, Azure Monitor Agent, and VM log collection.

Explanation:

The planned change specifies that you must configure a Data Collection Rule (DCR) to collect only system events with Event ID 4648 from VM2 and VM4.
A Data Collection Rule (DCR) in Azure Monitor defines how data is collected from resources, filtered, and sent to destinations like Log Analytics workspaces. To define or query this data within Azure Monitor Logs or Log Analytics, you use Kusto Query Language (KQL).
From the Microsoft Learn: Azure Monitor Logs Documentation:
"Log queries in Azure Monitor are written in Kusto Query Language (KQL), the same query language used by Azure Data Explorer."
"KQL is optimized for querying large datasets, filtering by event IDs, sources, and event types." Other options:
* WQL (WMI Query Language) - used for on-prem Windows event querying, not for Azure DCR.
* T-SQL (Transact-SQL) - used for Azure SQL Database queries, not for monitoring data.
* XPath - used in Event Viewer or XML-based event filtering, not within Azure Monitor DCR configuration.
Therefore, when you configure DCR1 to collect system events (Event ID 4648) from the specified VMs, the Kusto Query Language (KQL) is the correct and verified method to filter and process these events.
Example of a valid KQL expression for this requirement:
SecurityEvent
| where EventID == 4648
| where Computer in ( " VM2 " , " VM4 " )
This aligns with the Azure Monitor and Log Analytics query methodology covered in AZ-104 official exam guide (Implement and manage monitoring).