How Should You Track Windows Registry and DNS Changes on Azure VMs?

Why the Answer Is Correct

Azure Automation Change Tracking and Inventory is the service designed to monitor changes inside the Windows guest operating system, including registry keys, files, software, and services. For the registry requirement, it provides the audit trail without building custom scripting or per-VM manual processes. DNS settings on Azure virtual machines are exposed as Azure resource configuration properties, so Azure Monitor Change Analysis is the appropriate fit because it records changes made to Azure resources and their configuration. Using Change Tracking and Inventory for registry and Change Analysis for DNS keeps administrative effort low and aligns each tool with the layer it actually monitors.

Why Other Candidate Answers Are Wrong

Azure Monitor VM Insights is primarily a performance and dependency monitoring feature, not a configuration-change audit trail for registry keys or DNS settings. Azure Policy can audit and enforce Azure resource properties, but it does not inspect Windows registry changes inside the guest OS. Using Log Analytics or Azure Monitor Agent alone would require custom data collection and query logic, increasing administrative effort and failing the audit-trail requirement. Change Analysis cannot see registry edits inside the VM, just as Change Tracking and Inventory is not the primary tool for Azure resource property changes such as DNS configuration.

Community Comment Notes

AllanHouston's comment aligns closely with this split, noting that Change Tracking "monitors changes inside the Windows guest operating system, including registry keys" and pairing that with Azure Monitor Change Analysis for DNS setting changes. The comment's quoted Microsoft Learn reference reinforces that registry monitoring is an in-guest capability, which is the key distinction the exam is testing. No community commentary in the provided record argues for a single service covering both requirements.