Objective 5.014% of exam

Monitor and Maintain Azure Resources

AZ-104 Practice Questions

This AZ-104 domain covers keeping Azure workloads healthy: Azure Monitor metrics and logs, Log Analytics workspaces, KQL queries, alerts and action groups, Application Insights, Network Watcher, and backup/recovery via Recovery Services vaults. The exam tests these through scenario questions asking you to select the right monitoring tool, alert configuration, diagnostic setting, or recovery action for a stated requirement.

Full Practice Test →All Objectives

What this objective tests

AZ-104 Monitor and Maintain Azure Resources — Key Topics

Configure Azure Monitor alerts with action groups, write KQL queries in Log Analytics, and set up Recovery Services vault backups. Get alert scopes and conditions right, since wrong signals cause missed or noisy notifications.

Configuring Azure Monitor diagnostic settings to route resource logs to Log Analytics, Storage, or Event Hubs
Writing KQL queries in Log Analytics to filter, summarize, and aggregate Azure activity and resource logs
Creating metric and log search alerts with action groups, plus interpreting alert processing rules
Using Network Watcher tools like IP flow verify, connection troubleshoot, and NSG flow logs

Common exam traps

Where candidates lose marks on Monitor and Maintain Azure Resources

⚠Confusing metric alerts with log search alerts, then choosing the wrong alert type for a requirement needing KQL query logic.
⚠Forgetting that diagnostic settings must be enabled per resource before logs appear in Log Analytics, so queries return nothing.
⚠Assuming Azure Backup automatically restores VMs; recovery requires selecting a recovery point and restore type in the vault.

AZ-104 Monitor and Maintain Azure Resources — Practice Questions

30 questions from this objective · 14% of your AZ-104 exam

Question 2hardmultiple choice

Monitor and Maintain Azure Resources

AZ-104 Monitor and Maintain Azure Resources — Key Topics

Where candidates lose marks on Monitor and Maintain Azure Resources

AZ-104 Monitor and Maintain Azure Resources — Practice Questions

You need to collect Windows event logs and performance counters from multiple Azure virtual machines and query the data centrally by using Kusto Query Language. Which Azure resource should you deploy?

A business requires that a workload keep running if an entire Azure region becomes unavailable. Is Azure Backup alone sufficient, and what should you add if it is not?

Exhibit

Which of the following Azure VM backup restore options are correctly described?

A team wants daily Azure VM backups with a 30-day retention period. Which two settings are configured in the backup policy? Select two.

An application depends on a regional Azure service. Operations wants an automatic notification if Microsoft posts an incident that affects only the region where the app runs, even when the individual VMs remain healthy. Which two Azure Monitor capabilities should be configured? Select two.

Which policy best matches the requirement for daily backups retained for 30 days?

Exhibit

A user deleted a file from an Azure VM, and the administrator wants to use Azure Backup file-level recovery rather than restore the whole VM. Which two prerequisites are required before mounting the recovery point from the portal? Select two.

An operations team wants an email notification when the average CPU percentage on a VM stays above 85 percent for 10 minutes. Which two Azure Monitor components should they configure? Select two.

An alert must start automated responses when a metric threshold is reached. Which two resources can an Azure Monitor action group invoke? Select two.

Every backup job for a newly deployed Azure VM fails immediately and reports that the VM agent is not ready. Which two checks should the administrator perform first? Select two.

A production virtual machine must trigger an immediate notification whenever average CPU stays above 85 percent for 15 minutes, and the same event must also start an Azure Function that opens an incident ticket. Which two Azure Monitor components should you configure? Select two.

An operations team needs to know when Azure marks a storage account unavailable because of a regional platform issue, and they also want to detect abnormal service latency on the account itself. Which two alerting approaches should they configure? Select two.

A troubleshooting team wants to investigate a storage account write failure and subscription-level role assignment changes in a single Log Analytics workspace. They want to ingest only the telemetry needed for those investigations. Which two sources should they enable? Select two.

An administrator must centralize Azure Activity log events and diagnostic logs from several storage accounts into a single workspace so the team can query them with KQL. What should be configured on each resource?

You are responsible for monitoring and maintaining Azure resources for a large enterprise. Which four of the following actions or configurations can help you proactively identify performance bottlenecks, optimize costs, and ensure high availability? (Choose four.)

You have an Azure subscription that contains a storage account named storage1. You need to ensure that all read and write operations to the blobs in storage1 are logged and retained for 90 days. The logs must be stored in a separate storage account named storage2. What should you configure?

You need to be notified whenever the average CPU usage of VM-App01 exceeds 80 percent for 10 minutes. The solution must send an email to the operations team automatically. What should you configure?

Your company wants to query performance and event data from multiple Azure virtual machines by using Kusto Query Language. The operations team also wants to centralize retention and analysis of this data. What should you deploy?

You need to retain Azure Firewall logs for long-term analysis in a Log Analytics workspace and also archive them in a storage account for compliance. What should you configure on the Azure Firewall resource?

You need to notify the security team whenever anyone deletes a resource group in the subscription. Which alert type should you configure?

Your operations team needs to run Kusto queries across collected sign-in logs, VM performance counters, and Azure Activity Log data in a central location. What should you deploy?

A Virtual Machine Scale Set must add instances automatically when average CPU usage is above 75 percent and remove instances when CPU drops below 30 percent. Which feature should you configure?

You need to collect guest operating system performance counters and Windows event logs from several Azure virtual machines into a central queryable platform. Which Azure component should you configure?

Your operations team needs to receive a Microsoft Teams or email notification whenever a production application becomes unavailable. You have already created an availability test in Azure Monitor. What should you configure next?

You need to view recommendations about underutilized virtual machines, security improvements, and cost-saving opportunities in Azure. Which service should you use?

You need to keep Azure activity log data for longer than the default retention period and make it available for analysis. What should you configure?

You need an alert that emails administrators when CPU on VM-DB01 exceeds a threshold. Which two Azure Monitor components work together to achieve this?

Your operations team wants to query collected VM log data by using Kusto Query Language and retain it centrally for analysis. Which Azure resource should you deploy?

Your company wants to know when an Azure service outage in the region might affect subscribed resources, even if no metric threshold has been crossed yet. Which alert type should you configure?

All AZ-104 Objectives

Monitor and Maintain Azure Resources

AZ-104 Monitor and Maintain Azure Resources — Key Topics

Where candidates lose marks on Monitor and Maintain Azure Resources

AZ-104 Monitor and Maintain Azure Resources — Practice Questions

You need to collect Windows event logs and performance counters from multiple Azure virtual machines and query the data centrally by using Kusto Query Language. Which Azure resource should you deploy?

A business requires that a workload keep running if an entire Azure region becomes unavailable. Is Azure Backup alone sufficient, and what should you add if it is not?

Exhibit

Which of the following Azure VM backup restore options are correctly described?

A team wants daily Azure VM backups with a 30-day retention period. Which two settings are configured in the backup policy? Select two.

An application depends on a regional Azure service. Operations wants an automatic notification if Microsoft posts an incident that affects only the region where the app runs, even when the individual VMs remain healthy. Which two Azure Monitor capabilities should be configured? Select two.

Which policy best matches the requirement for daily backups retained for 30 days?

Exhibit

A user deleted a file from an Azure VM, and the administrator wants to use Azure Backup file-level recovery rather than restore the whole VM. Which two prerequisites are required before mounting the recovery point from the portal? Select two.

An operations team wants an email notification when the average CPU percentage on a VM stays above 85 percent for 10 minutes. Which two Azure Monitor components should they configure? Select two.

An alert must start automated responses when a metric threshold is reached. Which two resources can an Azure Monitor action group invoke? Select two.

Every backup job for a newly deployed Azure VM fails immediately and reports that the VM agent is not ready. Which two checks should the administrator perform first? Select two.

A production virtual machine must trigger an immediate notification whenever average CPU stays above 85 percent for 15 minutes, and the same event must also start an Azure Function that opens an incident ticket. Which two Azure Monitor components should you configure? Select two.

An operations team needs to know when Azure marks a storage account unavailable because of a regional platform issue, and they also want to detect abnormal service latency on the account itself. Which two alerting approaches should they configure? Select two.

A troubleshooting team wants to investigate a storage account write failure and subscription-level role assignment changes in a single Log Analytics workspace. They want to ingest only the telemetry needed for those investigations. Which two sources should they enable? Select two.

An administrator must centralize Azure Activity log events and diagnostic logs from several storage accounts into a single workspace so the team can query them with KQL. What should be configured on each resource?

You are responsible for monitoring and maintaining Azure resources for a large enterprise. Which four of the following actions or configurations can help you proactively identify performance bottlenecks, optimize costs, and ensure high availability? (Choose four.)

You have an Azure subscription that contains a storage account named storage1. You need to ensure that all read and write operations to the blobs in storage1 are logged and retained for 90 days. The logs must be stored in a separate storage account named storage2. What should you configure?

You need to be notified whenever the average CPU usage of VM-App01 exceeds 80 percent for 10 minutes. The solution must send an email to the operations team automatically. What should you configure?

Your company wants to query performance and event data from multiple Azure virtual machines by using Kusto Query Language. The operations team also wants to centralize retention and analysis of this data. What should you deploy?

You need to retain Azure Firewall logs for long-term analysis in a Log Analytics workspace and also archive them in a storage account for compliance. What should you configure on the Azure Firewall resource?

You need to notify the security team whenever anyone deletes a resource group in the subscription. Which alert type should you configure?

Your operations team needs to run Kusto queries across collected sign-in logs, VM performance counters, and Azure Activity Log data in a central location. What should you deploy?

A Virtual Machine Scale Set must add instances automatically when average CPU usage is above 75 percent and remove instances when CPU drops below 30 percent. Which feature should you configure?

You need to collect guest operating system performance counters and Windows event logs from several Azure virtual machines into a central queryable platform. Which Azure component should you configure?

Your operations team needs to receive a Microsoft Teams or email notification whenever a production application becomes unavailable. You have already created an availability test in Azure Monitor. What should you configure next?

You need to view recommendations about underutilized virtual machines, security improvements, and cost-saving opportunities in Azure. Which service should you use?

You need to keep Azure activity log data for longer than the default retention period and make it available for analysis. What should you configure?

You need an alert that emails administrators when CPU on VM-DB01 exceeds a threshold. Which two Azure Monitor components work together to achieve this?

Your operations team wants to query collected VM log data by using Kusto Query Language and retain it centrally for analysis. Which Azure resource should you deploy?

Your company wants to know when an Azure service outage in the region might affect subscribed resources, even if no metric threshold has been crossed yet. Which alert type should you configure?

All AZ-104 Objectives