AZ-104 Monitor and Maintain Azure Resources — 50 Questions

Question 1

You need to collect Windows event logs and performance counters from multiple Azure virtual machines and query the data centrally by using Kusto Query Language. Which Azure resource should you deploy?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the correct resource because it serves as the central repository for collecting diagnostic data such as Windows event logs and performance counters from Azure VMs. Once collected, you can query this data using Kusto Query Language (KQL) to perform advanced analysis and monitoring. This aligns directly with the requirement to centrally query the data using KQL.

Answer

A Recovery Services vault

Answer

Azure Network Watcher

Answer

A load balancer

Question 2

A business requires that a workload keep running if an entire Azure region becomes unavailable. Is Azure Backup alone sufficient, and what should you add if it is not?

Accepted Answer

No. Add Azure Site Recovery or another replication and failover design for regional resilience.. Azure Backup is designed to protect data by creating recovery points that can be used to restore data to a different region, but it does not provide continuous service or automatic failover during a regional outage. To keep the workload running without interruption, you need Azure Site Recovery (ASR) or a custom replication and failover solution that replicates the entire workload to a secondary region and enables automatic or manual failover. Therefore, Azure Backup alone is insufficient for high availability during a regional disaster.

Answer

Yes. Azure Backup alone provides continuous service during a regional outage.

Answer

Yes. Increasing the backup retention period will keep the application online.

Answer

No. Configure an action group so operators receive faster notifications during outages.

Question 3

Which of the following Azure VM backup restore options are correctly described?

Accepted Answer

File Recovery: Restore individual files from an Azure VM backup. Azure VM Backup offers: File Recovery to restore individual files (A correct), Create new VM to deploy a new VM from a recovery point (so B's description is incorrect), Replace existing VM to overwrite the original VM (so C's description is incorrect), Cross-region restore for disaster recovery (D correct), and Restore disks to restore only managed disks (E correct). Therefore, the correct options are A, D, and E.

Answer

Create new VM: Overwrite the original VM with backup data

Answer

Replace existing VM: Deploy a new virtual machine from a recovery point

Question 4

A team wants daily Azure VM backups with a 30-day retention period. Which two settings are configured in the backup policy? Select two.

Accepted Answer

Backup schedule. A backup policy for Azure VM backups must include a backup schedule that defines when the backup job runs (e.g., daily at a specific time). This schedule triggers the Azure Backup service to create recovery points for the VM. Without a schedule, the backup policy cannot automate the creation of backups. Additionally, a backup policy must include retention rules that specify how long recovery points are kept (e.g., 30 days). This directly addresses the retention period requirement stated in the scenario, ensuring old backups are removed after the defined period.

Answer

Log Analytics workspace

Answer

Private endpoint

Answer

Metric alert threshold

Question 5

An application depends on a regional Azure service. Operations wants an automatic notification if Microsoft posts an incident that affects only the region where the app runs, even when the individual VMs remain healthy. Which two Azure Monitor capabilities should be configured? Select two.

Accepted Answer

Service health alert. A Service health alert is correct because it monitors for service incidents, maintenance, and health advisories published by Azure for a specific region or service. When Microsoft posts an incident affecting only the region where the application runs, the alert triggers automatically, even if individual VMs remain healthy. This meets the requirement for automatic notification of regional Azure service incidents. An Action group is correct because it defines who and how the notification is delivered (e.g., email, SMS, webhook). Service health alerts must be associated with an action group to send automatic notifications; without it, the alert would not reach the operations team.

Answer

Metric alert rule

Answer

Log Analytics query

Answer

Resource lock

Question 6

Which policy best matches the requirement for daily backups retained for 30 days?

Accepted Answer

A policy with daily backups retained for 30 days.. The requirement explicitly states 'daily backups retained for 30 days.' A backup policy in Azure Backup allows you to define the frequency (daily) and retention duration (30 days) for recovery points. This policy directly matches the requirement without over-retention or under-retention.

Answer

A policy with daily backups retained for 7 days.

Answer

A policy with weekly backups retained for 30 days.

Answer

A policy with daily backups retained for 365 days.

Question 7

A user deleted a file from an Azure VM, and the administrator wants to use Azure Backup file-level recovery rather than restore the whole VM. Which two prerequisites are required before mounting the recovery point from the portal? Select two.

Accepted Answer

Download the vault credentials file. Option A is correct because Azure Backup file-level recovery requires downloading the vault credentials file from the Recovery Services vault, which is then used by the iSCSI initiator script to authenticate and connect to the recovery point's storage. Option B is correct because you must select the appropriate recovery point (the specific backup date/time containing the deleted file) in the portal before the script can mount that point as a drive on the target machine. Option C is not required because access to the recovery point is granted via the vault credentials, not the storage account key. Option D is not required because file-level recovery mounts the recovery point over iSCSI to the machine running the script and does not depend on a public IP on the source VM. Option E is not required because no Microsoft Entra ID application secret is involved in the file recovery workflow.

Answer

Provide the storage account access key

Answer

Assign a public IP address to the VM

Answer

Create an Azure AD application secret

Question 8

An operations team wants an email notification when the average CPU percentage on a VM stays above 85 percent for 10 minutes. Which two Azure Monitor components should they configure? Select two.

Accepted Answer

A metric alert rule. A metric alert rule is correct because it monitors a specific VM performance metric (e.g., Percentage CPU) and triggers when the average value exceeds 85% for a duration of 10 minutes. An action group is required to define the notification method, such as sending an email, when the alert fires. Together, they enable email notifications for metric thresholds.

Answer

Azure Bastion

Answer

A Recovery Services vault

Answer

A resource lock

Question 9

An alert must start automated responses when a metric threshold is reached. Which two resources can an Azure Monitor action group invoke? Select two.

Accepted Answer

An Azure Automation runbook. Azure Monitor action groups can invoke both Azure Automation runbooks and Azure Functions as executable actions when an alert fires. Runbooks allow scripted remediation workflows, while Functions provide serverless code execution for automated responses. Other options like VNet peering, resource locks, and storage access tiers are configuration or static resources, not actions that can be directly invoked.

Answer

A virtual network peering connection

Answer

A resource lock

Answer

A storage account access tier

Question 10

Every backup job for a newly deployed Azure VM fails immediately and reports that the VM agent is not ready. Which two checks should the administrator perform first? Select two.

Accepted Answer

Verify that the Azure VM Agent is installed and the service is running inside the guest.. The Azure VM Agent is required for the Azure Backup service to communicate with the VM and orchestrate snapshot operations. If the agent is not installed or the service (Windows: WindowsAzureGuestAgent, Linux: waagent) is not running, backup jobs will fail immediately with the 'agent not ready' error. Verifying agent status is the first logical step because without a functioning agent, no backup can proceed. Additionally, the VM must have outbound HTTPS connectivity to Azure Backup and Storage endpoints so the agent can communicate with the backup service and transfer backup data. Blocked connectivity can prevent the agent from reporting readiness or cause backup jobs to fail. Both checks are essential first steps to isolate the root cause.

Answer

Increase the recovery point retention in the backup policy.

Answer

Recreate the Recovery Services vault in another region.

Answer

Disable the backup policy until the VM is rebooted several times.

Question 11

A security team needs to investigate future configuration changes on a storage account and subscription-level control-plane changes in one place by using KQL. The team already created a Log Analytics workspace. What else must the administrator configure so the required logs are queryable in that workspace?

Accepted Answer

Enable only the Azure Activity log export and skip resource diagnostic settings.. The Azure Activity log captures control-plane events for all resources, including storage account configuration changes. Therefore, exporting the subscription Activity log to the Log Analytics workspace is sufficient to query both subscription-level and storage account control-plane changes. Diagnostic settings on the storage account are unnecessary for this requirement.

Answer

Configure diagnostic settings on the storage account and export the subscription Activity log to the same workspace.

Answer

Install the Azure Monitor Agent on the storage account so it can send its own logs.

Answer

Create separate workspaces for each resource and query them independently.

Question 12

A production virtual machine must trigger an immediate notification whenever average CPU stays above 85 percent for 15 minutes, and the same event must also start an Azure Function that opens an incident ticket. Which two Azure Monitor components should you configure? Select two.

Accepted Answer

Create a metric alert rule on the VM CPU percentage.. Both A and B are required. A metric alert rule monitors the Percentage CPU metric and fires when the average exceeds 85% for 15 minutes. The action group (B) is attached to that alert rule to send email notifications and invoke the Azure Function when the alert fires.

Answer

Enable a diagnostic setting on the VM without creating an alert rule.

Answer

Create a Log Analytics workspace and rely on manual queries only.

Answer

Apply a resource lock so CPU usage changes are blocked.

Question 13

An operations team needs to know when Azure marks a storage account unavailable because of a regional platform issue, and they also want to detect abnormal service latency on the account itself. Which two alerting approaches should they configure? Select two.

Accepted Answer

Create a Resource Health alert for the storage account.. A Resource Health alert monitors the health of the storage account from the Azure platform's perspective, triggering when Azure marks the resource as unavailable due to a regional platform issue (e.g., an outage or degradation). A metric alert for storage availability or latency monitors the account's actual performance, triggering when latency exceeds a threshold or availability drops, which detects abnormal service latency. Together they satisfy both requirements.

Answer

Create an Activity Log alert for every blob write.

Answer

Send a workbook link in an action group instead of an alert.

Answer

Turn on Azure Policy compliance scanning for the storage account.

Question 14

A troubleshooting team wants to investigate a storage account write failure and subscription-level role assignment changes in a single Log Analytics workspace. They want to ingest only the telemetry needed for those investigations. Which two sources should they enable? Select two.

Accepted Answer

Configure diagnostic settings on the storage account to send resource logs to the workspace.. Diagnostic settings on a storage account can be configured to send resource logs (such as storage write operations, including details of failed writes) to a Log Analytics workspace. This allows the team to investigate write failures directly from the storage account's telemetry. Additionally, the subscription Azure Activity log contains subscription-level events such as role assignment changes, and exporting it to the same workspace enables investigation of those changes.

Answer

Enable guest-level Windows event collection on a random virtual machine.

Answer

Turn on NSG flow logs for every subnet in the subscription.

Answer

Use Azure Advisor recommendations as the source of telemetry.

Question 15

An administrator must centralize Azure Activity log events and diagnostic logs from several storage accounts into a single workspace so the team can query them with KQL. What should be configured on each resource?

Accepted Answer

Diagnostic settings to send logs to a Log Analytics workspace.. Diagnostic settings are the Azure mechanism for streaming logs to destinations such as a Log Analytics workspace. Activity Log events must be sent via diagnostic settings on the subscription level, while diagnostic logs from each storage account are sent via diagnostic settings on the storage account. Configuring these diagnostic settings centralizes both log types for KQL querying. The other options address backup, networking, or governance, not log streaming.

Answer

A backup policy in Recovery Services vault to copy logs into the workspace.

Answer

A private endpoint for each storage account so the logs remain internal to Azure.

Answer

A management group lock to prevent log deletion.

Question 16

You are responsible for monitoring and maintaining Azure resources for a large enterprise. Which four of the following actions or configurations can help you proactively identify performance bottlenecks, optimize costs, and ensure high availability? (Choose four.)

Accepted Answer

Enabling Azure Advisor recommendations for resizing underutilized virtual machines to reduce costs.. All four correct actions are proactive: Azure Advisor provides cost optimization recommendations; autoscale rules automatically adjust capacity to prevent bottlenecks and improve availability; Service Health alerts notify you of service incidents affecting availability; diagnostic settings to Log Analytics enable proactive analysis of performance logs. Traffic Manager failover routing reroutes traffic away from unhealthy endpoints, not healthy ones, and Backup Center restores are reactive recovery actions rather than proactive monitoring.

Answer

Using Azure Backup Center to perform an on-demand restore of a deleted virtual machine to its original state.

Answer

Deploying Azure Traffic Manager with a failover routing method to reroute traffic away from a healthy endpoint.

Question 17

You have an Azure subscription that contains a storage account named storage1. You need to ensure that all read and write operations to the blobs in storage1 are logged and retained for 90 days. The logs must be stored in a separate storage account named storage2. What should you configure?

Accepted Answer

Enable Azure Storage analytics logging for blobs and set the retention policy to 90 days. Configure the logs to be written to storage2.. To log read and write operations to blobs and retain them for 90 days in a separate storage account, you enable Azure Storage analytics logging for blobs, set the retention policy to 90 days, and configure the destination storage account as storage2. Alternatively, diagnostic settings can send logs to a storage account, but retention must be managed via lifecycle policy on that account.

Answer

Configure a lifecycle management policy on storage1 to move blobs to cool tier after 30 days and delete after 90 days.

Answer

Enable Azure Defender for Storage and configure a security policy to export logs to storage2 for 90 days.

Answer

Enable diagnostic settings for storage1, select the blob service, and send the logs to storage2 with a retention of 90 days.

Question 18

You need to be notified whenever the average CPU usage of VM-App01 exceeds 80 percent for 10 minutes. The solution must send an email to the operations team automatically. What should you configure?

Accepted Answer

Create an Azure Monitor metric alert and link it to an action group.. Azure Monitor metric alerts can evaluate performance counters like CPU usage over a specified time window (e.g., 10 minutes) and trigger an action group when the threshold (80%) is exceeded. The action group can be configured with an email notification to the operations team, meeting the requirement automatically.

Answer

Create an Azure Advisor recommendation alert.

Answer

Create an activity log alert for the virtual machine.

Answer

Create a subscription budget alert.

Question 19

Your company wants to query performance and event data from multiple Azure virtual machines by using Kusto Query Language. The operations team also wants to centralize retention and analysis of this data. What should you deploy?

Accepted Answer

A Log Analytics workspace.. A Log Analytics workspace is the correct choice because it is the central repository in Azure Monitor for collecting telemetry and log data from Azure virtual machines. It supports Kusto Query Language (KQL) for querying performance and event data, and it provides centralized retention, analysis, and alerting capabilities, meeting both requirements.

Answer

Azure Advisor.

Answer

Azure Network Watcher only.

Answer

A network security group.

Question 20

You need to retain Azure Firewall logs for long-term analysis in a Log Analytics workspace and also archive them in a storage account for compliance. What should you configure on the Azure Firewall resource?

Accepted Answer

Diagnostic settings. Diagnostic settings on the Azure Firewall resource allow you to stream platform logs and metrics to a Log Analytics workspace for long-term analysis and to a storage account for archival and compliance. This is the only configuration that simultaneously supports both destinations for the firewall's log data.

Answer

A resource lock

Answer

An availability set

Answer

A VNet peering connection