Question 1mediummultiple choice
Read the full Monitor and Maintain Resources explanation →AZ-104 Monitor and Maintain Azure Resources • Complete Question Bank
Complete AZ-104 Monitor and Maintain Azure Resources question bank — all 0 questions with answers and detailed explanations.
Recovery Services vault > Backup item: vm-web02 Available recovery points: 5 Current VM status: Running Issue reported: OS disk corruption after patching Requirement: repair the VM without rebuilding networking or re-registering the VM
Storage account: stprod01 Monitoring > Diagnostic settings Existing settings: none Metrics: Enabled Logs: Disabled Destination: not configured Requirement: retain operational logs in Log Analytics workspace law-prod
Recovery Services vault > Backup policy: Policy-Prod Backup schedule: Daily at 01:00 UTC Retention: - Daily recovery points: 30 days - Weekly recovery points: not configured - Monthly recovery points: not configured Business requirement: retain one weekly recovery point for 1 year
Azure Monitor > Alerts Alert rule: cpu-prod-vm Scope: /subscriptions/1234/resourceGroups/rg-prod/providers/Microsoft.Compute/virtualMachines/vm01 Condition: Average Percentage CPU > 80 for 5 minutes Evaluation frequency: 1 minute Actions: None Status: Enabled
Business continuity note: - Current protection: daily Azure VM backups in Recovery Services vault - Requirement: application must remain available during a full regional outage - Recovery objective: users should fail over to another region with minimal interruption
AzureActivity | where TimeGenerated >= ago(24h) | where OperationNameValue == "Microsoft.Compute/virtualMachines/deallocate/action" | where ActivityStatusValue == "Failed"
Recovery Services vault: rsv-prod Backup Items > Azure Virtual Machine Item: vm-app01 Protection status: Protection stopped Deletion status: Deleted Soft Delete: Enabled Retention window remaining: 13 days
Recovery Services vault > Backup item > vm-finance01 Restore points available: 3 Most recent recovery point: 2026-04-25 01:00 UTC Requirement: restore C:\Data\Quarterly\budget.xlsx only
Azure Monitor > Alerts Rule name: HighCPU Scope: VM01 Condition: Percentage CPU > 80 for 5 minutes Status: Enabled Actions: None
AzureActivity sample rows: TimeGenerated OperationName ActivityStatusValue Caller 2026-04-26T08:00:00Z Start Virtual Machine Succeeded alice@contoso.com 2026-04-26T08:05:00Z Stop Virtual Machine Failed bob@contoso.com 2026-04-26T08:07:00Z Restart Virtual Machine Failed carol@contoso.com
Drag a concept onto its matching description — or click a concept then click the description.
Metric alert rule
Action group
Diagnostic setting
Activity log alert
Log Analytics workspace
AzureActivity sample rows: TimeGenerated OperationNameValue ActivityStatusValue Caller 2026-04-24T10:02:00Z Microsoft.Storage/storageAccounts/delete Succeeded alice@contoso.com 2026-04-24T10:07:00Z Microsoft.Storage/storageAccounts/delete Failed bob@contoso.com 2026-04-24T10:11:00Z Microsoft.Storage/storageAccounts/delete Failed bob@contoso.com 2026-04-24T10:20:00Z Microsoft.Storage/storageAccounts/write Succeeded admin@contoso.com Goal: identify failed delete operations from the last hour.
Backup policy: DailyBackupPolicy Schedule: every day at 02:00 Retention: daily 7 days, weekly 4 weeks, monthly 12 months Requirement: operators must recover any daily backup for 30 days; monthly retention is already sufficient.
Current workspace settings: Workspace: law-prod Retention: 14 days Connected sources: VM guest logs, App Service logs Subscription Activity log export: Not configured Incident note: A user deleted a storage account yesterday, but the team could not search for the deletion event after two weeks.
Recovery Services vault: vault-prod-backup Protected item: vm-app01 Last successful backup: 2026-04-24 23:00 Recovery point type: Crash consistent Restore goal: quarterly validation test with no impact to production Available restore targets: same region, alternate resource group, alternate VNet
CustomAppLogs_CL sample rows: TimeGenerated Status_s Component_s Message 2026-04-24T08:00:00Z Failed api timeout 2026-04-24T08:03:00Z Failed api timeout 2026-04-24T08:05:00Z Success api ok 2026-04-24T08:07:00Z Failed api auth error 2026-04-24T08:09:00Z Failed api auth error 2026-04-24T08:11:00Z Failed api auth error The alert must trigger when at least 5 failed events occur in any 15-minute window.
Current alert rule: Name: StorageTxnAlert Target: storage account stprod001 Signal type: Metric Metric: Transactions Condition: Greater than 100 in 5 minutes Action group: SecOps Change request: notify the team when anyone edits the storage account network rules or disables public access.
Restore options shown in Recovery Services vault: - Create a new VM - Replace existing VM - Restore disks - File Recovery Incident: One configuration file was deleted from vm-web02, but the VM is still running and should remain unchanged.
Alert rule name: CPUSpikeAlert Scope: /subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/RG-App/providers/Microsoft.Compute/virtualMachines/VM1 Condition: Average Percentage CPU > 80 Window size: 5 minutes Evaluation frequency: 1 minute Action group: Ops-Email Recent alert history: 6 alerts between 23:10 and 23:25 during patching
Drag a concept onto its matching description — or click a concept then click the description.
Restore virtual machine
Restore disks
File recovery
Create virtual machine
Cross-region restore
Drag a concept onto its matching description — or click a concept then click the description.
Keeps only rows that meet the filter condition.
Returns only selected columns and can rename them.
Aggregates rows into totals, counts, or grouped results.
Orders the output by one or more columns.
Drag a concept onto its matching description — or click a concept then click the description.
Filters rows so only records that meet the condition remain in the result.
Returns only selected columns and can rename them for cleaner output.
Aggregates data, such as counting failures by hour or by status code.
Adds a calculated column based on existing fields in each row.
Sorts the result set, such as showing the newest records first.
Drag a concept onto its matching description — or click a concept then click the description.
Triggers when a numeric metric such as CPU percentage crosses a defined threshold.
Sends notifications or starts responses such as email, SMS, webhook, or automation.
Reports an Azure platform incident, advisory, or planned maintenance that affects a region or subscription.
Shows whether one specific Azure resource is currently healthy, degraded, or unavailable.
Exports a resource's logs and metrics to destinations such as Log Analytics or Storage.
Drag a concept onto its matching description — or click a concept then click the description.
Evaluates a numeric metric and fires when the threshold condition is met.
Sends the alert to chosen recipients or automation targets.
Shows Microsoft platform, region, or resource health incidents affecting the subscription.
Sends resource logs and metrics to Log Analytics, Event Hub, or Storage for later analysis.
Drag a concept onto its matching description — or click a concept then click the description.
Central place where Azure VM backups, policies, and recovery points are managed.
Defines when backups run and how long recovery points are retained.
Mounts a recovery point so individual files or folders can be copied back.
Recovers VM disks so they can be attached or used to rebuild a machine.
Overwrites the original VM by restoring it from a chosen recovery point.
Drag a concept onto its matching description — or click a concept then click the description.
Shows subscription-level management events such as deployments, deletes, and role assignments.
Provide detailed, service-specific telemetry from an Azure resource after diagnostics are enabled.
Capture near-real-time numeric measurements used for charts and threshold-based alerts.
Stores data that can be searched and correlated with KQL queries.
Provides official Azure platform incident and maintenance information.
Recovery Services vault Backup item: vm-finance-01 Protection status: Protected Last successful backup: 04/26/2026 02:00 Requirement: A user deleted one Excel file from the Windows VM. The administrator must restore only that file and leave the rest of the VM unchanged.
Azure Monitor alert rule Condition: Average Percentage CPU > 85 for 10 minutes Notifications: Not configured Action group: Missing Scope: vm-prod-02
Backup policy draft Backup frequency: Daily Daily retention: 30 days Weekly retention: None Monthly retention: None
Drag a concept onto its matching description — or click a concept then click the description.
Delivers the alert to a mailbox or distribution list.
Sends a text message to an on-call phone number.
Calls an external HTTPS endpoint such as a ticketing or orchestration system.
Runs custom code after the alert fires.
Starts a scripted remediation runbook in Azure Automation.
Alert rule: Name: CPU-Alert-VM01 Scope: /subscriptions/00000000-0000-0000-0000-000000000001/resourceGroups/RG-Prod/providers/Microsoft.Compute/virtualMachines/vm01 Condition: Percentage CPU is greater than 80 for 5 minutes Status: Enabled Action groups: None
Drag a concept onto its matching description — or click a concept then click the description.
Alerts on a numeric measurement such as average CPU, disk queue length, or memory utilization.
Evaluates a KQL query and alerts when matching records appear in a workspace.
Responds to subscription-level control-plane events such as create, delete, or policy changes.
Indicates that a specific Azure resource is unhealthy or unavailable.
Notifies on Azure platform incidents, advisories, or maintenance affecting a region or service.
Drag a concept onto its matching description — or click a concept then click the description.
Determines when the VM backup job runs, such as daily at a specific time.
Determines how long a recovery point is kept before it expires.
Keeps short-term snapshots available for quick restores before they age out.
Preserves deleted backup data for a recovery window instead of removing it immediately.
Represents the protected VM that is registered in the vault.
Azure portal > Service Health Incident: Azure Virtual Machines Region: East US Status: Active incident Impact: Some customers may experience failed VM start operations Recommended action: Monitor the incident for updates and mitigation status.
AzureDiagnostics sample rows TimeGenerated OperationName Status VaultName 2026-04-26T01:03:12Z BackupJob Failed Vault-Prod 2026-04-26T01:04:10Z BackupJob Succeeded Vault-Prod Query draft: AzureDiagnostics | where TimeGenerated > ago(24h) | where Status == "Failed" | ____ TimeGenerated, VaultName, OperationName
Storage account: mystorage01 Diagnostic settings: - Send to Log Analytics workspace: Not configured - Archive to storage account: Off - Stream to event hub: Off Logs: Disabled Metrics: Enabled
Recovery Services vault > Jobs Last 24 hours: - Backup job: Succeeded - Backup job: Failed - Restore job: In progress Need: Review the error details for the failed backup job
Storage account diagnostics --------------------------- Diagnostic settings: storage-diag Logs: Enabled Destinations: - Archive to storage account: Yes - Event Hub: No - Log Analytics workspace: No Operational requirement ---------------------- Search logs in KQL Build workbook charts Create log-based alerts Keep data queryable for 30 days
Drag a concept onto its matching description — or click a concept then click the description.
Log Analytics workspace
Storage account
Event Hub
Action group
Drag a concept onto its matching description — or click a concept then click the description.
Evaluates resource performance data such as CPU, latency, or disk metrics.
Watches subscription-level control-plane events such as deletes or policy changes.
Runs a KQL query against workspace data and alerts on the result.
Exports resource telemetry off the resource for storage or analysis.
Serves as the reusable response target for notifications and automation.
Drag a concept onto its matching description — or click a concept then click the description.
Creates a separate virtual machine from the recovery point.
Recovers the managed disks so you can rebuild or inspect the workload manually.
Mounts the recovery point so you can retrieve individual files or folders.
Restores from the paired region when the primary region is unavailable.
Drag a concept onto its matching description — or click a concept then click the description.
Central repository for collected telemetry that you query and analyze over a retention period.
The query language used to filter, summarize, and correlate log records in Azure Monitor.
Subscription-scoped record of Azure control-plane operations such as create, update, and delete.
Alert that evaluates the result of a KQL query on a schedule and fires when conditions are met.
Configuration that sends resource logs and metrics to a workspace, storage account, or Event Hub.
Azure Backup recovery point --------------------------- Protected item: win-file01 Restore points available: 2026-04-25 23:00, 2026-04-26 23:00 Recovery option selected in portal: Restore virtual machine User impact: One file missing at C:\Data\Reports\April.xlsx Goal: Recover only the deleted file
Activity log export ------------------- Category: Administrative Destination: law-ops KQL draft --------- AzureActivity | where OperationNameValue == "Microsoft.Resources/subscriptions/resourcegroups/delete" | where Caller != "auto-remediate@contoso.com" Requirement ----------- Alert on resource group deletion events except when Caller is the automation account
Alert rule summary ------------------ Scope: vm-prod-01 Condition: Percentage CPU > 85 Evaluation frequency: 1 minute Window size: 10 minutes Severity: 2 Action groups: None Notifications: Not configured Status: Enabled Metric sample ------------- 12:00 CPU 72% 12:01 CPU 88% 12:02 CPU 91% 12:03 CPU 89% 12:04 CPU 87% 12:05 CPU 90% 12:06 CPU 86% 12:07 CPU 92% 12:08 CPU 94% 12:09 CPU 88%
Drag a concept onto its matching description — or click a concept then click the description.
Keeps deleted backup items recoverable for a limited retention period.
Stops future backups but preserves existing recovery points in the vault.
Stops protection and removes stored recovery points after the deletion process completes.
Allows restore operations from the secondary region when the vault uses geo-redundant storage and the feature is enabled.
Drag a concept onto its matching description — or click a concept then click the description.
Evaluates a numeric Azure Monitor metric and fires when a threshold or dynamic condition is met.
Runs a KQL query against workspace data and fires when the query result matches the condition.
Delivers notifications or automation such as email, SMS, webhook, or runbook execution.
Exports resource logs and metrics to a destination such as Log Analytics, storage, or Event Hub.
Monitors subscription-level control-plane events such as deletes, writes, or policy actions.
Workspace: law-prod Table: Heartbeat Sample records -------------- TimeGenerated Computer ResourceId 2026-04-26T10:00:00Z VM01 /subscriptions/111/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/VM01 2026-04-26T10:01:00Z VM01 /subscriptions/111/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/VM01 2026-04-26T10:02:00Z VM02 /subscriptions/111/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/VM02 2026-04-26T10:03:00Z VM02 /subscriptions/111/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/VM02 Requirement ----------- Alert if a VM has no heartbeat for 15 minutes.
Current alert design -------------------- Alert 1: CPU on VM-Prod-01 Alert 2: Disk queue length on VM-Prod-02 Alert 3: Availability check on web-app-01 Requirements ------------ - Send email, SMS, and webhook notifications - Reuse the same notification target across multiple alerts - Minimize repeated configuration
Recovery Services vault settings -------------------------------- Soft delete: Disabled Backup item state: Protection stopped Deleted backup item: vm-fin-02 Time since deletion: 14 hours Recovery requirement: Re-enable protection and recover deleted backup data
Drag a concept onto its matching description — or click a concept then click the description.
Defines when the backup job starts, such as daily at a specific time.
Defines how long recovery points remain available for restore.
Determines how the scheduled backup time is interpreted in the policy.
Keeps snapshot copies available for fast local restores before the vault copy completes.
Reusable object that combines schedule, retention, and related backup settings.
Recovery Services vault: RSV-Prod Protected item: vm-app-03 Current backup policy --------------------- Backup frequency: Daily Backup time: 23:00 Instant restore snapshots: 2 days Daily retention: 7 days Weekly retention: Not configured Monthly retention: Not configured Yearly retention: Not configured Requirement ----------- Keep daily recovery points for 30 days
Key Vault diagnostic settings ----------------------------- Destination: Storage account only Logs: AuditEvent = Disabled Metrics: AllMetrics = Enabled Retention on storage account: 7 days Investigation requirement ------------------------ Search administrative and access events in Log Analytics Keep data queryable for 30 days Create log alerts from the collected events
Backup item: vm-finance-03 Current status: Protected Incident: One spreadsheet was deleted from C:\Reports\Q1\ Requirement: Restore only the deleted file Constraint: The virtual machine must remain available to users during recovery
Monitoring requirement - 5 Linux VMs in one resource group - Collect CPU percentage and logical disk free space - Keep ingestion cost as low as possible - No application tracing is required - Current state: No guest monitoring agent configured
Azure Monitor alert rule - Signal type: Metric - Resource: vm-prod-01 - Condition: Percentage CPU > 80 - Condition window: 10 minutes - Current action group: None - Notification requirement: Email the operations team
Azure Backup policy - Schedule: Daily at 01:00 - Retain instant recovery snapshots: 2 days - Retain daily backup points: 7 days - Retain weekly backup points: Not configured Business requirement: Keep daily backups for 30 days
Monitoring requirement - Resource: stacctprod01 - Need notification when Azure reports the resource as unavailable or unhealthy - Do not monitor a custom application metric - Do not query a custom log table - Current setup: No alert rule exists
Storage account diagnostic settings - Destination: Log Analytics workspace - Categories: allLogs - Export mode: Resource-specific Troubleshooting note: - A coworker ran: AzureDiagnostics | where ResourceProvider == "MICROSOFT.STORAGE" - Result: No matching records
KQL draft: Heartbeat | __________ | summarize LastSeen = max(TimeGenerated) by Computer Requirement: show only records from the last 30 minutes before summarizing.
Recovery Services vault > Backup jobs Job: Backup of vm-app-07 Status: Failed Error details: "Backup failed because the VM agent is not in a ready state." Additional note: The VM was created from a custom image.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.