AZ-104 Monitor and Maintain Azure Resources Practice Test 10 — 15 Questions

Question 1

A VM backup policy is being designed in a Recovery Services vault. Match each backup policy element to the behavior it controls.

Accepted Answer

Retention Range: Defines how long backup snapshots and recovery points are kept.. A backup policy in a Recovery Services vault includes retention settings (how long to keep backups), schedule (when to back up), snapshot retention (for instant restores), policy type (Standard vs Enhanced), time zone, and frequency (daily/weekly).

Answer

Retention Range: Controls the time zone for backup scheduling.

Answer

Backup Schedule: Defines how many backups are retained.

Question 2

The team accidentally stopped protection for a VM and deleted its backup data. They want Azure Backup to keep deleted backup items recoverable for a grace period so the item can be undeleted if needed. Which vault feature should be enabled?

Accepted Answer

Soft delete. Soft delete is the correct feature because it provides a grace period (default 14 days) during which deleted backup data is retained in a soft-deleted state. This allows administrators to recover (undelete) backup items that were accidentally deleted, including cases where protection was stopped and data was removed. Without soft delete, deleted backup data is permanently purged and cannot be recovered.

Answer

Instant restore

Answer

A new backup policy

Answer

A private endpoint for the vault

Question 3

A security team wants platform logs from a storage account sent for long-term retention and later analysis. Which three destinations can an Azure diagnostic setting send data to? Select three.

Accepted Answer

A Log Analytics workspace. Azure Diagnostic Settings can stream platform logs and metrics to three destinations: a Log Analytics workspace for query-based analysis, a storage account for archival and long-term retention, and an Event Hub for real-time ingestion into SIEM or third-party tools. This is defined in the Azure Monitor diagnostic settings configuration, which supports these three outputs natively.

Answer

A Recovery Services vault

Answer

An availability zone

Question 4

An administrator accidentally stopped protection for a critical VM and then deleted its backup item. The mistake was discovered a day later, and the organization wants deleted backup data to remain recoverable for a grace period. Which feature should be enabled on the Recovery Services vault?

Accepted Answer

Soft delete on the Recovery Services vault.. Soft delete on the Recovery Services vault provides a grace period (default 14 days) during which deleted backup data is retained in a soft-deleted state, allowing recovery even after a backup item is deleted. This feature is specifically designed to protect against accidental deletion, as it prevents permanent removal of backup data until the soft-delete period expires or is manually purged.

Answer

An action group attached to the vault alerts.

Answer

Diagnostic settings that export vault events to Log Analytics.

Answer

Cross-region restore for the vault.

Question 5

A VM was corrupted and the team wants to recover it from Azure Backup without using the original damaged disks. Which two restore targets are supported? Select two.

Accepted Answer

Create a new virtual machine. Azure Backup supports restoring a VM to a new virtual machine directly from the recovery point, which creates a new VM with the same configuration and data without using the original damaged disks. This is a common restore workflow when the original VM is corrupted or inaccessible.

Answer

Change the subscription automatically

Answer

Replace the Recovery Services vault name

Answer

Rebuild the virtual network

Question 6

A VM named VM01 stopped sending Heartbeat records to Log Analytics 15 minutes ago. Which KQL query should you run to confirm the VM's recent heartbeat entries?

Accepted Answer

Heartbeat | where Computer == "VM01" and TimeGenerated > ago(15m). The Heartbeat table in Log Analytics stores records sent by the Azure Monitor Agent (AMA) or Log Analytics agent every 5 minutes by default. Querying Heartbeat with a filter for Computer == 'VM01' and TimeGenerated > ago(15m) directly checks if any heartbeat records were generated in the last 15 minutes, confirming whether the VM is still reporting. This is the correct approach because Heartbeat is the dedicated table for agent health, and the time filter matches the 15-minute window specified in the question.

Answer

AzureActivity | where ResourceProviderValue == "Microsoft.Compute/virtualMachines"

Answer

Heartbeat | summarize count() by Computer

Answer

Perf | where CounterName == "% Processor Time"

Question 7

A virtual machine is already protected by Azure Backup. The business wants the VM backed up every day at 11:00 PM and wants daily recovery points retained for 30 days, without re-onboarding the VM. What should the administrator modify?

Accepted Answer

Modify the backup policy associated with the protected VM. Azure Backup uses backup policies to define the backup schedule and retention rules for protected resources. By modifying the existing policy associated with the VM, you can change the backup time to 11:00 PM and set daily recovery point retention to 30 days without needing to re-onboard the VM or create a new vault.

Answer

Create a new Recovery Services vault and re-register the VM

Answer

Install a new VM extension to change retention behavior

Answer

Take a manual snapshot of the VM disk every night

Question 8

A virtual machine is already protected by Azure Backup. The current policy runs daily at 23:00 and keeps daily recovery points for 30 days. The business now wants the same schedule but wants new daily recovery points retained for 90 days. No new vault or re-registration should occur. What should the administrator do?

Accepted Answer

Edit the existing backup policy and change the daily retention for future recovery points.. Azure Backup allows you to modify an existing backup policy to change the retention duration for future recovery points without creating a new vault or re-registering the VM. By editing the policy and setting the daily retention to 90 days, all new daily recovery points will be retained for the longer period, while existing recovery points remain unaffected by the change.

Answer

Create a new Recovery Services vault and enable backup again with the longer retention period.

Answer

Take nightly managed disk snapshots because snapshots automatically inherit the Recovery Services vault retention period.

Answer

Change the vault redundancy setting to increase the number of retained recovery points.

Question 9

Based on the exhibit, a VM is protected by Azure Backup. The business wants daily backups at 11:00 PM, retention of daily recovery points for 30 days, and no changes to the existing vault or VM. The current policy already backs up every day but keeps recovery points for only 7 days. What should the administrator modify?

Accepted Answer

Edit the backup policy and change daily retention to 30 days.. The existing backup policy already performs daily backups at 11:00 PM, but its retention setting for daily recovery points is only 7 days. By editing the policy and changing the daily retention to 30 days, the administrator meets the business requirement without creating a new VM, altering the vault, or modifying the VM itself. Azure Backup policies allow modification of retention durations independently of backup frequency, so this is a straightforward configuration change.

Answer

Create a new VM and attach the existing backup vault to it.

Answer

Enable soft delete on the vault.

Answer

Move the VM to another availability zone.

Question 10

A team wants an email and SMS notification whenever the average CPU on a production VM stays above 85% for 10 minutes. The same notification setup may be reused by other alerts later. Which Azure feature should you configure?

Accepted Answer

Action group. B is correct because an Action Group is the Azure component that defines the notification actions (email, SMS, webhook, etc.) to be triggered when an alert fires. The question specifies that the same notification setup should be reusable by other alerts later, which is exactly the purpose of an Action Group: it decouples the notification configuration from the alert rule itself. You would create a Metric Alert Rule to monitor the CPU metric, but that rule references an Action Group to send the email and SMS.

Answer

Metric alert rule

Answer

Diagnostic setting

Answer

Resource lock

Question 11

Based on the exhibit, a security team wants to search Key Vault audit events in Log Analytics for 30 days and create alerts when secrets are accessed unexpectedly. The current diagnostic configuration is not sending the right data. What should the administrator enable?

Accepted Answer

Enable AuditEvent and send the logs to a Log Analytics workspace.. The Key Vault diagnostic setting must include the AuditEvent category to capture all audit logs, including secret operations. Sending these logs to a Log Analytics workspace enables the security team to query them for 30 days and create alerts on unexpected secret access. Without AuditEvent enabled, no audit data is available for analysis.

Answer

Enable only AllMetrics and keep sending data to the storage account.

Answer

Create a private endpoint for the Key Vault.

Answer

Turn on a resource lock with the ReadOnly effect.

Question 12

An administrator enabled diagnostic settings on a storage account and selected the resource-specific table format for Log Analytics. A coworker later queried AzureDiagnostics and received no rows. What should the administrator tell the coworker to do?

Accepted Answer

Query the dedicated storage resource tables created by the diagnostic setting instead of AzureDiagnostics. When diagnostic settings are configured to use the 'Resource specific' destination table format, logs are sent to dedicated tables named after the resource type (e.g., StorageBlobLogs, StorageQueueLogs) rather than the legacy AzureDiagnostics table. Querying AzureDiagnostics returns no rows because logs are not written there under this format. The coworker must query the appropriate resource-specific table instead.

Answer

Recreate the storage account because AzureDiagnostics is only populated by new resources

Answer

Change the storage account replication type to GRS so diagnostic logs are duplicated

Answer

Enable Azure Monitor metrics collection on the storage account before querying AzureDiagnostics

Question 13

A Windows VM in Azure is protected by Azure Backup. A developer accidentally deleted one application folder, but the VM must keep serving users while the administrator restores only that folder. What should the administrator do?

Accepted Answer

Use File Recovery from the appropriate recovery point and copy the folder back.. Azure Backup's File Recovery feature allows you to mount a recovery point as a drive on the running VM, enabling you to copy specific files or folders without restoring the entire VM or disrupting production. This is the only method that meets the requirement of restoring only the deleted folder while the VM continues serving users.

Answer

Restore the entire VM from the latest recovery point into the production resource group.

Answer

Restore the managed disk and attach it to the running VM as a second OS disk.

Answer

Create a new Recovery Services vault and re-protect the VM before restoring anything.

Question 14

The team needs alerts for VM CPU and storage capacity thresholds, but they want to keep telemetry ingestion costs as low as possible. Which approach is best?

Accepted Answer

Use Azure Monitor metric alerts for the threshold conditions.. Azure Monitor metric alerts are the most cost-effective approach because they evaluate lightweight, pre-collected platform metrics (e.g., CPU percentage, disk read/write operations) at regular intervals without ingesting or storing raw log data. This avoids the ingestion and retention costs associated with sending diagnostic logs to a Log Analytics workspace, making it ideal for simple threshold-based monitoring of VM CPU and storage capacity.

Answer

Send all VM diagnostic logs to Log Analytics and create only log search alerts.

Answer

Create a Recovery Services vault backup policy with a short retention period.

Answer

Assign Azure Policy to the subscription to audit CPU and storage trends.

Question 15

An operations team wants to know when Azure marks a specific storage account unhealthy because of a regional platform issue. They do not want to depend on a custom metric, a Log Analytics query, or any polling script. What should they create?

Accepted Answer

A resource health alert for the storage account. A resource health alert is the correct choice because it directly monitors the health of a specific Azure resource, such as a storage account, and triggers when Azure detects a platform-level issue that marks the resource as unhealthy. This alert does not require custom metrics, Log Analytics queries, or polling scripts, aligning perfectly with the team's requirement to avoid those dependencies. Resource health alerts are designed to notify you of service-impacting events originating from the Azure platform, not from your own configuration or usage patterns.

Answer

A metric alert on storage capacity because platform issues always reduce capacity first

Answer

A log alert that searches AzureDiagnostics for unavailable status codes

Answer

An activity log alert on every write operation to the storage account