AZ-104 Monitor and Maintain Azure Resources Practice Test 10 — 15 Questions

Question 1

Based on the exhibit, a VM is protected by Azure Backup. The business wants daily backups at 11:00 PM, retention of daily recovery points for 30 days, and no changes to the existing vault or VM. The current policy already backs up every day but keeps recovery points for only 7 days. What should the administrator modify?

Accepted Answer

Edit the backup policy and change daily retention to 30 days.. Option B is correct because the existing backup policy already performs daily backups at 11:00 PM, but its retention setting for daily recovery points is only 7 days. By editing the policy and changing the daily retention to 30 days, the administrator meets the business requirement without creating a new VM, altering the vault, or modifying the VM itself. Azure Backup policies allow modification of retention durations independently of backup frequency, so this is a straightforward configuration change.

Answer

Create a new VM and attach the existing backup vault to it.

Answer

Enable soft delete on the vault.

Answer

Move the VM to another availability zone.

Question 2

A team wants an email and SMS notification whenever the average CPU on a production VM stays above 85% for 10 minutes. The same notification setup may be reused by other alerts later. Which Azure feature should you configure?

Accepted Answer

Action group. B is correct because an Action Group is the Azure component that defines the notification actions (email, SMS, webhook, etc.) to be triggered when an alert fires. The question specifies that the same notification setup should be reusable by other alerts later, which is exactly the purpose of an Action Group: it decouples the notification configuration from the alert rule itself. You would create a Metric Alert Rule to monitor the CPU metric, but that rule references an Action Group to send the email and SMS.

Answer

Metric alert rule

Answer

Diagnostic setting

Answer

Resource lock

Question 3

Based on the exhibit, a security team wants to search Key Vault audit events in Log Analytics for 30 days and create alerts when secrets are accessed unexpectedly. The current diagnostic configuration is not sending the right data. What should the administrator enable?

Accepted Answer

Enable AuditEvent and send the logs to a Log Analytics workspace.. Option A is correct because the Key Vault diagnostic setting must include the AuditEvent category to capture all audit logs, including secret operations. Sending these logs to a Log Analytics workspace enables the security team to query them for 30 days and create alerts on unexpected secret access. Without AuditEvent enabled, no audit data is available for analysis.

Answer

Enable only AllMetrics and keep sending data to the storage account.

Answer

Create a private endpoint for the Key Vault.

Answer

Turn on a resource lock with the ReadOnly effect.

Question 4

An administrator enabled diagnostic settings on a storage account and selected the resource-specific table format for Log Analytics. A coworker later queried AzureDiagnostics and received no rows. What should the administrator tell the coworker to do?

Accepted Answer

Query the dedicated storage resource tables created by the diagnostic setting instead of AzureDiagnostics. When diagnostic settings are configured to use the 'Resource specific' destination table format, logs are sent to dedicated tables named after the resource type (e.g., StorageBlobLogs, StorageQueueLogs) rather than the legacy AzureDiagnostics table. Querying AzureDiagnostics returns no rows because logs are not written there under this format. The coworker must query the appropriate resource-specific table instead.

Answer

Recreate the storage account because AzureDiagnostics is only populated by new resources

Answer

Change the storage account replication type to GRS so diagnostic logs are duplicated

Answer

Enable Azure Monitor metrics collection on the storage account before querying AzureDiagnostics

Question 5

A Windows VM in Azure is protected by Azure Backup. A developer accidentally deleted one application folder, but the VM must keep serving users while the administrator restores only that folder. What should the administrator do?

Accepted Answer

Use File Recovery from the appropriate recovery point and copy the folder back.. Option B is correct because Azure Backup's File Recovery feature allows you to mount a recovery point as a drive on the running VM, enabling you to copy specific files or folders without restoring the entire VM or disrupting production. This is the only method that meets the requirement of restoring only the deleted folder while the VM continues serving users.

Answer

Restore the entire VM from the latest recovery point into the production resource group.

Answer

Restore the managed disk and attach it to the running VM as a second OS disk.

Answer

Create a new Recovery Services vault and re-protect the VM before restoring anything.

Question 6

An alert must start automated responses when a metric threshold is reached. Which two resources can an Azure Monitor action group invoke? Select two.

Accepted Answer

An Azure Automation runbook. Azure Monitor action groups can invoke an Azure Automation runbook to execute automated remediation or response tasks when a metric alert fires. This allows you to trigger scripts or workflows in response to specific conditions, such as scaling resources or restarting services, without manual intervention.

Answer

A virtual network peering connection

Answer

A resource lock

Answer

A storage account access tier

Question 7

Every backup job for a newly deployed Azure VM fails immediately and reports that the VM agent is not ready. Which two checks should the administrator perform first? Select two.

Accepted Answer

Verify that the Azure VM Agent is installed and the service is running inside the guest.. The Azure VM Agent is required for the Azure Backup service to communicate with the VM and orchestrate snapshot operations. If the agent is not installed or the service (Windows: WindowsAzureGuestAgent, Linux: waagent) is not running, backup jobs will fail immediately with the 'agent not ready' error. Verifying agent status is the first logical step because without a functioning agent, no backup can proceed.

Answer

Increase the recovery point retention in the backup policy.

Answer

Recreate the Recovery Services vault in another region.

Answer

Disable the backup policy until the VM is rebooted several times.

Question 8

The team needs alerts for VM CPU and storage capacity thresholds, but they want to keep telemetry ingestion costs as low as possible. Which approach is best?

Accepted Answer

Use Azure Monitor metric alerts for the threshold conditions.. Azure Monitor metric alerts are the most cost-effective approach because they evaluate lightweight, pre-collected platform metrics (e.g., CPU percentage, disk read/write operations) at regular intervals without ingesting or storing raw log data. This avoids the ingestion and retention costs associated with sending diagnostic logs to a Log Analytics workspace, making it ideal for simple threshold-based monitoring of VM CPU and storage capacity.

Answer

Send all VM diagnostic logs to Log Analytics and create only log search alerts.

Answer

Create a Recovery Services vault backup policy with a short retention period.

Answer

Assign Azure Policy to the subscription to audit CPU and storage trends.

Question 9

An operations team wants to know when Azure marks a specific storage account unhealthy because of a regional platform issue. They do not want to depend on a custom metric, a Log Analytics query, or any polling script. What should they create?

Accepted Answer

A resource health alert for the storage account. A resource health alert is the correct choice because it directly monitors the health of a specific Azure resource, such as a storage account, and triggers when Azure detects a platform-level issue that marks the resource as unhealthy. This alert does not require custom metrics, Log Analytics queries, or polling scripts, aligning perfectly with the team's requirement to avoid those dependencies. Resource health alerts are designed to notify you of service-impacting events originating from the Azure platform, not from your own configuration or usage patterns.

Answer

A metric alert on storage capacity because platform issues always reduce capacity first

Answer

A log alert that searches AzureDiagnostics for unavailable status codes

Answer

An activity log alert on every write operation to the storage account

Question 10

A VM must be backed up every day, and backups must be retained for several days after creation. Which two settings are configured in an Azure Backup policy? Select two.

Accepted Answer

Backup schedule. Option A is correct because an Azure Backup policy requires a backup schedule to define when the backup job runs (e.g., daily at a specific time). Option B is correct because retention rules specify how long each backup recovery point is kept (e.g., 7 days for daily backups, 30 days for weekly). Together, these two settings form the core of a backup policy, ensuring both the timing and lifespan of backups are controlled.

Answer

Network security group rules

Answer

Private DNS zone records

Answer

Availability set placement

Question 11

A help desk analyst wants a query in Log Analytics that returns Azure virtual machines that have stopped sending a heartbeat for more than 15 minutes. Which KQL query should the analyst run?

Accepted Answer

Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen < ago(15m). Option A is correct because the Heartbeat table in Log Analytics records a heartbeat signal from Azure Monitor agents every 5 minutes by default. The query uses `summarize` to find the latest `TimeGenerated` per computer, then filters with `where LastSeen < ago(15m)` to identify VMs that have not sent a heartbeat in over 15 minutes, indicating they are likely offline or unresponsive.

Answer

AzureActivity | where OperationNameValue contains 'Heartbeat' | summarize count() by ResourceGroup

Answer

Perf | where CounterName == '% Processor Time' | summarize avg(CounterValue) by Computer

Answer

SecurityEvent | where EventID == 4624 | summarize count() by Computer

Question 12

A help desk analyst needs a KQL query that identifies each VM's most recent heartbeat so computers can be flagged if their last check-in is older than 20 minutes. Which two KQL elements should be used? Select two.

Accepted Answer

Query the Heartbeat table, because it stores the heartbeat records for Azure VMs.. Option A is correct because the Heartbeat table in Azure Monitor Logs (Log Analytics) is specifically designed to store heartbeat records from Azure Monitor Agent (AMA) or the legacy Log Analytics agent. Each heartbeat record contains a TimeGenerated timestamp, making it the authoritative source for determining when a VM last reported its health status.

Answer

Join the results to AzureActivity to calculate service health.

Answer

Filter where TimeGenerated is older than 20 minutes before summarizing.

Answer

Use the Perf table because it stores heartbeat timestamps.

Question 13

You want to send a storage account's platform logs to a workspace so they can be queried with KQL later. Which two items are part of the required configuration? Select two.

Accepted Answer

Diagnostic settings on the storage account. A is correct because diagnostic settings on the storage account are the mechanism that defines which platform logs (e.g., storage read/write/delete operations) are collected and where they are sent. Without configuring diagnostic settings, the storage account does not emit logs to any destination. B is correct because a Log Analytics workspace is the required destination for storing the logs so they can be queried with KQL; it provides the ingestion and retention infrastructure for log analytics.

Answer

A network security group

Answer

A Recovery Services vault

Answer

An availability zone assignment

Question 14

A production VM must generate an alert when average CPU exceeds 80 percent for 10 minutes. The alert must be evaluated continuously, but email notifications should be suppressed outside 08:00 to 18:00 on weekdays. What should the administrator configure?

Accepted Answer

A metric alert rule with an action group and an alert processing rule that suppresses actions outside business hours. Option B is correct because it combines a metric alert rule (which continuously evaluates the CPU threshold) with an alert processing rule that suppresses notifications outside business hours. The metric alert rule evaluates every minute by default, meeting the 'continuously evaluated' requirement, while the alert processing rule (formerly action rule) allows you to suppress actions based on a schedule without altering the alert rule itself.

Answer

A log query alert only, with the query scheduled to run during business hours

Answer

A diagnostic setting that sends CPU logs to a storage account and a Logic App for email delivery

Answer

An action group with an email receiver and a virtual machine extension to pause the workload outside business hours

Question 15

A user deleted one Excel file from a Windows Server VM that is protected by Azure Backup. The VM must keep running, and the administrator must restore only that file as quickly as possible. What should the administrator do?

Accepted Answer

Use File Recovery from the Recovery Services vault, mount the recovery point, and copy back the deleted file.. Azure Backup for Azure VMs supports file-level recovery from recovery points without restoring the entire VM. The File Recovery feature mounts the recovery point as an iSCSI target on the VM, allowing the administrator to browse and copy the deleted Excel file directly. This is the fastest method because it avoids the overhead of a full VM restore or snapshot management.

Answer

Restore the entire virtual machine from the most recent recovery point.

Answer

Fail over the VM by using Azure Site Recovery and then copy the file from the replica.

Answer

Create a snapshot of the VM disk and restore the spreadsheet from the snapshot.

AZ-104 Monitor and Maintain Azure Resources Practice Test 10 — 15 Questions

Exhibit

AZ-104 Monitor and Maintain Azure Resources Practice Test 10 — 15 Questions

Exhibit