AZ-104 Monitor and Maintain Azure Resources Practice Test 11 — 15 Questions

Question 1

A VM must be backed up every day, and backups must be retained for several days after creation. Which two settings are configured in an Azure Backup policy? Select two.

Accepted Answer

Backup schedule. An Azure Backup policy requires a backup schedule to define when the backup job runs (e.g., daily at a specific time). Option B is correct because retention rules specify how long each backup recovery point is kept (e.g., 7 days for daily backups, 30 days for weekly). Together, these two settings form the core of a backup policy, ensuring both the timing and lifespan of backups are controlled.

Answer

Network security group rules

Answer

Private DNS zone records

Answer

Availability set placement

Question 2

A help desk analyst wants a query in Log Analytics that returns Azure virtual machines that have stopped sending a heartbeat for more than 15 minutes. Which KQL query should the analyst run?

Accepted Answer

Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen < ago(15m). The Heartbeat table in Log Analytics records a heartbeat signal from Azure Monitor agents every 5 minutes by default. The query uses `summarize` to find the latest `TimeGenerated` per computer, then filters with `where LastSeen < ago(15m)` to identify VMs that have not sent a heartbeat in over 15 minutes, indicating they are likely offline or unresponsive.

Answer

AzureActivity | where OperationNameValue contains 'Heartbeat' | summarize count() by ResourceGroup

Answer

Perf | where CounterName == '% Processor Time' | summarize avg(CounterValue) by Computer

Answer

SecurityEvent | where EventID == 4624 | summarize count() by Computer

Question 3

A help desk analyst needs a KQL query that identifies each VM's most recent heartbeat so computers can be flagged if their last check-in is older than 20 minutes. Which two KQL elements should be used? Select two.

Accepted Answer

Query the Heartbeat table, because it stores the heartbeat records for Azure VMs.. The Heartbeat table in Azure Monitor Logs (Log Analytics) is specifically designed to store heartbeat records from Azure Monitor Agent (AMA) or the legacy Log Analytics agent. Each heartbeat record contains a TimeGenerated timestamp, making it the authoritative source for determining when a VM last reported its health status.

Answer

Join the results to AzureActivity to calculate service health.

Answer

Filter where TimeGenerated is older than 20 minutes before summarizing.

Answer

Use the Perf table because it stores heartbeat timestamps.

Question 4

You want to send a storage account's platform logs to a workspace so they can be queried with KQL later. Which two items are part of the required configuration? Select two.

Accepted Answer

Diagnostic settings on the storage account. A is correct because diagnostic settings on the storage account are the mechanism that defines which platform logs (e.g., storage read/write/delete operations) are collected and where they are sent. Without configuring diagnostic settings, the storage account does not emit logs to any destination. B is correct because a Log Analytics workspace is the required destination for storing the logs so they can be queried with KQL; it provides the ingestion and retention infrastructure for log analytics.

Answer

A network security group

Answer

A Recovery Services vault

Answer

An availability zone assignment

Question 5

A production VM must generate an alert when average CPU exceeds 80 percent for 10 minutes. The alert must be evaluated continuously, but email notifications should be suppressed outside 08:00 to 18:00 on weekdays. What should the administrator configure?

Accepted Answer

A metric alert rule with an action group and an alert processing rule that suppresses actions outside business hours. It combines a metric alert rule (which continuously evaluates the CPU threshold) with an alert processing rule that suppresses notifications outside business hours. The metric alert rule evaluates every minute by default, meeting the 'continuously evaluated' requirement, while the alert processing rule (formerly action rule) allows you to suppress actions based on a schedule without altering the alert rule itself.

Answer

A log query alert only, with the query scheduled to run during business hours

Answer

A diagnostic setting that sends CPU logs to a storage account and a Logic App for email delivery

Answer

An action group with an email receiver and a virtual machine extension to pause the workload outside business hours

Question 6

A user deleted one Excel file from a Windows Server VM that is protected by Azure Backup. The VM must keep running, and the administrator must restore only that file as quickly as possible. What should the administrator do?

Accepted Answer

Use File Recovery from the Recovery Services vault, mount the recovery point, and copy back the deleted file.. Azure Backup for Azure VMs supports file-level recovery from recovery points without restoring the entire VM. The File Recovery feature mounts the recovery point as an iSCSI target on the VM, allowing the administrator to browse and copy the deleted Excel file directly. This is the fastest method because it avoids the overhead of a full VM restore or snapshot management.

Answer

Restore the entire virtual machine from the most recent recovery point.

Answer

Fail over the VM by using Azure Site Recovery and then copy the file from the replica.

Answer

Create a snapshot of the VM disk and restore the spreadsheet from the snapshot.

Question 7

An admin enables backup on a newly deployed Azure VM, but every backup job fails immediately with a message that the VM agent is not ready. What should the administrator verify first?

Accepted Answer

The Azure VM Agent is installed, running, and able to provision backup-related extensions.. The Azure VM Agent (also known as the Windows Guest Agent or Linux Agent) is required for the Azure Backup service to install the backup extension (e.g., IaaSBcdrExtension for Windows or SnapshotV2 for Linux). If the agent is not installed, not running, or is in a 'Not Ready' state, the backup extension cannot be provisioned, causing immediate failure. The administrator should first verify that the VM Agent is installed and its status is 'Ready' in the VM's properties.

Answer

The VM is placed in an availability zone that supports backup.

Answer

The VM has a public IP address assigned for outbound connectivity.

Answer

The VM is added to a load balancer backend pool.

Question 8

The operations team manages several Azure VMs in one resource group. They need an alert whenever average CPU percentage on any VM in the group stays above 80% for 10 minutes, and the alert must send email and SMS to the on-call team. What should the administrator configure?

Accepted Answer

Create an Azure Monitor metric alert rule at the resource-group scope and attach an action group.. Azure Monitor metric alerts can be created at the resource-group scope, which allows a single alert rule to monitor the 'Percentage CPU' metric across all VMs in that group. The alert triggers when the average CPU stays above 80% for 10 minutes (evaluated using a fixed aggregation window). An action group attached to the alert rule sends email and SMS notifications to the on-call team, meeting all requirements without manual intervention.

Answer

Create a Log Analytics query alert on the Activity log and manually notify the on-call team.

Answer

Export VM diagnostics to a storage account and have operators review the files after each incident.

Answer

Create a resource lock on the VMs and use Azure Policy to notify the team about CPU spikes.

Question 9

A help desk engineer needs a Log Analytics query that returns each computer whose most recent heartbeat is older than 20 minutes. Which query should they use?

Accepted Answer

Heartbeat | summarize LastSeen = max(TimeGenerated) by Computer | where LastSeen < ago(20m). It first summarizes the most recent heartbeat timestamp for each computer using `max(TimeGenerated)`, then filters for computers where that latest heartbeat is older than 20 minutes with `where LastSeen < ago(20m)`. This ensures only computers that have not sent a heartbeat in the last 20 minutes are returned, which is the exact requirement.

Answer

Heartbeat | where TimeGenerated < ago(20m) | summarize LastSeen = max(TimeGenerated) by Computer

Answer

Heartbeat | summarize count() by Computer | where count_ < 20

Answer

Heartbeat | where TimeGenerated > ago(20m) | summarize LastSeen = max(TimeGenerated) by Computer

Question 10

A team already has a metric alert on a production VM. The alert should continue evaluating 24/7, but email notifications must be sent only Monday through Friday from 08:00 to 18:00 local time. What should the administrator add or change?

Accepted Answer

Create an alert processing rule that suppresses notifications outside business hours.. An alert processing rule (formerly action rule) can suppress notifications for a metric alert based on a schedule. By creating a rule with a suppression action that applies outside business hours (e.g., 18:00 to 08:00 and weekends), the alert continues to evaluate and fire, but email notifications are blocked during those times. This meets the requirement without altering the alert rule itself.

Answer

Replace the metric alert with a diagnostic setting and store the data in Log Analytics.

Answer

Lower the alert threshold so fewer alerts occur during the week.

Answer

Use an autoscale profile instead of an alert rule.

Question 11

Backup protection was enabled on a new Azure VM, but every backup job fails immediately with a message indicating the guest agent is not ready. What should the administrator verify first?

Accepted Answer

That the Azure VM agent is installed, running, and up to date inside the guest operating system.. The Azure Backup extension requires the Azure VM agent to be installed, running, and up to date inside the guest OS to coordinate backup operations. When the agent is not ready, the backup job fails immediately because the extension cannot communicate with the VM to take snapshots. Verifying the agent's status is the first troubleshooting step before investigating network or configuration issues.

Answer

That the recovery vault uses GZRS storage redundancy.

Answer

That the VM has a private endpoint to the Recovery Services vault.

Answer

That a resource lock has not been applied to the VM.

Question 12

A Windows VM protected by Azure Backup is missing one application file, but the VM must stay online during recovery. Which restore approach should the administrator use?

Accepted Answer

Use the file recovery option from the Recovery Services vault for the relevant recovery point. Azure Backup's file recovery option allows you to mount a recovery point as a drive on the running VM without restoring the entire VM or taking it offline. This enables you to copy the missing application file directly from the backup while the VM remains operational, meeting the requirement to stay online.

Answer

Restore the entire VM to a new deployment and then copy the file back

Answer

Trigger an Azure Site Recovery failover to a recovery region

Answer

Create a new backup policy with a shorter retention period and run the next scheduled backup

Question 13

A team wants to monitor average CPU on a small set of Linux VMs and OS disk free space, but they want the lowest telemetry ingestion cost possible. Which two actions should they take? Select two.

Accepted Answer

Use a metric alert for the VM CPU metric.. Metric alerts for VM CPU are based on platform metrics collected automatically by Azure, incurring no additional ingestion cost. This allows monitoring average CPU without any agent or data collection rule, making it the lowest-cost approach for that metric.

Answer

Enable full VM Insights for every guest performance counter.

Answer

Stream all syslog and event logs to a workspace before creating any alert.

Answer

Rely on Azure Resource Health to measure guest OS disk free space.

Question 14

An operations team manages an Azure virtual machine scale set that hosts a stateless API. They already collect guest logs in Log Analytics, but they do not want to ingest extra performance data just to watch CPU. They need an alert when average CPU across the scale set stays above 80% for 10 minutes, and the notification must support email and a webhook. What should they configure?

Accepted Answer

Create an Azure Monitor metric alert on the scale set CPU metric and attach an action group.. Azure Monitor metric alerts can directly evaluate the 'Percentage CPU' metric from a virtual machine scale set without ingesting additional performance data into Log Analytics. By setting the aggregation to 'Average' and the threshold to 80% for a duration of 10 minutes, the alert triggers when the condition is met. An action group attached to the alert can send notifications via email and webhook simultaneously, meeting all requirements without extra data ingestion.

Answer

Create a diagnostic setting on the scale set and build a log query alert for CPU samples.

Answer

Configure an autoscale rule and rely on its notification settings for alerting.

Answer

Install a monitoring extension that writes CPU readings to storage for later review.

Question 15

A Recovery Services vault protects 40 VMs by using one daily backup policy that retains recovery points for 7 days. One finance VM must keep daily recovery points for 30 days, but the other VMs should remain on the 7-day policy. What should the administrator do?

Accepted Answer

Create a second backup policy with 30-day retention and assign only the finance VM to it.. Azure Backup allows multiple backup policies within a single Recovery Services vault, and you can assign different policies to different VMs. By creating a second policy with 30-day retention and assigning only the finance VM to it, the administrator meets the requirement without affecting the other 39 VMs that continue using the existing 7-day policy.

Answer

Edit the existing policy so all protected VMs inherit 30-day retention.

Answer

Move the finance VM to another resource group so it gets different retention automatically.

Answer

Apply a resource lock to the finance VM to preserve its recovery points longer.