AZ-104 Monitor and Maintain Azure Resources Practice Test 11 — 15 Questions

Question 1

A security team needs to investigate future configuration changes on a storage account and subscription-level control-plane changes in one place by using KQL. The team already created a Log Analytics workspace. What else must the administrator configure so the required logs are queryable in that workspace?

Accepted Answer

Configure diagnostic settings on the storage account and export the subscription Activity log to the same workspace.. Option B is correct because the Azure Activity log captures subscription-level control-plane events (e.g., resource creation, policy changes), and diagnostic settings on the storage account capture resource-level control-plane and data-plane changes. By exporting both to the same Log Analytics workspace, the security team can query all future configuration changes in one place using KQL, meeting the requirement without needing separate workspaces or agents.

Answer

Enable only the Azure Activity log export and skip resource diagnostic settings.

Answer

Install the Azure Monitor Agent on the storage account so it can send its own logs.

Answer

Create separate workspaces for each resource and query them independently.

Question 2

An admin enables backup on a newly deployed Azure VM, but every backup job fails immediately with a message that the VM agent is not ready. What should the administrator verify first?

Accepted Answer

The Azure VM Agent is installed, running, and able to provision backup-related extensions.. The Azure VM Agent (also known as the Windows Guest Agent or Linux Agent) is required for the Azure Backup service to install the backup extension (e.g., IaaSBcdrExtension for Windows or SnapshotV2 for Linux). If the agent is not installed, not running, or is in a 'Not Ready' state, the backup extension cannot be provisioned, causing immediate failure. The administrator should first verify that the VM Agent is installed and its status is 'Ready' in the VM's properties.

Answer

The VM is placed in an availability zone that supports backup.

Answer

The VM has a public IP address assigned for outbound connectivity.

Answer

The VM is added to a load balancer backend pool.

Question 3

The operations team manages several Azure VMs in one resource group. They need an alert whenever average CPU percentage on any VM in the group stays above 80% for 10 minutes, and the alert must send email and SMS to the on-call team. What should the administrator configure?

Accepted Answer

Create an Azure Monitor metric alert rule at the resource-group scope and attach an action group.. Option B is correct because Azure Monitor metric alerts can be created at the resource-group scope, which allows a single alert rule to monitor the 'Percentage CPU' metric across all VMs in that group. The alert triggers when the average CPU stays above 80% for 10 minutes (evaluated using a fixed aggregation window). An action group attached to the alert rule sends email and SMS notifications to the on-call team, meeting all requirements without manual intervention.

Answer

Create a Log Analytics query alert on the Activity log and manually notify the on-call team.

Answer

Export VM diagnostics to a storage account and have operators review the files after each incident.

Answer

Create a resource lock on the VMs and use Azure Policy to notify the team about CPU spikes.

Question 4

A help desk engineer needs a Log Analytics query that returns each computer whose most recent heartbeat is older than 20 minutes. Which query should they use?

Accepted Answer

Heartbeat | summarize LastSeen = max(TimeGenerated) by Computer | where LastSeen < ago(20m). Option B is correct because it first summarizes the most recent heartbeat timestamp for each computer using `max(TimeGenerated)`, then filters for computers where that latest heartbeat is older than 20 minutes with `where LastSeen < ago(20m)`. This ensures only computers that have not sent a heartbeat in the last 20 minutes are returned, which is the exact requirement.

Answer

Heartbeat | where TimeGenerated < ago(20m) | summarize LastSeen = max(TimeGenerated) by Computer

Answer

Heartbeat | summarize count() by Computer | where count_ < 20

Answer

Heartbeat | where TimeGenerated > ago(20m) | summarize LastSeen = max(TimeGenerated) by Computer

Question 5

A production virtual machine must trigger an immediate notification whenever average CPU stays above 85 percent for 15 minutes, and the same event must also start an Azure Function that opens an incident ticket. Which two Azure Monitor components should you configure? Select two.

Accepted Answer

Create a metric alert rule on the VM CPU percentage.. A metric alert rule on the VM CPU percentage is correct because it monitors the specific metric (Percentage CPU) and triggers when the average exceeds 85% for 15 minutes, meeting the notification requirement. This rule evaluates the metric at regular intervals and fires when the condition is met, which is the standard Azure Monitor approach for real-time metric-based alerts.

Answer

Enable a diagnostic setting on the VM without creating an alert rule.

Answer

Create a Log Analytics workspace and rely on manual queries only.

Answer

Apply a resource lock so CPU usage changes are blocked.

Question 6

An operations team needs to know when Azure marks a storage account unavailable because of a regional platform issue, and they also want to detect abnormal service latency on the account itself. Which two alerting approaches should they configure? Select two.

Accepted Answer

Create a Resource Health alert for the storage account.. Option A is correct because a Resource Health alert monitors the health of the storage account from the Azure platform's perspective, triggering when Azure marks the resource as unavailable due to a regional platform issue (e.g., an outage or degradation). This directly addresses the requirement to know when the account is marked unavailable.

Answer

Create an Activity Log alert for every blob write.

Answer

Send a workbook link in an action group instead of an alert.

Answer

Turn on Azure Policy compliance scanning for the storage account.

Question 7

A team already has a metric alert on a production VM. The alert should continue evaluating 24/7, but email notifications must be sent only Monday through Friday from 08:00 to 18:00 local time. What should the administrator add or change?

Accepted Answer

Create an alert processing rule that suppresses notifications outside business hours.. Option B is correct because an alert processing rule (formerly action rule) can suppress notifications for a metric alert based on a schedule. By creating a rule with a suppression action that applies outside business hours (e.g., 18:00 to 08:00 and weekends), the alert continues to evaluate and fire, but email notifications are blocked during those times. This meets the requirement without altering the alert rule itself.

Answer

Replace the metric alert with a diagnostic setting and store the data in Log Analytics.

Answer

Lower the alert threshold so fewer alerts occur during the week.

Answer

Use an autoscale profile instead of an alert rule.

Question 8

Backup protection was enabled on a new Azure VM, but every backup job fails immediately with a message indicating the guest agent is not ready. What should the administrator verify first?

Accepted Answer

That the Azure VM agent is installed, running, and up to date inside the guest operating system.. The Azure Backup extension requires the Azure VM agent to be installed, running, and up to date inside the guest OS to coordinate backup operations. When the agent is not ready, the backup job fails immediately because the extension cannot communicate with the VM to take snapshots. Verifying the agent's status is the first troubleshooting step before investigating network or configuration issues.

Answer

That the recovery vault uses GZRS storage redundancy.

Answer

That the VM has a private endpoint to the Recovery Services vault.

Answer

That a resource lock has not been applied to the VM.

Question 9

A Windows VM protected by Azure Backup is missing one application file, but the VM must stay online during recovery. Which restore approach should the administrator use?

Accepted Answer

Use the file recovery option from the Recovery Services vault for the relevant recovery point. Azure Backup's file recovery option allows you to mount a recovery point as a drive on the running VM without restoring the entire VM or taking it offline. This enables you to copy the missing application file directly from the backup while the VM remains operational, meeting the requirement to stay online.

Answer

Restore the entire VM to a new deployment and then copy the file back

Answer

Trigger an Azure Site Recovery failover to a recovery region

Answer

Create a new backup policy with a shorter retention period and run the next scheduled backup

Question 10

A team wants to monitor average CPU on a small set of Linux VMs and OS disk free space, but they want the lowest telemetry ingestion cost possible. Which two actions should they take? Select two.

Accepted Answer

Use a metric alert for the VM CPU metric.. Option A is correct because metric alerts for VM CPU are based on platform metrics collected automatically by Azure, incurring no additional ingestion cost. This allows monitoring average CPU without any agent or data collection rule, making it the lowest-cost approach for that metric.

Answer

Enable full VM Insights for every guest performance counter.

Answer

Stream all syslog and event logs to a workspace before creating any alert.

Answer

Rely on Azure Resource Health to measure guest OS disk free space.

Question 11

An operations team manages an Azure virtual machine scale set that hosts a stateless API. They already collect guest logs in Log Analytics, but they do not want to ingest extra performance data just to watch CPU. They need an alert when average CPU across the scale set stays above 80% for 10 minutes, and the notification must support email and a webhook. What should they configure?

Accepted Answer

Create an Azure Monitor metric alert on the scale set CPU metric and attach an action group.. Option B is correct because Azure Monitor metric alerts can directly evaluate the 'Percentage CPU' metric from a virtual machine scale set without ingesting additional performance data into Log Analytics. By setting the aggregation to 'Average' and the threshold to 80% for a duration of 10 minutes, the alert triggers when the condition is met. An action group attached to the alert can send notifications via email and webhook simultaneously, meeting all requirements without extra data ingestion.

Answer

Create a diagnostic setting on the scale set and build a log query alert for CPU samples.

Answer

Configure an autoscale rule and rely on its notification settings for alerting.

Answer

Install a monitoring extension that writes CPU readings to storage for later review.

Question 12

A Recovery Services vault protects 40 VMs by using one daily backup policy that retains recovery points for 7 days. One finance VM must keep daily recovery points for 30 days, but the other VMs should remain on the 7-day policy. What should the administrator do?

Accepted Answer

Create a second backup policy with 30-day retention and assign only the finance VM to it.. Option B is correct because Azure Backup allows multiple backup policies within a single Recovery Services vault, and you can assign different policies to different VMs. By creating a second policy with 30-day retention and assigning only the finance VM to it, the administrator meets the requirement without affecting the other 39 VMs that continue using the existing 7-day policy.

Answer

Edit the existing policy so all protected VMs inherit 30-day retention.

Answer

Move the finance VM to another resource group so it gets different retention automatically.

Answer

Apply a resource lock to the finance VM to preserve its recovery points longer.

Question 13

Engineers need a single Log Analytics workspace to investigate incidents by querying Windows event logs from a VM and Azure resource logs from a storage account. What should the administrator configure?

Accepted Answer

Use Azure Monitor Agent with a data collection rule for the VM and diagnostic settings for the storage account, both sending data to the same workspace.. Option B is correct because Azure Monitor Agent (AMA) with a data collection rule (DCR) collects Windows event logs from VMs, and diagnostic settings on a storage account send Azure resource logs to the same Log Analytics workspace. This centralizes both data sources for unified querying and incident investigation.

Answer

Create a resource lock on the workspace and let each team send emails when incidents happen.

Answer

Move the VM and storage account into the same availability set so their logs appear together.

Answer

Enable a private endpoint for the workspace and disable all diagnostic collection.

Question 14

Based on the exhibit, which restore option should the administrator use to recover only the deleted file while keeping the VM online?

Accepted Answer

Use File Recovery from the Recovery Services vault.. Option B is correct because Azure Backup's File Recovery feature allows you to mount a recovery point as a drive on the VM, enabling you to browse and restore individual files without affecting the running VM. This avoids the need to restore the entire VM or take it offline, which is essential for recovering only the deleted file while maintaining availability.

Answer

Restore the entire virtual machine to the latest recovery point.

Answer

Redeploy the VM from the original image.

Answer

Disable backup protection and then re-enable it.

Question 15

A production virtual machine is experiencing intermittent performance spikes. The operations team wants an alert when average CPU usage stays above 80 percent for 10 minutes and wants email and SMS notifications sent automatically. What should the administrator configure in Azure Monitor?

Accepted Answer

Create a metric alert on Percentage CPU and associate an action group with email and SMS receivers.. Option B is correct because Azure Monitor metric alerts can evaluate real-time performance counters like Percentage CPU against a threshold (e.g., 80%) over a specified duration (e.g., 10 minutes). By associating an action group with email and SMS receivers, the alert automatically triggers the desired notifications without requiring log ingestion or complex queries.

Answer

Create a log search alert on the VM performance data and attach a resource lock.

Answer

Assign an Azure Policy definition to the VM to stop it when CPU exceeds the threshold.

Answer

Enable diagnostic settings on the VM and send the data only to a storage account.