AZ-104 Monitor and Maintain Azure Resources Practice Test 12 — 15 Questions

Question 1

Engineers need a single Log Analytics workspace to investigate incidents by querying Windows event logs from a VM and Azure resource logs from a storage account. What should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Azure Monitor Agent with a data collection rule for the VM and diagnostic settings for the storage account, both sending data to the same workspace.. Azure Monitor Agent (AMA) with a data collection rule (DCR) collects Windows event logs from VMs, and diagnostic settings on a storage account send Azure resource logs to the same Log Analytics workspace. This centralizes both data sources for unified querying and incident investigation.

Answer

Create a resource lock on the workspace and let each team send emails when incidents happen.

Answer

Move the VM and storage account into the same availability set so their logs appear together.

Answer

Enable a private endpoint for the workspace and disable all diagnostic collection.

Question 2

Based on the exhibit, which restore option should the administrator use to recover only the deleted file while keeping the VM online?

Accepted Answer

Use File Recovery from the Recovery Services vault.. Azure Backup's File Recovery feature allows you to mount a recovery point as a drive on the VM, enabling you to browse and restore individual files without affecting the running VM. This avoids the need to restore the entire VM or take it offline, which is essential for recovering only the deleted file while maintaining availability.

Answer

Restore the entire virtual machine to the latest recovery point.

Answer

Redeploy the VM from the original image.

Answer

Disable backup protection and then re-enable it.

Question 3

A production virtual machine is experiencing intermittent performance spikes. The operations team wants an alert when average CPU usage stays above 80 percent for 10 minutes and wants email and SMS notifications sent automatically. What should the administrator configure in Azure Monitor?

Accepted Answer

Create a metric alert on Percentage CPU and associate an action group with email and SMS receivers.. Azure Monitor metric alerts can evaluate real-time performance counters like Percentage CPU against a threshold (e.g., 80%) over a specified duration (e.g., 10 minutes). By associating an action group with email and SMS receivers, the alert automatically triggers the desired notifications without requiring log ingestion or complex queries.

Answer

Create a log search alert on the VM performance data and attach a resource lock.

Answer

Assign an Azure Policy definition to the VM to stop it when CPU exceeds the threshold.

Answer

Enable diagnostic settings on the VM and send the data only to a storage account.

Question 4

An employee deleted one spreadsheet from a Windows VM that is protected by Azure Backup. The VM must stay online while the administrator recovers only that file. Which two restore methods are supported? Select two.

Accepted Answer

Use file recovery from the recovery point in the Azure portal.. Azure Backup's file-level recovery feature in the Azure portal allows you to mount a recovery point as a drive on the running Windows VM, enabling you to browse and copy individual files without restoring the entire VM. This method supports selective file recovery while the VM remains online, meeting the requirement. Option B is also correct because the file recovery script (or PowerShell mount workflow) performs the same mount operation programmatically, providing an alternative way to access and recover the specific spreadsheet from the recovery point.

Answer

Restore the entire VM to a new VM and copy the file back manually.

Answer

Restore the disks from backup and attach them to the running VM.

Answer

Use Azure Site Recovery failover to expose the file.

Question 5

A storage account experiences a brief regional platform issue. The team wants an alert whenever Azure marks the resource as unavailable, even if no custom metric changes are detected. What should the administrator use?

Accepted Answer

A Resource Health alert for the storage account.. A Resource Health alert is designed to monitor the health of Azure resources and trigger notifications when Azure detects that the resource is unavailable due to platform issues, even if no custom metric thresholds are breached. This alert uses signals from the Azure Resource Health service, which tracks the current and historical health status of resources, making it the correct choice for detecting regional platform unavailability without relying on custom metrics.

Answer

A metric alert on the account's transaction count.

Answer

A diagnostic setting that sends logs only to a storage account.

Answer

An Azure Policy assignment that denies writes to the storage account.

Question 6

An employee deleted one spreadsheet stored on a Windows VM that is protected by Azure Backup. The administrator must recover only that file without restoring the entire VM. What should be used?

Accepted Answer

The file recovery process from the Recovery Services vault recovery point.. Azure Backup for Azure VMs supports file-level recovery from a recovery point without restoring the entire VM. The file recovery process mounts the recovery point as an iSCSI target on the VM, allowing the administrator to browse and copy the deleted spreadsheet directly from the snapshot. This is the only option that provides granular, non-disruptive file restoration from a VM backup.

Answer

A full VM restore to replace the existing virtual machine.

Answer

Blob rehydration from Archive tier in the storage account.

Answer

A restore point collection operation in Azure Compute.

Question 7

Based on the exhibit, what should the administrator deploy to monitor CPU and free disk space on a small set of VMs while keeping telemetry cost low?

Accepted Answer

Deploy Azure Monitor Agent and collect only the required performance counters with a data collection rule.. Azure Monitor Agent (AMA) is the modern, cost-effective agent for collecting performance counters like CPU and free disk space from VMs. By using a Data Collection Rule (DCR) to specify only the required counters, the administrator minimizes data ingestion volume, directly controlling telemetry costs. This approach avoids the overhead of sending all guest logs or using more expensive monitoring tools.

Answer

Enable diagnostic settings on each VM and send all guest logs to a storage account.

Answer

Install Application Insights on each VM and enable request tracing.

Answer

Create a resource lock on each VM to preserve the current state.

Question 8

A team needs an alert that emails the operations group whenever a VM's average CPU percentage stays above 85% for 10 minutes. Which two Azure Monitor components must you configure? Select two.

Accepted Answer

A metric alert rule on the VM CPU metric. A metric alert rule on the VM CPU metric is required because it continuously monitors the 'Percentage CPU' metric and triggers when the average value exceeds 85% for a duration of 10 minutes. This rule evaluates the condition using the aggregation type 'Average' and the window size set to PT10M (ISO 8601 format). Without this rule, no alert condition exists to detect the threshold breach.

Answer

A Recovery Services vault

Answer

A private endpoint for the virtual machine

Answer

A blob lifecycle management policy

Question 9

Based on the exhibit, what should the administrator configure so the operations team receives an email when the VM's average CPU stays above 80% for 10 minutes?

Accepted Answer

Create an action group and attach it to the metric alert rule.. To send an email when a metric threshold is breached, you must first create an action group that defines the notification action (e.g., email, SMS). Then, when configuring the metric alert rule for 'Percentage CPU' with a condition of 'greater than 80%' for 10 minutes, you attach that action group to the alert rule. This ensures that when the alert fires, the defined email notification is sent to the operations team.

Answer

Create a diagnostic setting on the VM and send platform logs to Log Analytics.

Answer

Assign a Reader role to the operations team on the VM resource.

Answer

Enable a resource lock on the VM to prevent CPU spikes.

Question 10

Based on the exhibit, what should the administrator change if the business wants backups to be kept for 30 days instead of 7 days?

Accepted Answer

Increase the retain daily backup points setting to 30 days.. The backup retention policy in Azure Backup is configured via the 'Retain daily backup points' setting, which specifies how many days daily recovery points are kept. To change retention from 7 to 30 days, the administrator must increase this value to 30. This directly controls the lifespan of daily backups in the Recovery Services vault.

Answer

Change the backup schedule from daily to hourly.

Answer

Increase the instant recovery snapshot retention to 30 days.

Answer

Enable a CanNotDelete lock on the Recovery Services vault.

Question 11

You need to monitor CPU on a small set of VMs while keeping ingestion costs low. Which two actions are the best choices? Select two.

Accepted Answer

Use Azure Monitor platform metrics for CPU instead of collecting guest logs. Azure Monitor platform metrics for CPU are collected automatically from the Azure VM host at no additional cost, providing basic CPU utilization data without requiring the Log Analytics agent or incurring data ingestion charges. This approach keeps costs low because platform metrics are included in the Azure Monitor pricing, whereas guest-level metrics require log ingestion and storage fees. For a small set of VMs where only CPU monitoring is needed, platform metrics are sufficient and cost-effective.

Answer

Collect all Windows event logs from every VM

Answer

Create a separate workspace for each VM

Answer

Enable verbose guest logging on every server

Question 12

A storage account is failing writes, and the team also wants to correlate those errors with subscription-level changes such as role assignments or deployments. What should the administrator configure?

Accepted Answer

Create diagnostic settings on the storage account and the subscription that send logs to the same Log Analytics workspace.. Diagnostic settings on both the storage account and the subscription can stream platform logs (e.g., StorageWrite failures) and activity logs (e.g., role assignments, deployments) to the same Log Analytics workspace. This enables correlated queries across resource-level operational issues and subscription-level changes, allowing the administrator to identify if a recent role assignment or deployment caused the write failures.

Answer

Rotate the storage account keys and review access from the portal activity feed.

Answer

Place the storage account behind an availability set so writes remain available during maintenance.

Answer

Enable a service endpoint from the application subnet and check whether the firewall blocks the writes.

Question 13

Based on the exhibit, which alert type should the administrator create to detect when Azure marks the storage account unhealthy because of a platform issue?

Accepted Answer

Resource Health alert.. Resource Health alerts are specifically designed to notify administrators when an Azure service or resource becomes unhealthy due to platform issues. In this scenario, the storage account being marked unhealthy by Azure due to a platform issue is exactly the kind of event that a Resource Health alert captures, as it monitors the health status of Azure resources and triggers alerts on state transitions (e.g., from 'Available' to 'Degraded' or 'Unavailable').

Answer

Metric alert on account capacity.

Answer

Log search alert against AzureDiagnostics.

Answer

Autoscale rule based on storage transactions.

Question 14

Based on the exhibit, why does a query against AzureDiagnostics return no rows after the storage account diagnostic setting was changed?

Accepted Answer

The logs are written to resource-specific tables instead of AzureDiagnostics.. When you change a diagnostic setting for a storage account from 'AzureDiagnostics' mode to 'Resource-specific' mode, logs are no longer sent to the AzureDiagnostics table. Instead, they are written to dedicated resource-specific tables (e.g., StorageReadLogs, StorageWriteLogs). Since the query targets AzureDiagnostics, it returns no rows because the logs are now stored in the new table format.

Answer

The storage account cannot send logs to Log Analytics when public network access is disabled.

Answer

The diagnostic setting only sends metrics, not logs, to the workspace.

Answer

The workspace retention period automatically deletes all records after one hour.

Question 15

A Recovery Services vault currently keeps daily Azure VM recovery points for 7 days. The business changes the requirement to keep daily recovery points for 30 days. Where should the administrator change the setting?

Accepted Answer

In the backup policy associated with the Recovery Services vault.. The retention duration for Azure VM backups is configured within the backup policy that is associated with the Recovery Services vault. By modifying the backup policy (either the default policy or a custom policy), the administrator can change the retention setting from 7 days to 30 days for daily recovery points. This policy directly controls how long backup snapshots are retained, and the change takes effect for all VMs linked to that policy.

Answer

In the VM's network interface settings, because backup retention follows the NIC configuration.

Answer

In Azure Policy, by assigning a retention compliance initiative to the subscription.

Answer

In a storage account lifecycle rule attached to the VM disks.