AZ-104 Monitor and Maintain Azure Resources Practice Test 12 — 15 Questions

Question 1

An employee deleted one spreadsheet from a Windows VM that is protected by Azure Backup. The VM must stay online while the administrator recovers only that file. Which two restore methods are supported? Select two.

Accepted Answer

Use file recovery from the recovery point in the Azure portal.. Option A is correct because Azure Backup's file-level recovery feature in the Azure portal allows you to mount a recovery point as a drive on the running Windows VM, enabling you to browse and copy individual files without restoring the entire VM. This method supports selective file recovery while the VM remains online, meeting the requirement. Option B is also correct because the file recovery script (or PowerShell mount workflow) performs the same mount operation programmatically, providing an alternative way to access and recover the specific spreadsheet from the recovery point.

Answer

Restore the entire VM to a new VM and copy the file back manually.

Answer

Restore the disks from backup and attach them to the running VM.

Answer

Use Azure Site Recovery failover to expose the file.

Question 2

A storage account experiences a brief regional platform issue. The team wants an alert whenever Azure marks the resource as unavailable, even if no custom metric changes are detected. What should the administrator use?

Accepted Answer

A Resource Health alert for the storage account.. A Resource Health alert is designed to monitor the health of Azure resources and trigger notifications when Azure detects that the resource is unavailable due to platform issues, even if no custom metric thresholds are breached. This alert uses signals from the Azure Resource Health service, which tracks the current and historical health status of resources, making it the correct choice for detecting regional platform unavailability without relying on custom metrics.

Answer

A metric alert on the account's transaction count.

Answer

A diagnostic setting that sends logs only to a storage account.

Answer

An Azure Policy assignment that denies writes to the storage account.

Question 3

An employee deleted one spreadsheet stored on a Windows VM that is protected by Azure Backup. The administrator must recover only that file without restoring the entire VM. What should be used?

Accepted Answer

The file recovery process from the Recovery Services vault recovery point.. Azure Backup for Azure VMs supports file-level recovery from a recovery point without restoring the entire VM. The file recovery process mounts the recovery point as an iSCSI target on the VM, allowing the administrator to browse and copy the deleted spreadsheet directly from the snapshot. This is the only option that provides granular, non-disruptive file restoration from a VM backup.

Answer

A full VM restore to replace the existing virtual machine.

Answer

Blob rehydration from Archive tier in the storage account.

Answer

A restore point collection operation in Azure Compute.

Question 4

Based on the exhibit, what should the administrator deploy to monitor CPU and free disk space on a small set of VMs while keeping telemetry cost low?

Accepted Answer

Deploy Azure Monitor Agent and collect only the required performance counters with a data collection rule.. Option A is correct because Azure Monitor Agent (AMA) is the modern, cost-effective agent for collecting performance counters like CPU and free disk space from VMs. By using a Data Collection Rule (DCR) to specify only the required counters, the administrator minimizes data ingestion volume, directly controlling telemetry costs. This approach avoids the overhead of sending all guest logs or using more expensive monitoring tools.

Answer

Enable diagnostic settings on each VM and send all guest logs to a storage account.

Answer

Install Application Insights on each VM and enable request tracing.

Answer

Create a resource lock on each VM to preserve the current state.

Question 5

A troubleshooting team wants to investigate a storage account write failure and subscription-level role assignment changes in a single Log Analytics workspace. They want to ingest only the telemetry needed for those investigations. Which two sources should they enable? Select two.

Accepted Answer

Configure diagnostic settings on the storage account to send resource logs to the workspace.. Option A is correct because diagnostic settings on a storage account can be configured to send resource logs (such as storage write operations, including details of failed writes) to a Log Analytics workspace. This allows the team to investigate write failures directly from the storage account's telemetry.

Answer

Enable guest-level Windows event collection on a random virtual machine.

Answer

Turn on NSG flow logs for every subnet in the subscription.

Answer

Use Azure Advisor recommendations as the source of telemetry.

Question 6

A team needs an alert that emails the operations group whenever a VM's average CPU percentage stays above 85% for 10 minutes. Which two Azure Monitor components must you configure? Select two.

Accepted Answer

A metric alert rule on the VM CPU metric. A metric alert rule on the VM CPU metric is required because it continuously monitors the 'Percentage CPU' metric and triggers when the average value exceeds 85% for a duration of 10 minutes. This rule evaluates the condition using the aggregation type 'Average' and the window size set to PT10M (ISO 8601 format). Without this rule, no alert condition exists to detect the threshold breach.

Answer

A Recovery Services vault

Answer

A private endpoint for the virtual machine

Answer

A blob lifecycle management policy

Question 7

Based on the exhibit, what should the administrator configure so the operations team receives an email when the VM's average CPU stays above 80% for 10 minutes?

Accepted Answer

Create an action group and attach it to the metric alert rule.. To send an email when a metric threshold is breached, you must first create an action group that defines the notification action (e.g., email, SMS). Then, when configuring the metric alert rule for 'Percentage CPU' with a condition of 'greater than 80%' for 10 minutes, you attach that action group to the alert rule. This ensures that when the alert fires, the defined email notification is sent to the operations team.

Answer

Create a diagnostic setting on the VM and send platform logs to Log Analytics.

Answer

Assign a Reader role to the operations team on the VM resource.

Answer

Enable a resource lock on the VM to prevent CPU spikes.

Question 8

Based on the exhibit, what should the administrator change if the business wants backups to be kept for 30 days instead of 7 days?

Accepted Answer

Increase the retain daily backup points setting to 30 days.. The backup retention policy in Azure Backup is configured via the 'Retain daily backup points' setting, which specifies how many days daily recovery points are kept. To change retention from 7 to 30 days, the administrator must increase this value to 30. This directly controls the lifespan of daily backups in the Recovery Services vault.

Answer

Change the backup schedule from daily to hourly.

Answer

Increase the instant recovery snapshot retention to 30 days.

Answer

Enable a CanNotDelete lock on the Recovery Services vault.

Question 9

You need to monitor CPU on a small set of VMs while keeping ingestion costs low. Which two actions are the best choices? Select two.

Accepted Answer

Use Azure Monitor platform metrics for CPU instead of collecting guest logs. Azure Monitor platform metrics for CPU are collected automatically from the Azure VM host at no additional cost, providing basic CPU utilization data without requiring the Log Analytics agent or incurring data ingestion charges. This approach keeps costs low because platform metrics are included in the Azure Monitor pricing, whereas guest-level metrics require log ingestion and storage fees. For a small set of VMs where only CPU monitoring is needed, platform metrics are sufficient and cost-effective.

Answer

Collect all Windows event logs from every VM

Answer

Create a separate workspace for each VM

Answer

Enable verbose guest logging on every server

Question 10

A storage account is failing writes, and the team also wants to correlate those errors with subscription-level changes such as role assignments or deployments. What should the administrator configure?

Accepted Answer

Create diagnostic settings on the storage account and the subscription that send logs to the same Log Analytics workspace.. Option B is correct because diagnostic settings on both the storage account and the subscription can stream platform logs (e.g., StorageWrite failures) and activity logs (e.g., role assignments, deployments) to the same Log Analytics workspace. This enables correlated queries across resource-level operational issues and subscription-level changes, allowing the administrator to identify if a recent role assignment or deployment caused the write failures.

Answer

Rotate the storage account keys and review access from the portal activity feed.

Answer

Place the storage account behind an availability set so writes remain available during maintenance.

Answer

Enable a service endpoint from the application subnet and check whether the firewall blocks the writes.

Question 11

Based on the exhibit, which alert type should the administrator create to detect when Azure marks the storage account unhealthy because of a platform issue?

Accepted Answer

Resource Health alert.. Resource Health alerts are specifically designed to notify administrators when an Azure service or resource becomes unhealthy due to platform issues. In this scenario, the storage account being marked unhealthy by Azure due to a platform issue is exactly the kind of event that a Resource Health alert captures, as it monitors the health status of Azure resources and triggers alerts on state transitions (e.g., from 'Available' to 'Degraded' or 'Unavailable').

Answer

Metric alert on account capacity.

Answer

Log search alert against AzureDiagnostics.

Answer

Autoscale rule based on storage transactions.

Question 12

Based on the exhibit, why does a query against AzureDiagnostics return no rows after the storage account diagnostic setting was changed?

Accepted Answer

The logs are written to resource-specific tables instead of AzureDiagnostics.. Option B is correct because when you change a diagnostic setting for a storage account from 'AzureDiagnostics' mode to 'Resource-specific' mode, logs are no longer sent to the AzureDiagnostics table. Instead, they are written to dedicated resource-specific tables (e.g., StorageReadLogs, StorageWriteLogs). Since the query targets AzureDiagnostics, it returns no rows because the logs are now stored in the new table format.

Answer

The storage account cannot send logs to Log Analytics when public network access is disabled.

Answer

The diagnostic setting only sends metrics, not logs, to the workspace.

Answer

The workspace retention period automatically deletes all records after one hour.

Question 13

An administrator must centralize Azure Activity log events and diagnostic logs from several storage accounts into a single workspace so the team can query them with KQL. What should be configured on each resource?

Accepted Answer

Diagnostic settings to send logs to a Log Analytics workspace.. Diagnostic settings are the Azure mechanism for streaming resource logs and metrics to various destinations, including Log Analytics workspaces. By configuring diagnostic settings on each storage account to send its Activity Log and diagnostic logs to a single Log Analytics workspace, the administrator centralizes the logs for KQL querying. This is the only option that directly enables log ingestion into the workspace.

Answer

A backup policy in Recovery Services vault to copy logs into the workspace.

Answer

A private endpoint for each storage account so the logs remain internal to Azure.

Answer

A management group lock to prevent log deletion.

Question 14

A Recovery Services vault currently keeps daily Azure VM recovery points for 7 days. The business changes the requirement to keep daily recovery points for 30 days. Where should the administrator change the setting?

Accepted Answer

In the backup policy associated with the Recovery Services vault.. The retention duration for Azure VM backups is configured within the backup policy that is associated with the Recovery Services vault. By modifying the backup policy (either the default policy or a custom policy), the administrator can change the retention setting from 7 days to 30 days for daily recovery points. This policy directly controls how long backup snapshots are retained, and the change takes effect for all VMs linked to that policy.

Answer

In the VM's network interface settings, because backup retention follows the NIC configuration.

Answer

In Azure Policy, by assigning a retention compliance initiative to the subscription.

Answer

In a storage account lifecycle rule attached to the VM disks.

Question 15

A storage account becomes unavailable because Azure has a regional platform issue. The operations team wants a notification whenever Azure marks the resource or region unhealthy, and they want to avoid continuous log ingestion just to detect the outage. What should they configure?

Accepted Answer

A Service Health alert based on the Activity log, scoped appropriately.. Option C is correct because a Service Health alert, configured from the Azure Activity log, provides proactive notifications when Azure services or regions experience an outage or degradation. This alert is triggered by Azure's own health signals, eliminating the need for continuous log ingestion or custom metric monitoring to detect platform-level issues.

Answer

A metric alert on storage capacity with an action group.

Answer

A log alert on storage diagnostic logs that watches for 503 responses.

Answer

An Azure Policy assignment that audits the storage account state.