AZ-104 Monitor and Maintain Azure Resources Practice Test 2 — 15 Questions

Question 1

An administrator must centralize Azure Activity log events and diagnostic logs from several storage accounts into a single workspace so the team can query them with KQL. What should be configured on each resource?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Diagnostic settings to send logs to a Log Analytics workspace.. Diagnostic settings are the Azure mechanism for streaming logs to destinations such as a Log Analytics workspace. Activity Log events must be sent via diagnostic settings on the subscription level, while diagnostic logs from each storage account are sent via diagnostic settings on the storage account. Configuring these diagnostic settings centralizes both log types for KQL querying. The other options address backup, networking, or governance, not log streaming.

Answer

A backup policy in Recovery Services vault to copy logs into the workspace.

Answer

A private endpoint for each storage account so the logs remain internal to Azure.

Answer

A management group lock to prevent log deletion.

Question 2

You are responsible for monitoring and maintaining Azure resources for a large enterprise. Which four of the following actions or configurations can help you proactively identify performance bottlenecks, optimize costs, and ensure high availability? (Choose four.)

Accepted Answer

Creating diagnostic settings to stream resource logs from Azure SQL Database to a Log Analytics workspace for query-based analysis.. All four correct actions are proactive: Azure Advisor provides cost optimization recommendations; autoscale rules automatically adjust capacity to prevent bottlenecks and improve availability; Service Health alerts notify you of service incidents affecting availability; diagnostic settings to Log Analytics enable proactive analysis of performance logs. Traffic Manager failover routing reroutes traffic away from unhealthy endpoints, not healthy ones, and Backup Center restores are reactive recovery actions rather than proactive monitoring.

Answer

Deploying Azure Traffic Manager with a failover routing method to reroute traffic away from a healthy endpoint.

Answer

Using Azure Backup Center to perform an on-demand restore of a deleted virtual machine to its original state.

Question 3

You need to be notified whenever the average CPU usage of VM-App01 exceeds 80 percent for 10 minutes. The solution must send an email to the operations team automatically. What should you configure?

Accepted Answer

Create an Azure Monitor metric alert and link it to an action group.. Azure Monitor metric alerts can evaluate performance counters like CPU usage over a specified time window (e.g., 10 minutes) and trigger an action group when the threshold (80%) is exceeded. The action group can be configured with an email notification to the operations team, meeting the requirement automatically.

Answer

Create an Azure Advisor recommendation alert.

Answer

Create an activity log alert for the virtual machine.

Answer

Create a subscription budget alert.

Question 4

Your company wants to query performance and event data from multiple Azure virtual machines by using Kusto Query Language. The operations team also wants to centralize retention and analysis of this data. What should you deploy?

Accepted Answer

A Log Analytics workspace.. A Log Analytics workspace is the correct choice because it is the central repository in Azure Monitor for collecting telemetry and log data from Azure virtual machines. It supports Kusto Query Language (KQL) for querying performance and event data, and it provides centralized retention, analysis, and alerting capabilities, meeting both requirements.

Answer

Azure Advisor.

Answer

Azure Network Watcher only.

Answer

A network security group.

Question 5

You need to retain Azure Firewall logs for long-term analysis in a Log Analytics workspace and also archive them in a storage account for compliance. What should you configure on the Azure Firewall resource?

Accepted Answer

Diagnostic settings. Diagnostic settings on the Azure Firewall resource allow you to stream platform logs and metrics to a Log Analytics workspace for long-term analysis and to a storage account for archival and compliance. This is the only configuration that simultaneously supports both destinations for the firewall's log data.

Answer

A resource lock

Answer

An availability set

Answer

A VNet peering connection

Question 6

You need to notify the security team whenever anyone deletes a resource group in the subscription. Which alert type should you configure?

Accepted Answer

An activity log alert. An activity log alert monitors subscription-level events recorded in the Azure Activity Log, including resource group deletion operations. When a user deletes a resource group, the 'Microsoft.Resources/subscriptions/resourceGroups/delete' operation is logged, and an activity log alert can be configured to trigger on that specific operation, sending notifications to the security team.

Answer

A metric alert on CPU percentage

Answer

A budget alert

Answer

A log alert based only on guest OS event logs

Question 7

Your operations team needs to run Kusto queries across collected sign-in logs, VM performance counters, and Azure Activity Log data in a central location. What should you deploy?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the central repository in Azure that ingests and stores diagnostic data from multiple sources, including sign-in logs (Azure AD), VM performance counters (Azure Monitor for VMs), and Azure Activity Logs. It supports Kusto Query Language (KQL) for running complex queries across all collected data, making it the correct choice for this requirement.

Answer

An availability zone

Answer

A NAT gateway

Answer

A standard public IP address

Question 8

A Virtual Machine Scale Set must add instances automatically when average CPU usage is above 75 percent and remove instances when CPU drops below 30 percent. Which feature should you configure?

Accepted Answer

Autoscale rules in Azure Monitor. Autoscale rules in Azure Monitor allow you to define conditions for automatically scaling a Virtual Machine Scale Set (VMSS) based on metrics like average CPU usage. You can set a scale-out rule to add instances when CPU exceeds 75% and a scale-in rule to remove instances when CPU drops below 30%, with a cool-down period to prevent flapping. This is the native Azure feature designed for such metric-based auto-scaling scenarios.

Answer

A Recovery Services vault policy

Answer

Boot diagnostics

Answer

Azure Advisor only

Question 9

You need to collect guest operating system performance counters and Windows event logs from several Azure virtual machines into a central queryable platform. Which Azure component should you configure?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the correct Azure component for collecting guest OS performance counters and Windows event logs from Azure VMs. It serves as a central repository where diagnostic data from Azure Monitor agents (such as the Log Analytics agent or Azure Monitor Agent) is ingested, stored, and made available for querying via Kusto Query Language (KQL). This enables you to analyze performance metrics and event logs across multiple VMs in a unified, queryable platform.

Answer

A Recovery Services vault

Answer

An Azure Policy initiative

Answer

A route table

Question 10

Your operations team needs to receive a Microsoft Teams or email notification whenever a production application becomes unavailable. You have already created an availability test in Azure Monitor. What should you configure next?

Accepted Answer

A metric or log alert rule linked to an action group. An availability test in Azure Monitor detects when an application is unavailable, but it does not inherently trigger notifications. To send a Teams or email alert, you must create a metric or log alert rule that references the availability test's results and link it to an action group, which defines the notification actions (e.g., email, SMS, webhook to Teams). This is the standard Azure Monitor workflow for proactive incident response.

Answer

A management group

Answer

A resource lock

Answer

A private endpoint

Question 11

You need to view recommendations about underutilized virtual machines, security improvements, and cost-saving opportunities in Azure. Which service should you use?

Accepted Answer

Azure Advisor. Azure Advisor provides personalized best-practice recommendations related to reliability, security, performance, operational excellence, and cost.

Answer

Azure Policy

Answer

Network Watcher

Answer

Azure Backup

Question 12

You need to keep Azure activity log data for longer than the default retention period and make it available for analysis. What should you configure?

Accepted Answer

Diagnostic settings for the activity log. The default retention period for Azure activity logs is 90 days. To retain activity log data beyond this period and make it available for analysis (e.g., in a Log Analytics workspace, storage account, or Event Hubs), you must configure diagnostic settings for the activity log. This allows you to stream the log data to a destination of your choice, where you can set custom retention policies.

Answer

A resource lock on the subscription

Answer

An availability zone

Answer

A scale set autoscale policy

Question 13

You need an alert that emails administrators when CPU on VM-DB01 exceeds a threshold. Which two Azure Monitor components work together to achieve this?

Accepted Answer

A metric alert and an action group. A metric alert monitors a specific performance metric (like CPU percentage) on a target resource (VM-DB01) and triggers when the value crosses a defined threshold. An action group defines the notification actions (e.g., sending an email to administrators) that execute when the alert fires. Together, they form the core alerting workflow in Azure Monitor: the metric alert evaluates the condition, and the action group delivers the response.

Answer

A budget alert and a private DNS zone

Answer

A Recovery Services vault and a route table

Answer

An activity log export and a lock

Question 14

Your operations team wants to query collected VM log data by using Kusto Query Language and retain it centrally for analysis. Which Azure resource should you deploy?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the correct Azure resource because it serves as the central repository for VM log data collected via Azure Monitor agents. It supports Kusto Query Language (KQL) for querying and analyzing the collected data, enabling the operations team to perform advanced log analytics and retention. This aligns directly with the requirement to query and retain VM log data centrally.

Answer

An availability set

Answer

A local user account on each VM

Answer

A network security group

Question 15

Your company wants to know when an Azure service outage in the region might affect subscribed resources, even if no metric threshold has been crossed yet. Which alert type should you configure?

Accepted Answer

A Service Health alert. Service Health alerts are designed to notify you about Azure service incidents, maintenance, health advisories, and security advisories that may impact your subscribed resources. Unlike metric alerts, they trigger based on Azure's own health status rather than any metric threshold you configure, making them ideal for detecting region-wide outages before they affect your specific metrics.

Answer

A metric alert

Answer

A budget alert

Answer

A boot diagnostics alert