AZ-104 Monitor and Maintain Azure Resources Practice Test 4 — 15 Questions

Question 1

Based on the exhibit, the backup policy must support 30-day recovery for daily backups while keeping 12 months of monthly copies. Which setting should be changed?

Accepted Answer

Increase daily retention from 7 days to 30 days.. The backup policy currently has daily retention set to 7 days, which only keeps daily recovery points for a week. To meet the requirement of 30-day recovery for daily backups, you must increase the daily retention to 30 days. This ensures that each daily backup is retained for 30 days, allowing point-in-time recovery within that window.

Answer

Increase weekly retention from 4 weeks to 30 weeks.

Answer

Change the backup schedule to every 30 days.

Answer

Turn on archive tier for the backup policy.

Question 2

Based on the exhibit, the support team needs a searchable 90-day history of who deleted Azure resources and when. The current workspace only contains VM guest logs. Which configuration should you add?

Accepted Answer

Configure a diagnostic setting at the subscription scope to send the Azure Activity log to Log Analytics and retain it for 90 days.. The Azure Activity log records all control-plane events, including resource deletions, at the subscription level. By configuring a diagnostic setting to stream the Activity log to a Log Analytics workspace, you can retain the data for up to 90 days (or longer with data export rules) and make it searchable via KQL queries. The current workspace only contains VM guest logs, so adding this setting directly meets the requirement without relying on guest-level or network-level logs.

Answer

Enable guest-level diagnostics on each VM so deletion events are captured.

Answer

Turn on NSG flow logs for all subnets to capture resource deletions.

Answer

Store VM backups in the vault and use restore points as an audit trail.

Question 3

Based on the exhibit, the team wants to validate that a protected Azure VM can be recovered without affecting production. Which restore approach best meets the requirement?

Accepted Answer

Restore the VM to a separate resource group or test environment from the latest recovery point.. Restoring the VM to a separate resource group or test environment from the latest recovery point creates an isolated copy of the VM that does not interact with production resources. This approach validates recoverability without risking production name conflicts, IP address overlaps, or accidental data modification. Azure Backup's restore-to-new-location option explicitly supports this isolation by allowing you to choose a different resource group, virtual network, and storage account.

Answer

Use Replace existing VM so the test uses the production name and disks.

Answer

Export a snapshot and assume that proves the VM can boot successfully.

Answer

Enable Site Recovery failover, because backup restore and failover are identical.

Question 4

Based on the exhibit, which KQL query should you use in a scheduled query alert to trigger only when five or more failed events occur within any 15-minute window?

Accepted Answer

CustomAppLogs_CL | where TimeGenerated >= ago(1h) | where Status_s == 'Failed' | summarize FailedCount=count() by bin(TimeGenerated, 15m) | where FailedCount >= 5. Option B is correct because it filters for 'Failed' events in the last hour, groups them into 15-minute bins using `bin(TimeGenerated, 15m)`, and then counts them. The `where FailedCount >= 5` condition triggers the alert only when five or more failed events occur within any single 15-minute window, matching the requirement exactly.

Answer

CustomAppLogs_CL | where TimeGenerated >= ago(15m) | where Status_s == 'Failed' | summarize FailedCount=count() by bin(TimeGenerated, 1h) | where FailedCount >= 5

Answer

CustomAppLogs_CL | where TimeGenerated >= ago(1h) | summarize FailedCount=count() by bin(TimeGenerated, 15m) | where FailedCount >= 5

Answer

CustomAppLogs_CL | where TimeGenerated >= ago(1h) | where Status_s == 'Failed' | summarize FailedCount=count() by bin(TimeGenerated, 15m) | where FailedCount > 0

Question 5

Based on the exhibit, the security team wants an alert whenever someone changes the configuration of a storage account, such as disabling public network access. The current rule is a metric alert on transaction count. What should you use instead?

Accepted Answer

Create an activity log alert for write operations on the storage account resource.. Activity log alerts are designed to monitor Azure resource-level operations, such as write actions that modify storage account configurations. Option D is correct because it creates an alert specifically for write operations on the storage account resource, which captures events like disabling public network access. This is the appropriate method for detecting configuration changes, unlike metric alerts which track performance data.

Answer

Keep the metric alert and lower the threshold to 10 transactions.

Answer

Create a service health alert because storage account settings affect platform status.

Answer

Use a Log Analytics query alert against VM guest logs to detect network-rule changes.

Question 6

Based on the exhibit, an administrator needs to recover one deleted configuration file from a running Azure VM without replacing the VM. Which restore option should be used?

Accepted Answer

Use File Recovery to mount the recovery point and copy back the missing file.. Azure VM File Recovery (part of Azure Backup) allows you to mount a recovery point as a drive on a running VM, browse the file system, and copy specific files back without restoring the entire VM or disks. This is the only option that recovers a single deleted configuration file without replacing or rebuilding the VM.

Answer

Create a new VM from the recovery point so the deleted file returns with a clean operating system.

Answer

Restore disks and manually rebuild the VM afterward.

Answer

Replace the existing VM immediately to recover only one file.

Question 7

Based on the exhibit, the operations team says the alert is too noisy because short CPU spikes after nightly maintenance trigger notifications. They want an alert only when VM1's average CPU stays above 80% for at least 10 minutes. What should you change?

Accepted Answer

Increase the window size to 10 minutes and keep the evaluation frequency at 1 minute.. Option B is correct because increasing the window size to 10 minutes while keeping the evaluation frequency at 1 minute means the alert will only fire when the average CPU over the last 10 minutes exceeds 80%. This filters out transient spikes from nightly maintenance, as the alert requires sustained high CPU for the full duration. The evaluation frequency of 1 minute ensures the alert is checked every minute, but the condition is based on the 10-minute rolling average.

Answer

Lower the threshold to 70% so the alert becomes less sensitive.

Answer

Replace the metric alert with a Log Analytics query alert against the activity log.

Answer

Move the alert scope from the VM to the resource group.

Question 8

A support engineer has several recovery scenarios after Azure VM backup. Match each recovery need to the restore option that best fits.

Question 9

A support engineer is investigating a failed Azure VM backup job in Log Analytics. Match each KQL operator to the result it produces.

Question 10

An administrator is reviewing a KQL query used to investigate failed operations in a Log Analytics workspace. Match each KQL operator to the effect it has on the query output.

Question 11

A backup administrator manages three Recovery Services vaults. They need a single place to review the latest job outcome across all vaults, and then drill into the failed job details for one VM. Which two Azure experiences should they use? Select two.

Accepted Answer

Azure Backup center. Azure Backup center provides a single, unified dashboard to monitor backup jobs across multiple Recovery Services vaults, enabling you to quickly view the latest job outcome for all protected workloads. From the Backup center, you can drill into a specific failed job for a VM by selecting it, which navigates to the detailed job view within the associated Recovery Services vault's Backup jobs blade. This combination meets the requirement for a centralized review and granular drill-down.

Answer

Azure Monitor metric chart

Answer

Azure Activity Log

Answer

Resource Health

Question 12

A production team wants to match common Azure Monitor components to the action each one performs. Match each item on the left to the best description on the right.

Question 13

A helpdesk engineer wants to determine whether a VM issue is caused by a Microsoft platform problem or a problem limited to one specific VM. Which two Azure features should they use? Select two.

Accepted Answer

Resource Health. Resource Health (C) provides a personalized dashboard showing the health of your individual Azure resources, including VMs, and can indicate whether an issue is specific to that resource. Service Health (D) provides a global view of Azure service availability across regions and can identify platform-wide outages or planned maintenance. Together, they allow the engineer to differentiate between a problem limited to one VM and a broader Azure platform problem.

Answer

Azure Advisor

Answer

Backup center

Answer

Log Analytics workspace

Question 14

An operations team monitors a group of Azure VMs and storage accounts. Match each Azure Monitor component to the behavior it provides in day-to-day operations.

Question 15

A production VM needs an email and SMS notification when CPU percentage stays above 80 percent for five minutes. Which two Azure Monitor components should the administrator configure? Select two.

Accepted Answer

Action group. A Metric alert rule monitors the VM’s CPU percentage metric and triggers when the condition (above 80% for 5 minutes) is met. An Action group defines the notification actions (email and SMS) that are executed when the alert fires. Together, they enable the required notification workflow.

Answer

Azure Policy assignment

Answer

Recovery Services vault

Answer

Log Analytics workspace

AZ-104 Monitor and Maintain Azure Resources Practice Test 4 — 15 Questions

Exhibit

AZ-104 Monitor and Maintain Azure Resources Practice Test 4 — 15 Questions

Exhibit