AZ-104 Monitor and Maintain Azure Resources Practice Test 4 — 15 Questions

Question 1

Based on the exhibit, the alert rule is firing, but the operations team is not receiving any notification. What should you change to make the alert send an email when the condition is met?

Accepted Answer

Attach an action group that includes the required email recipient.. An alert rule in Azure Monitor requires an action group to define the notification actions (e.g., email, SMS) when the alert fires. Without an action group attached to the alert rule, no notifications are sent, even if the condition is met. Option B correctly identifies that attaching an action group containing the required email recipient will enable email notifications.

Answer

Increase the evaluation frequency to 15 minutes so Azure sends a summary notification.

Answer

Create a diagnostic setting on the virtual machine and send logs to a storage account.

Answer

Move the virtual machine into a different resource group so the alert can notify the team.

Question 2

Based on the exhibit, what does the query return?

Accepted Answer

Failed deallocate operations on virtual machines during the last 24 hours.. The query filters for 'Status' equal to 'Failed' and 'Operation' equal to 'Deallocate Virtual Machines', returning only failed deallocate operations. The time filter restricts results to the last 24 hours. Therefore, the query returns failed deallocate operations on virtual machines during the last 24 hours.

Answer

All successful deallocate operations on virtual machines during the last 24 hours.

Answer

Any operations related to starting or restarting virtual machines in the last 24 hours.

Answer

Administrative changes made only from the Azure portal in the last 24 hours.

Question 3

You want to send a storage account's read, write, and delete events to a Log Analytics workspace for later investigation. Which feature should you configure?

Accepted Answer

Diagnostic settings for the storage account. Diagnostic settings on a storage account allow you to stream resource logs, including read, write, and delete operations (stored in the StorageRead, StorageWrite, and StorageDelete log categories), to a Log Analytics workspace. This is the correct feature for capturing and analyzing these events for later investigation.

Answer

An action group

Answer

A metric alert rule

Answer

A Recovery Services vault

Question 4

A production VM is using too much CPU. You want Azure to notify the operations team by email when Average Percentage CPU stays above 80 percent for 5 minutes. What should you configure?

Accepted Answer

A metric alert rule linked to an action group. A metric alert rule monitors a specific metric (e.g., Percentage CPU) and triggers when a condition (e.g., above 80% for 5 minutes) is met. Linking the alert to an action group allows Azure to send email notifications to the operations team. This is the correct Azure Monitor feature for threshold-based, metric-driven notifications.

Answer

A diagnostic setting on the VM

Answer

A Log Analytics workspace only

Answer

An Azure Policy assignment

Question 5

Based on the exhibit, the VM backup item was accidentally deleted from the vault yesterday, but the VM itself still exists. What should you do to resume protection with the existing backup item?

Accepted Answer

Recover or undelete the backup item from the vault before the soft-delete retention expires.. Azure Backup uses soft-delete for backup items, which retains deleted backup data for 14 days by default. Since the backup item was accidentally deleted yesterday, it is still in the soft-delete state and can be recovered or undeleted from the vault before the retention period expires. Once recovered, protection can be resumed on the existing VM without data loss or reconfiguration.

Answer

Delete the VM and recreate it so the backup can start again.

Answer

Create a new action group so the vault can re-enable protection.

Answer

Disable diagnostic settings on the vault and then re-enable them.

Question 6

Your team wants every protected Azure VM in a vault to be backed up once each day and kept for 30 days. Which Recovery Services vault setting should you configure?

Accepted Answer

A backup policy. A backup policy defines the frequency and retention duration for backups. By configuring a backup policy with a daily backup schedule and a retention period of 30 days, you ensure that each protected Azure VM in the Recovery Services vault is backed up once per day and the backups are kept for 30 days. This is the correct setting to meet the team's requirements.

Answer

A diagnostic setting

Answer

A resource lock

Answer

An action group

Question 7

Based on the exhibit, a user accidentally deleted one file from the VM and you need to restore only that file without recovering the entire virtual machine. What should you use?

Accepted Answer

Run file recovery from the available recovery point.. Azure Backup for Azure VMs supports file-level recovery from VM backup snapshots without restoring the entire VM. By selecting 'File Recovery' from the backup item's recovery point, you can mount the backup as a drive on the VM or a recovery machine, browse the file system, and copy the deleted file back to its original location. This avoids the overhead and downtime of a full VM restore.

Answer

Restore the entire VM to the original resource group.

Answer

Create a new backup policy with longer retention and wait for the next backup.

Answer

Use Azure Monitor alerts to trigger an automatic file restore.

Question 8

You already created a metric alert rule. You want the alert to send email and call a webhook when it fires. Which component should you link to the alert rule?

Accepted Answer

An action group. An action group is the correct component because it defines the notification and automation actions (such as sending an email or invoking a webhook) that are triggered when a metric alert rule fires. In Azure Monitor, alert rules are linked to action groups to execute these responses; without an action group, the alert can only log the event but cannot perform any external notification or automation.

Answer

A diagnostic setting

Answer

A Log Analytics workspace

Answer

An Azure Policy initiative

Question 9

In Log Analytics, you need to find AzureActivity records for VM stop or deallocate operations from the last 24 hours. Which query should you use?

Accepted Answer

AzureActivity | where TimeGenerated > ago(24h) | where OperationNameValue has_any ("Microsoft.Compute/virtualMachines/deallocate/action", "Microsoft.Compute/virtualMachines/powerOff/action"). It uses the `has_any` operator to filter AzureActivity records for the exact operation names corresponding to VM stop (powerOff) and deallocate actions, and it restricts the time range to the last 24 hours using `ago(24h)`. This directly matches the requirement to find VM stop or deallocate operations within the specified timeframe.

Answer

AzureActivity | summarize count() by OperationNameValue

Answer

AzureActivity | where ResourceType == "Microsoft.Compute/virtualMachines" | project TimeGenerated, ResourceGroup

Answer

AzureActivity | sort by TimeGenerated asc

Question 10

Based on the exhibit, a metric alert already exists for VM01, but the on-call team never receives an email when CPU exceeds 80% for 5 minutes. What should you configure to deliver the notification?

Accepted Answer

Add an action group to the alert rule and configure email delivery.. The alert rule exists, but no notification action is configured. An action group defines how to notify administrators (e.g., email, SMS, webhook). Adding an action group with an email action to the existing alert rule will deliver the email when the CPU threshold is breached.

Answer

Create a diagnostic setting on VM01 to export metrics to Log Analytics.

Answer

Assign the Reader role to the on-call team so they can view the alert.

Answer

Create a resource lock on VM01 to prevent accidental changes.

Question 11

Based on the exhibit, you need to return only the failed operations from the log entries. Which KQL query should you use?

Accepted Answer

AzureActivity | where ActivityStatusValue == "Failed" | project TimeGenerated, OperationName, Caller. The KQL query filters the AzureActivity table using the `where` clause to return only rows where `ActivityStatusValue` equals 'Failed', then projects the relevant columns `TimeGenerated`, `OperationName`, and `Caller`. This directly meets the requirement to return only failed operations from the log entries.

Answer

AzureActivity | summarize count() by Caller

Answer

AzureActivity | top 10 by TimeGenerated

Answer

AzureActivity | where ActivityStatusValue == "Succeeded"

Question 12

A team manages a production VM and its supporting storage account. Match each operational requirement to the Azure Monitor component that should be configured.

Accepted Answer

Azure Monitor Metrics: Stores numerical performance data. Azure Monitor Metrics stores numerical performance data, Log Analytics enables KQL queries, Alerts notify on conditions, Workbooks provide dashboards, the Azure Monitor Agent collects guest OS logs, and Storage analytics logs capture storage access data.

Answer

Azure Monitor Metrics: Enables KQL queries against collected log data

Answer

Log Analytics: Stores numerical performance data

Question 13

Based on the exhibit, which KQL query should you use to find failed storage account delete operations in the last hour and count them by caller?

Accepted Answer

AzureActivity | where TimeGenerated > ago(1h) | where OperationNameValue has 'Microsoft.Storage/storageAccounts/delete' | where ActivityStatusValue == 'Failed' | summarize Failures=count() by Caller. It filters AzureActivity logs to the last hour using `TimeGenerated > ago(1h)`, targets only storage account delete operations with `OperationNameValue has 'Microsoft.Storage/storageAccounts/delete'`, restricts to failed operations via `ActivityStatusValue == 'Failed'`, and then counts failures by caller using `summarize Failures=count() by Caller`. This precisely meets the requirement to find failed storage account delete operations in the last hour and count them by caller.

Answer

AzureActivity | where TimeGenerated > ago(1h) | where OperationNameValue has 'Microsoft.Storage/storageAccounts/delete' | where ActivityStatusValue == 'Succeeded' | summarize Failures=count() by Caller

Answer

SecurityEvent | where EventID == 4670 | summarize count() by Account

Answer

AzureActivity | where TimeGenerated > ago(1h) | where OperationNameValue has 'Microsoft.Storage/storageAccounts/delete' | summarize Failures=count() by Caller

Question 14

Based on the exhibit, the backup policy must support 30-day recovery for daily backups while keeping 12 months of monthly copies. Which setting should be changed?

Accepted Answer

Increase daily retention from 7 days to 30 days.. The backup policy currently has daily retention set to 7 days, which only keeps daily recovery points for a week. To meet the requirement of 30-day recovery for daily backups, you must increase the daily retention to 30 days. This ensures that each daily backup is retained for 30 days, allowing point-in-time recovery within that window.

Answer

Increase weekly retention from 4 weeks to 30 weeks.

Answer

Change the backup schedule to every 30 days.

Answer

Turn on archive tier for the backup policy.

Question 15

Based on the exhibit, the support team needs a searchable 90-day history of who deleted Azure resources and when. The current workspace only contains VM guest logs. Which configuration should you add?

Accepted Answer

Configure a diagnostic setting at the subscription scope to send the Azure Activity log to Log Analytics and retain it for 90 days.. The Azure Activity log records all control-plane events, including resource deletions, at the subscription level. By configuring a diagnostic setting to stream the Activity log to a Log Analytics workspace, you can retain the data for up to 90 days (or longer with data export rules) and make it searchable via KQL queries. The current workspace only contains VM guest logs, so adding this setting directly meets the requirement without relying on guest-level or network-level logs.

Answer

Enable guest-level diagnostics on each VM so deletion events are captured.

Answer

Turn on NSG flow logs for all subnets to capture resource deletions.

Answer

Store VM backups in the vault and use restore points as an audit trail.