AZ-104 Monitor and Maintain Azure Resources Practice Test 5 — 15 Questions

Question 1

Based on the exhibit, the team wants to validate that a protected Azure VM can be recovered without affecting production. Which restore approach best meets the requirement?

Accepted Answer

Restore the VM to a separate resource group or test environment from the latest recovery point.. Restoring the VM to a separate resource group or test environment from the latest recovery point creates an isolated copy of the VM that does not interact with production resources. This approach validates recoverability without risking production name conflicts, IP address overlaps, or accidental data modification. Azure Backup's restore-to-new-location option explicitly supports this isolation by allowing you to choose a different resource group, virtual network, and storage account.

Answer

Use Replace existing VM so the test uses the production name and disks.

Answer

Export a snapshot and assume that proves the VM can boot successfully.

Answer

Enable Site Recovery failover, because backup restore and failover are identical.

Question 2

Based on the exhibit, which KQL query should you use in a scheduled query alert to trigger only when five or more failed events occur within any 15-minute window?

Accepted Answer

CustomAppLogs_CL | where TimeGenerated >= ago(1h) | where Status_s == 'Failed' | summarize FailedCount=count() by bin(TimeGenerated, 15m) | where FailedCount >= 5. It filters for 'Failed' events in the last hour, groups them into 15-minute bins using `bin(TimeGenerated, 15m)`, and then counts them. The `where FailedCount >= 5` condition triggers the alert only when five or more failed events occur within any single 15-minute window, matching the requirement exactly.

Answer

CustomAppLogs_CL | where TimeGenerated >= ago(15m) | where Status_s == 'Failed' | summarize FailedCount=count() by bin(TimeGenerated, 1h) | where FailedCount >= 5

Answer

CustomAppLogs_CL | where TimeGenerated >= ago(1h) | summarize FailedCount=count() by bin(TimeGenerated, 15m) | where FailedCount >= 5

Answer

CustomAppLogs_CL | where TimeGenerated >= ago(1h) | where Status_s == 'Failed' | summarize FailedCount=count() by bin(TimeGenerated, 15m) | where FailedCount > 0

Question 3

Based on the exhibit, the security team wants an alert whenever someone changes the configuration of a storage account, such as disabling public network access. The current rule is a metric alert on transaction count. What should you use instead?

Accepted Answer

Create an activity log alert for write operations on the storage account resource.. Activity log alerts are designed to monitor Azure resource-level operations, such as write actions that modify storage account configurations. Option D is correct because it creates an alert specifically for write operations on the storage account resource, which captures events like disabling public network access. This is the appropriate method for detecting configuration changes, unlike metric alerts which track performance data.

Answer

Keep the metric alert and lower the threshold to 10 transactions.

Answer

Create a service health alert because storage account settings affect platform status.

Answer

Use a Log Analytics query alert against VM guest logs to detect network-rule changes.

Question 4

Based on the exhibit, an administrator needs to recover one deleted configuration file from a running Azure VM without replacing the VM. Which restore option should be used?

Accepted Answer

Use File Recovery to mount the recovery point and copy back the missing file.. Azure VM File Recovery (part of Azure Backup) allows you to mount a recovery point as a drive on a running VM, browse the file system, and copy specific files back without restoring the entire VM or disks. This is the only option that recovers a single deleted configuration file without replacing or rebuilding the VM.

Answer

Create a new VM from the recovery point so the deleted file returns with a clean operating system.

Answer

Restore disks and manually rebuild the VM afterward.

Answer

Replace the existing VM immediately to recover only one file.

Question 5

Based on the exhibit, the operations team says the alert is too noisy because short CPU spikes after nightly maintenance trigger notifications. They want an alert only when VM1's average CPU stays above 80% for at least 10 minutes. What should you change?

Accepted Answer

Increase the window size to 10 minutes and keep the evaluation frequency at 1 minute.. Increasing the window size to 10 minutes while keeping the evaluation frequency at 1 minute means the alert will only fire when the average CPU over the last 10 minutes exceeds 80%. This filters out transient spikes from nightly maintenance, as the alert requires sustained high CPU for the full duration. The evaluation frequency of 1 minute ensures the alert is checked every minute, but the condition is based on the 10-minute rolling average.

Answer

Lower the threshold to 70% so the alert becomes less sensitive.

Answer

Replace the metric alert with a Log Analytics query alert against the activity log.

Answer

Move the alert scope from the VM to the resource group.

Question 6

A support engineer is investigating a failed Azure VM backup job in Log Analytics. Match each KQL operator to the result it produces.

Accepted Answer

where: Filters rows based on a predicate. These are common KQL operators. 'where' filters, 'project' selects columns, 'extend' adds columns, 'summarize' aggregates, 'join' merges tables, and 'order by' sorts results.

Answer

where: Selects a subset of columns

Answer

extend: Aggregates groups of rows

Question 7

An administrator is reviewing a KQL query used to investigate failed operations in a Log Analytics workspace. Match each KQL operator to the effect it has on the query output.

Accepted Answer

where: Filters results to rows matching a specified condition. These are standard KQL operators used in Log Analytics queries. 'where' filters, 'project' selects columns, 'extend' adds computed columns, 'summarize' aggregates, 'join' merges tables, and 'order by' sorts results.

Answer

extend: Filters results to rows matching a specified condition

Answer

join: Adds computed columns to the result set

Answer

order by: Groups data and applies aggregation

Question 8

A backup administrator manages three Recovery Services vaults. They need a single place to review the latest job outcome across all vaults, and then drill into the failed job details for one VM. Which two Azure experiences should they use? Select two.

Accepted Answer

Azure Backup center. Azure Backup center provides a single, unified dashboard to monitor backup jobs across multiple Recovery Services vaults, enabling you to quickly view the latest job outcome for all protected workloads. From the Backup center, you can drill into a specific failed job for a VM by selecting it, which navigates to the detailed job view within the associated Recovery Services vault's Backup jobs blade. This combination meets the requirement for a centralized review and granular drill-down.

Answer

Azure Monitor metric chart

Answer

Azure Activity Log

Answer

Resource Health

Question 9

A production team wants to match common Azure Monitor components to the action each one performs. Match each item on the left to the best description on the right.

Accepted Answer

Log Analytics workspace: Stores log data from various sources for central querying and analysis.. Log Analytics workspace stores logs centrally; Azure Monitor Metrics handles numeric time-series data; Application Insights focuses on application performance; Activity Log tracks control plane events; Alerts send notifications; Workbooks create interactive reports.

Answer

Activity Log: Sends notifications or triggers automated actions when conditions are met.

Answer

Alerts: Tracks control plane events for subscription-level auditing.

Answer

Workbooks: Analyzes application usage and performance with detailed telemetry.

Question 10

A helpdesk engineer wants to determine whether a VM issue is caused by a Microsoft platform problem or a problem limited to one specific VM. Which two Azure features should they use? Select two.

Accepted Answer

Resource Health. Resource Health (C) provides a personalized dashboard showing the health of your individual Azure resources, including VMs, and can indicate whether an issue is specific to that resource. Service Health (D) provides a global view of Azure service availability across regions and can identify platform-wide outages or planned maintenance. Together, they allow the engineer to differentiate between a problem limited to one VM and a broader Azure platform problem.

Answer

Azure Advisor

Answer

Backup center

Answer

Log Analytics workspace

Question 11

An operations team monitors a group of Azure VMs and storage accounts. Match each Azure Monitor component to the behavior it provides in day-to-day operations.

Accepted Answer

Metrics: Collects numeric performance data from Azure resources.. Metrics give real-time performance; Logs store detailed events; Alerts trigger notifications; Workbooks visualize data; Autoscale adjusts capacity; Action Groups configure alert responses.

Answer

Action Groups: Automatically adjusts the number of instances.

Answer

Autoscale: Defines the notification preferences for alerts.

Answer

Workbooks: Stores log data for long-term retention.

Question 12

A production VM needs an email and SMS notification when CPU percentage stays above 80 percent for five minutes. Which two Azure Monitor components should the administrator configure? Select two.

Accepted Answer

Action group. A Metric alert rule monitors the VM’s CPU percentage metric and triggers when the condition (above 80% for 5 minutes) is met. An Action group defines the notification actions (email and SMS) that are executed when the alert fires. Together, they enable the required notification workflow.

Answer

Azure Policy assignment

Answer

Recovery Services vault

Answer

Log Analytics workspace

Question 13

A backup administrator is learning how Azure VM backup actions map to their purpose. Match each Recovery Services or backup item to the best description.

Accepted Answer

Recovery Services vault: Stores backup data and recovery points.. Recovery Services vault stores backups; policy defines schedule; instant snapshot allows fast restore; extension is the agent; restore point is a backup copy; cross-region restore enables DR.

Answer

Extension: Stores backup data and recovery points.

Answer

Cross-region restore: Defines the backup schedule and retention rules.

Question 14

A support engineer is narrowing a Log Analytics query to only failed backup jobs and wants to show only the needed columns. Which two KQL operators should they use? Select two.

Accepted Answer

project. The `where` operator filters rows based on a condition, so it is used to narrow results to only failed backup jobs (e.g., `where Status == "Failed"`). The `project` operator selects a subset of columns, allowing the engineer to display only the needed columns (e.g., `project JobName, Status, StartTime`). Together, they achieve both row filtering and column selection in a Kusto Query Language (KQL) query.

Answer

extend

Answer

join

Answer

summarize

Question 15

An administrator is comparing Azure monitoring data sources and destinations during an investigation. Match each item to the best operational use.

Accepted Answer

Activity Log: Tracks management events such as resource creation and deletion. Activity Log tracks management events; Metrics provide numeric performance data; Logs workspace enables cross-resource log analysis; Application Insights monitors app performance; Alerts trigger notifications; Workbooks combine data into dashboards.

Answer

Activity Log: Numeric performance data for resources

Answer

Metrics: Tracks management events such as resource creation and deletion