AZ-104 Monitor and Maintain Azure Resources Practice Test 5 — 15 Questions

Question 1

A backup administrator is learning how Azure VM backup actions map to their purpose. Match each Recovery Services or backup item to the best description.

Question 2

A support engineer is narrowing a Log Analytics query to only failed backup jobs and wants to show only the needed columns. Which two KQL operators should they use? Select two.

Accepted Answer

project. The `where` operator filters rows based on a condition, so it is used to narrow results to only failed backup jobs (e.g., `where Status == "Failed"`). The `project` operator selects a subset of columns, allowing the engineer to display only the needed columns (e.g., `project JobName, Status, StartTime`). Together, they achieve both row filtering and column selection in a Kusto Query Language (KQL) query.

Answer

extend

Answer

join

Answer

summarize

Question 3

An administrator is comparing Azure monitoring data sources and destinations during an investigation. Match each item to the best operational use.

Question 4

A production Azure VM farm runs customer-facing APIs. Operations wants an automatic notification when the average Percentage CPU on any VM stays above 85 percent for 10 minutes, and the notification must reach both email and SMS recipients. Which two Azure Monitor items must be configured? Select two.

Accepted Answer

Metric alert rule. A Metric alert rule is correct because it monitors the 'Percentage CPU' metric on Azure VMs and can trigger when the average value exceeds 85% for a duration of 10 minutes. This rule evaluates the metric over a specified time window and fires an alert based on the threshold condition, meeting the requirement for automatic notification based on performance metrics.

Answer

Diagnostic setting

Answer

Workbook

Answer

Service health alert

Question 5

Based on the exhibit, which restore option should the administrator choose?

Accepted Answer

File recovery, because it restores individual files or folders from the VM backup.. File recovery is the correct option because the administrator needs to restore a specific deleted file from a VM backup without restoring the entire VM. Azure Backup's file-level recovery allows mounting the backup as a drive (via iSCSI) to browse and copy individual files or folders, which directly addresses the requirement.

Answer

Recreate VM, because it restores the entire virtual machine from the backup point.

Answer

Backup policy, because it defines which files are included in the restore operation.

Answer

Recovery point, because it is the portal action used to mount a deleted file directly.

Question 6

A team wants daily Azure VM backups with a 30-day retention period. Which two settings are configured in the backup policy? Select two.

Accepted Answer

Backup schedule. Option A is correct because a backup policy for Azure VM backups must include a backup schedule that defines when the backup job runs (e.g., daily at a specific time). This schedule triggers the Azure Backup service to create recovery points for the VM. Without a schedule, the backup policy cannot automate the creation of backups.

Answer

Log Analytics workspace

Answer

Private endpoint

Answer

Metric alert threshold

Question 7

An application depends on a regional Azure service. Operations wants an automatic notification if Microsoft posts an incident that affects only the region where the app runs, even when the individual VMs remain healthy. Which two Azure Monitor capabilities should be configured? Select two.

Accepted Answer

Service health alert. A Service health alert is correct because it monitors for service incidents, maintenance, and health advisories published by Azure for a specific region or service. When Microsoft posts an incident affecting only the region where the application runs, the alert triggers automatically, even if individual VMs remain healthy. This meets the requirement for automatic notification of regional Azure service incidents.

Answer

Metric alert rule

Answer

Log Analytics query

Answer

Resource lock

Question 8

Based on the exhibit, what should the administrator add to send an email and SMS notification?

Accepted Answer

An action group with email and SMS receivers.. To send email and SMS notifications from an Azure Monitor alert, you must configure an action group. An action group defines the notification channels (e.g., email, SMS, webhook) and their respective receivers. When the alert rule triggers, Azure Monitor invokes the action group to deliver the notifications. Without an action group, the alert rule has no mechanism to send email or SMS.

Answer

A Log Analytics workspace connected to the virtual machine.

Answer

A backup recovery point for the virtual machine.

Answer

A private endpoint for the virtual machine.

Question 9

Based on the exhibit, which policy best matches the requirement for daily backups retained for 30 days?

Accepted Answer

A policy with daily backups retained for 30 days.. Option B is correct because the requirement explicitly states 'daily backups retained for 30 days.' A backup policy in Azure Backup allows you to define the frequency (daily) and retention duration (30 days) for recovery points. This policy directly matches the requirement without over-retention or under-retention.

Answer

A policy with daily backups retained for 7 days.

Answer

A policy with weekly backups retained for 30 days.

Answer

A policy with daily backups retained for 365 days.

Question 10

A user deleted a file from an Azure VM, and the administrator wants to use Azure Backup file-level recovery rather than restore the whole VM. Which two prerequisites are required before mounting the recovery point from the portal? Select two.

Accepted Answer

Download the vault credentials file. Option A is correct because vault credentials are required to authenticate the portal session to the Recovery Services vault when performing file-level recovery. Option B is correct because you must select a specific recovery point (snapshot) from which to mount the files; the portal uses this point to create an iSCSI target on the VM.

Answer

Provide the storage account access key

Answer

Assign a public IP address to the VM

Answer

Create an Azure AD application secret

Question 11

After enabling Azure VM backup, an administrator wants to confirm whether the nightly backup succeeded. Where should the administrator check the backup status?

Accepted Answer

In the Recovery Services vault backup jobs. The correct place to check backup status is the Recovery Services vault backup jobs. When Azure VM backup is enabled, each backup operation creates a job entry in the associated Recovery Services vault. The 'Backup Jobs' blade within the vault lists all backup jobs, their status (e.g., Completed, Failed, In Progress), and details like start time and error messages. This is the centralized monitoring point for backup operations, as defined by Azure Backup's job-based monitoring model.

Answer

In the VM's network security group

Answer

In the VM's availability set

Answer

In the subscription activity log only

Question 12

A team wants to keep Azure platform logs for a storage account in a central location and analyze them with queries. The logs should be queryable together with other Azure resource logs. What destination should the administrator choose for the diagnostic setting?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the correct destination because it allows you to collect Azure platform logs (such as resource logs, activity logs, and metrics) from multiple resources into a central location. These logs can then be queried together using Kusto Query Language (KQL) across different resource types, enabling cross-resource analysis and correlation. This meets the requirement for queryable logs alongside other Azure resource logs.

Answer

A storage account only

Answer

An action group

Answer

A management group

Question 13

A response team is designing notification paths for Azure Monitor alerts. Match each action group receiver or action to the outcome it provides.

Question 14

A support engineer needs to search a Log Analytics workspace for only failed sign-in records. Which KQL query should they use?

Accepted Answer

SigninLogs | where ResultType != 0. Option B is correct because in Azure AD sign-in logs, a `ResultType` of 0 indicates a successful sign-in, while any non-zero value (e.g., 50125, 53003) indicates a failure. The KQL query `SigninLogs | where ResultType != 0` filters for all records where the result type is not zero, thus returning only failed sign-in records.

Answer

SigninLogs | where ResultType == 0

Answer

SigninLogs | summarize count()

Answer

SigninLogs | project UserPrincipalName

Question 15

Based on the exhibit, what should the administrator configure so the alert sends email and SMS when CPU stays above the threshold?

Accepted Answer

Associate an Azure Monitor action group with the alert rule.. An Azure Monitor action group defines the notification channels (e.g., email, SMS) and actions to trigger when an alert fires. Associating an action group with the alert rule enables the administrator to send both email and SMS when the CPU threshold is breached. Without an action group, the alert rule can only log the condition but cannot deliver notifications.

Answer

Create a diagnostic setting on the virtual machine and send metrics to a Log Analytics workspace.

Answer

Enable boot diagnostics on the virtual machine so the CPU threshold can be reported.

Answer

Apply a resource lock to the virtual machine to prevent the CPU from increasing further.