AZ-104 Monitor and Maintain Azure Resources Practice Test 6 — 15 Questions

Question 1

A production Azure VM farm runs customer-facing APIs. Operations wants an automatic notification when the average Percentage CPU on any VM stays above 85 percent for 10 minutes, and the notification must reach both email and SMS recipients. Which two Azure Monitor items must be configured? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Metric alert rule. A Metric alert rule is correct because it monitors the 'Percentage CPU' metric on Azure VMs and can trigger when the average value exceeds 85% for a duration of 10 minutes. This rule evaluates the metric over a specified time window and fires an alert based on the threshold condition, meeting the requirement for automatic notification based on performance metrics.

Answer

Diagnostic setting

Answer

Workbook

Answer

Service health alert

Question 2

Based on the exhibit, which restore option should the administrator choose?

Accepted Answer

File recovery, because it restores individual files or folders from the VM backup.. File recovery is the correct option because the administrator needs to restore a specific deleted file from a VM backup without restoring the entire VM. Azure Backup's file-level recovery allows mounting the backup as a drive (via iSCSI) to browse and copy individual files or folders, which directly addresses the requirement.

Answer

Recreate VM, because it restores the entire virtual machine from the backup point.

Answer

Backup policy, because it defines which files are included in the restore operation.

Answer

Recovery point, because it is the portal action used to mount a deleted file directly.

Question 3

Based on the exhibit, what should the administrator add to send an email and SMS notification?

Accepted Answer

An action group with email and SMS receivers.. To send email and SMS notifications from an Azure Monitor alert, you must configure an action group. An action group defines the notification channels (e.g., email, SMS, webhook) and their respective receivers. When the alert rule triggers, Azure Monitor invokes the action group to deliver the notifications. Without an action group, the alert rule has no mechanism to send email or SMS.

Answer

A Log Analytics workspace connected to the virtual machine.

Answer

A backup recovery point for the virtual machine.

Answer

A private endpoint for the virtual machine.

Question 4

A user deleted a file from an Azure VM, and the administrator wants to use Azure Backup file-level recovery rather than restore the whole VM. Which two prerequisites are required before mounting the recovery point from the portal? Select two.

Accepted Answer

Download the vault credentials file. Vault credentials are required to authenticate the portal session to the Recovery Services vault when performing file-level recovery. Option B is correct because you must select a specific recovery point (snapshot) from which to mount the files; the portal uses this point to create an iSCSI target on the VM.

Answer

Provide the storage account access key

Answer

Assign a public IP address to the VM

Answer

Create an Azure AD application secret

Question 5

After enabling Azure VM backup, an administrator wants to confirm whether the nightly backup succeeded. Where should the administrator check the backup status?

Accepted Answer

In the Recovery Services vault backup jobs. The correct place to check backup status is the Recovery Services vault backup jobs. When Azure VM backup is enabled, each backup operation creates a job entry in the associated Recovery Services vault. The 'Backup Jobs' blade within the vault lists all backup jobs, their status (e.g., Completed, Failed, In Progress), and details like start time and error messages. This is the centralized monitoring point for backup operations, as defined by Azure Backup's job-based monitoring model.

Answer

In the VM's network security group

Answer

In the VM's availability set

Answer

In the subscription activity log only

Question 6

A team wants to keep Azure platform logs for a storage account in a central location and analyze them with queries. The logs should be queryable together with other Azure resource logs. What destination should the administrator choose for the diagnostic setting?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the correct destination because it allows you to collect Azure platform logs (such as resource logs, activity logs, and metrics) from multiple resources into a central location. These logs can then be queried together using Kusto Query Language (KQL) across different resource types, enabling cross-resource analysis and correlation. This meets the requirement for queryable logs alongside other Azure resource logs.

Answer

A storage account only

Answer

An action group

Answer

A management group

Question 7

A response team is designing notification paths for Azure Monitor alerts. Match each action group receiver or action to the outcome it provides.

Accepted Answer

Email: Sends email notifications to specified recipients.. Email/SMS/Push/Voice are direct notifications; ITSM connector creates tickets; Automation runbook runs scripts; Webhook sends to external services like Teams; Push notifications target mobile apps.

Answer

Automation runbook: Sends HTTP POST to an external service endpoint.

Answer

Webhook: Runs a script in Azure Automation.

Question 8

A support engineer needs to search a Log Analytics workspace for only failed sign-in records. Which KQL query should they use?

Accepted Answer

SigninLogs | where ResultType != 0. In Azure AD sign-in logs, a `ResultType` of 0 indicates a successful sign-in, while any non-zero value (e.g., 50125, 53003) indicates a failure. The KQL query `SigninLogs | where ResultType != 0` filters for all records where the result type is not zero, thus returning only failed sign-in records.

Answer

SigninLogs | where ResultType == 0

Answer

SigninLogs | summarize count()

Answer

SigninLogs | project UserPrincipalName

Question 9

Based on the exhibit, what should the administrator configure so the alert sends email and SMS when CPU stays above the threshold?

Accepted Answer

Associate an Azure Monitor action group with the alert rule.. An Azure Monitor action group defines the notification channels (e.g., email, SMS) and actions to trigger when an alert fires. Associating an action group with the alert rule enables the administrator to send both email and SMS when the CPU threshold is breached. Without an action group, the alert rule can only log the condition but cannot deliver notifications.

Answer

Create a diagnostic setting on the virtual machine and send metrics to a Log Analytics workspace.

Answer

Enable boot diagnostics on the virtual machine so the CPU threshold can be reported.

Answer

Apply a resource lock to the virtual machine to prevent the CPU from increasing further.

Question 10

The Azure portal shows that a storage service in the region is experiencing an outage that affects several Microsoft customers. The administrator wants to view official Azure status updates for that issue. Which Azure Monitor feature should be used?

Accepted Answer

Service Health. Service Health is the correct Azure Monitor feature because it provides a personalized view of the health of Azure services, regions, and resources, including real-time and historical information about service-impacting events such as outages. It also surfaces official root cause analyses and planned maintenance, making it the appropriate tool for an administrator to view official Azure status updates for a regional outage affecting multiple customers.

Answer

Activity log

Answer

Azure Advisor

Answer

Metrics explorer

Question 11

A team is choosing the right Azure Monitor alert type for different operational signals. Match each alert type to the situation it is best suited for.

Accepted Answer

Metric alerts: Monitor numeric values. Metric alerts monitor numeric values; Activity log alerts on resource changes; Log alerts query log data; Smart detection finds anomalies; Resource health alerts on resource status; Service health alerts on Azure service issues.

Answer

Metric alerts: Track resource changes

Answer

Activity log alerts: Monitor numeric values

Question 12

A storage account's platform logs must be searchable later with KQL in a central workspace. Which two actions should the administrator take? Select two.

Accepted Answer

Create a diagnostic setting on the storage account. A diagnostic setting on the storage account is required to route platform logs (e.g., storage read/write/delete operations) to a destination. Option C is correct because a Log Analytics workspace is the destination that enables KQL-based searching and analysis of those logs. Without both, the logs cannot be stored in a central, queryable repository.

Answer

Configure a NAT gateway on the storage subnet

Answer

Assign the Reader role on the subscription

Answer

Enable a VM backup policy

Question 13

A backup engineer is reviewing policy-related settings in a Recovery Services vault. Match each backup setting to the behavior it controls.

Accepted Answer

Backup frequency: How often backups are performed (e.g., daily, weekly).. Backup frequency sets how often; retention range sets how long; snapshot retention keeps local copy; schedule sets time; tier defines storage type; alerts notify on issues.

Answer

Backup frequency: How long backups are retained.

Answer

Snapshot retention: How often backups are taken.

Question 14

A user accidentally deleted a file from an Azure VM. The administrator wants to recover only the deleted file from the most recent backup instead of restoring the entire VM. What should the administrator use?

Accepted Answer

File recovery from the Azure Backup restore process. Azure Backup's file-level recovery (also known as item-level restore) allows you to recover individual files or folders from a VM backup point without restoring the entire VM. This is achieved by mounting the recovery point as a drive on the same or another VM, enabling direct file copy. Option A is correct because this feature is specifically designed for granular recovery of deleted files from the most recent backup.

Answer

A new VM image

Answer

A metric alert

Answer

An NSG flow log

Question 15

A backup operations team exports Recovery Services vault logs to Log Analytics. They need a query that returns only failed backup jobs from the last 24 hours and displays just the vault name, protected item name, and error description. Which two KQL operators should the query include? Select two.

Accepted Answer

where. The `where` operator filters the Log Analytics data to include only rows where the backup job status equals 'Failed' and the timestamp falls within the last 24 hours. This is essential for narrowing down the dataset to the specific failed jobs the team needs.

Answer

summarize

Answer

join

Answer

extend