AZ-104 Monitor and Maintain Azure Resources Practice Test 7 — 15 Questions

Question 1

Based on the exhibit, which Azure feature should the administrator use to track this kind of platform-wide service issue?

Accepted Answer

Service Health, because it reports Azure platform incidents that affect customers in a region.. Service Health is the correct feature because it provides a personalized dashboard of all Azure service incidents, planned maintenance, and health advisories that impact the customer's subscriptions and regions. It aggregates platform-wide issues (e.g., regional outages or degradation) that Azure engineering has confirmed, making it the appropriate tool for tracking a platform-wide service issue affecting multiple resources in a region.

Answer

Resource Health, because it shows whether a specific virtual machine is healthy or unavailable.

Answer

Activity Log, because it lists every administrative action taken in the subscription.

Answer

Azure Advisor, because it gives recommendations to improve the virtual machine configuration.

Question 2

A company wants an alert to be sent by email and SMS whenever a production virtual machine's CPU percentage goes above 80 percent. The administrator also wants the notification targets to be reusable by other alerts later. What should the administrator configure first?

Accepted Answer

An action group. An action group (B) is the correct first configuration because it defines the notification targets (email, SMS) that can be reused across multiple alert rules. In Azure Monitor, alert rules are decoupled from notification actions; you create an action group once and then reference it in any metric alert rule, including the CPU percentage threshold rule needed here. This ensures the administrator can meet the requirement for reusable notification targets.

Answer

A metric alert rule only

Answer

A service health alert

Answer

A diagnostic setting

Question 3

A user deleted several files from an Azure VM, and the administrator wants to use Azure Backup file recovery. Which two items are needed to start the recovery process? Select two.

Accepted Answer

A recovery point. Azure Backup file recovery requires a recovery point (A) because it represents the snapshot of the VM's data at a specific time from which files can be restored. The file recovery script (C) is downloaded from the Recovery Services vault and mounts the recovery point as a drive on the VM, enabling file-level access. Without both, the recovery process cannot proceed.

Answer

An application security group

Answer

A metric alert rule

Answer

A user-assigned managed identity

Question 4

A company wants to enable backup for an Azure virtual machine and later restore the VM if needed. Which Azure service should the administrator use to manage the backup plan and restores?

Accepted Answer

Recovery Services vault. The Recovery Services vault is the correct Azure service for managing backup plans and restores for Azure virtual machines. It provides a centralized management interface for configuring backup policies, performing on-demand backups, and initiating restore operations to recover VMs to a specific point in time.

Answer

Azure Monitor

Answer

Log Analytics workspace

Answer

Azure Front Door

Question 5

An administrator wants to send a virtual machine's guest logs to a central workspace so they can search them later with queries. Which configuration should be created on the VM or its resource provider first?

Accepted Answer

A diagnostic setting. A diagnostic setting is the correct configuration because it enables the streaming of guest OS logs (e.g., System, Application, Security event logs) from an Azure virtual machine to a Log Analytics workspace. This is done by installing the Azure Monitor Agent (AMA) or legacy Log Analytics agent on the VM and then configuring a data collection rule or diagnostic setting to specify which logs to send and the destination workspace. Without this setting, the VM's guest logs remain local and cannot be queried centrally.

Answer

A role assignment at the subscription scope

Answer

A private endpoint

Answer

A lock on the VM resource group

Question 6

A finance VM is backed up daily. The team wants short-lived snapshots so recently changed files can be recovered quickly, but they also need daily recovery points retained for 30 days. Which two backup policy settings should be configured? Select two.

Accepted Answer

Retain instant restore snapshots for 2 days. Instant restore snapshots are short-lived, locally stored snapshots that allow quick recovery of recently changed files. Setting 'Retain instant restore snapshots for 2 days' ensures these snapshots are available for immediate restores without consuming long-term backup storage. Option B is correct because 'Retain daily recovery points for 30 days' meets the requirement for daily recovery points to be kept for the specified retention period, allowing recovery from any of the last 30 daily backups.

Answer

Run the backup job every 12 hours

Answer

Retain weekly recovery points for 30 days

Answer

Move backup data to Archive tier

Question 7

Based on the exhibit, which KQL operator should replace the blank to return only those columns?

Accepted Answer

project, because it returns only the named columns in the result.. The `project` operator in Kusto Query Language (KQL) is specifically designed to select a subset of columns from the input table, returning only the named columns in the result set. This matches the requirement to 'return only those columns,' making option C correct.

Answer

where, because it filters rows and also selects the visible columns.

Answer

summarize, because it groups the failed records into a smaller result set.

Answer

extend, because it creates new output columns for the selected fields.

Question 8

A customer wants official information about whether an Azure service issue is affecting their subscription or the wider Azure platform. Which two sources should they check? Select two.

Accepted Answer

Azure Service Health. Azure Service Health (B) provides personalized alerts and guidance when Azure service issues affect your subscription, including planned maintenance and health advisories. Azure Status (D) offers a global view of the health of all Azure services across regions, which is the official source for widespread platform issues. Together, they cover both subscription-specific and platform-wide service incidents.

Answer

Azure Advisor

Answer

Backup center

Answer

Resource Graph

Question 9

Based on the exhibit, what should the administrator configure so storage logs can be queried later with KQL?

Accepted Answer

Configure diagnostic settings to send logs to a Log Analytics workspace.. Diagnostic settings in Azure allow you to stream platform logs, including storage logs, to a Log Analytics workspace. Once the logs are in Log Analytics, you can query them using Kusto Query Language (KQL) to analyze storage operations, errors, and metrics. This is the only option that directly enables querying storage logs with KQL.

Answer

Create a backup policy for the storage account so the logs are retained automatically.

Answer

Enable a resource lock on the storage account so no logs are lost.

Answer

Turn on blob versioning so every change to the storage account is searchable.

Question 10

Based on the exhibit, where should the administrator go next to review the failed backup job details?

Accepted Answer

Jobs, because it contains the backup job status and error details.. The Jobs blade in Azure Backup is the central location for reviewing the status, progress, and detailed error messages of all backup jobs, including failed ones. It provides a filtered view of backup, restore, and other operations, allowing the administrator to drill into specific job failures to see error codes and recommended actions.

Answer

Backup policy, because it shows the retention and schedule configuration.

Answer

Backup items, because it lists protected resources and recovery points.

Answer

Properties, because it contains the general vault settings.

Question 11

A Windows VM fails shortly after startup when a custom extension runs, and the administrator cannot use RDP to inspect the machine. The goal is to see what happened during boot and confirm whether the failure occurred before the guest OS finished loading. Which two features should be used first? Select two.

Accepted Answer

Boot diagnostics. Boot diagnostics captures serial console output and screenshots of the VM during the boot process, allowing you to see if the OS failed to load before the guest OS finished. Azure Serial Console provides text-based, keyboard-focused access to the VM even when RDP is unavailable, enabling you to inspect boot logs and interact with the OS during startup. Together, they let you determine whether the custom extension failure occurred before or after the OS fully loaded.

Answer

Availability set

Answer

Managed disk snapshots

Answer

Azure Monitor autoscale

Question 12

An administrator enabled Azure VM backup yesterday and now wants to confirm whether the most recent backup job succeeded. Which two places can they check? Select two.

Accepted Answer

Recovery Services vault backup jobs. The Recovery Services vault backup jobs (Option C) is correct because it provides a dedicated view of all backup jobs associated with the vault, including status, start time, and duration. Backup Center (Option D) is correct because it offers a centralized, cross-vault, cross-region dashboard to monitor backup jobs and alerts, making it ideal for confirming the success of the most recent backup.

Answer

Activity log

Answer

Azure Advisor

Answer

Resource Graph

Question 13

A VM suddenly stops responding, and the operations team needs to determine whether the issue is caused by a Microsoft platform problem or is isolated to that specific VM. Which two Azure portal features should be reviewed? Select two.

Accepted Answer

Service Health. Service Health (A) provides a global view of Azure platform-wide issues, such as regional outages or service degradation, that could affect multiple resources. Resource Health (B) reports the health of a specific VM instance, indicating whether the VM is available, degraded, or unavailable, and whether the issue is due to a platform event or a user-initiated action. Together, these two features allow the operations team to differentiate between a Microsoft platform problem and an isolated VM issue.

Answer

Azure Advisor

Answer

Diagnostic setting

Answer

Action group

Question 14

The subscription activity log is being sent to a Log Analytics workspace. An alert must fire when any resource group is deleted, but delete operations initiated by the automation account rg-cleaner@contoso.com must be ignored. Which query should be used in the alert rule?

Accepted Answer

AzureActivity | where OperationNameValue == "Microsoft.Resources/subscriptions/resourceGroups/delete" | where ActivityStatusValue == "Succeeded" | where Caller != "rg-cleaner@contoso.com" | summarize Count = count(). It filters for the exact operation that deletes a resource group (Microsoft.Resources/subscriptions/resourceGroups/delete), ensures the deletion succeeded, and excludes the caller 'rg-cleaner@contoso.com'. This meets the requirement to fire an alert only when a resource group is deleted by any user except the automation account.

Answer

AzureActivity | where ResourceProviderValue == "Microsoft.Resources" | where OperationName contains "delete"

Answer

Heartbeat | where Computer == "rg-cleaner@contoso.com" | where TimeGenerated > ago(1d)

Answer

SecurityEvent | where EventID == 4688 | where Account == "rg-cleaner@contoso.com"

Question 15

Based on the exhibit, the security team needs 30 days of searchable log data for a storage account and wants to create queries that can be used in workbooks and alerts. The current configuration only sends data to an archive location. What should the administrator configure?

Accepted Answer

Add a Log Analytics workspace destination to the diagnostic setting.. The current diagnostic setting only archives logs to a storage account, which does not support interactive querying, workbooks, or alert rules. By adding a Log Analytics workspace destination to the same diagnostic setting, logs are sent to a centralized workspace where they become searchable via KQL, enabling real-time queries, workbook visualizations, and alert triggers. This meets the security team's requirement for 30 days of searchable log data without changing the existing archive destination.

Answer

Change the storage account redundancy to RA-GRS.

Answer

Enable a CanNotDelete lock on the storage account.

Answer

Configure a private endpoint for the storage account.