AZ-104 Monitor and Maintain Azure Resources Practice Test 8 — 15 Questions

Question 1

A VM suffered corruption and an auditor also needs one missing file. Match each Azure Backup restore workflow to the recovery outcome it provides.

Question 2

A security analyst is reviewing deleted-resource evidence, exported diagnostics, and heartbeat data. Match each monitoring term to the best description.

Question 3

The subscription admin wants to receive an alert whenever anyone deletes a resource group, regardless of which resource type was inside it. Which alert type should be used?

Accepted Answer

An activity log alert targeting the delete resource group operation. Option C is correct because the 'Delete Resource Group' operation is an Azure Resource Manager control-plane action that is automatically logged in the Azure Activity Log. An activity log alert can be configured to fire whenever this specific operation is recorded, regardless of the resource types inside the group. This is the only alert type that directly monitors management-plane events like resource group deletion.

Answer

A metric alert on the deleted resource group's CPU

Answer

A log alert on a custom KQL query in a workspace only

Answer

A backup alert from a Recovery Services vault

Question 4

Based on the exhibit, a user deleted one file from a Windows Azure VM. The VM is still running, and the administrator wants to restore only that file instead of recovering the full machine. Which restore approach should be used?

Accepted Answer

Mount the recovery point and copy the file back to the VM.. Option B is correct because Azure VM backup allows you to mount a recovery point as a disk on another VM or the same VM, enabling file-level restore without overwriting the entire VM. This approach uses the 'File Recovery' feature of Azure Backup, which presents the recovery point as an iSCSI target that can be mounted and browsed to copy individual files back to the running VM.

Answer

Use the VM restore option and overwrite the entire VM.

Answer

Increase the VM size and redeploy the workload.

Answer

Enable a diagnostic setting on the VM and recover the file from logs.

Question 5

Based on the exhibit, a subscription activity log is already being sent to Log Analytics. The operations team wants an alert that fires when any resource group is deleted, but it should ignore deletions performed by a known automation account. Which approach should the administrator use?

Accepted Answer

Create a log alert using the AzureActivity table and filter out the automation caller.. Option B is correct because the AzureActivity table in Log Analytics captures all control-plane operations, including resource group deletions. By creating a log alert query that filters on OperationNameValue='MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/DELETE' and excludes Caller where it matches the automation account's service principal or object ID, the alert triggers only for non-automation deletions. This approach leverages the existing activity log stream to Log Analytics without additional configuration.

Answer

Create a metric alert on CPU percentage for the subscription.

Answer

Enable a diagnostic setting on the resource group object.

Answer

Apply an Azure Policy deny assignment to all deletions.

Question 6

In Log Analytics, you want an alert that fires if VM01 has not sent a Heartbeat record in the last 15 minutes. Which query should be used as the alert condition?

Accepted Answer

Heartbeat | where Computer == "VM01" | summarize LastHeartbeat = max(TimeGenerated) | where LastHeartbeat < ago(15m). Option B is correct because the alert must fire when VM01 has *not* sent a Heartbeat in the last 15 minutes. The query uses `max(TimeGenerated)` to find the most recent heartbeat, then filters with `where LastHeartbeat < ago(15m)` to detect records older than 15 minutes. This condition evaluates to true when the last heartbeat is older than the threshold, triggering the alert.

Answer

Heartbeat | where Computer == "VM01" | summarize LastHeartbeat = max(TimeGenerated) | where LastHeartbeat > ago(15m)

Answer

Heartbeat | where Computer == "VM01" and TimeGenerated > ago(15m) | summarize count() by Computer

Answer

Heartbeat | where Computer == "VM01" | summarize count() by bin(TimeGenerated, 15m)

Question 7

Based on the exhibit, a production VM must send an email and SMS notification if average CPU stays above 85% for 10 minutes. The team created the alert rule, but no one receives notifications when the condition is met. What should the administrator add to the alert rule?

Accepted Answer

Attach an action group that includes email and SMS receivers.. The alert rule is correctly configured to trigger when the average CPU exceeds 85% for 10 minutes, but notifications are not being sent because no action group is attached. An action group defines the notification channels (e.g., email, SMS, webhook) that fire when the alert is activated. Without an action group, the alert can fire silently, so the administrator must attach an action group containing the desired email and SMS receivers.

Answer

Add a diagnostic setting that sends VM metrics to a Log Analytics workspace.

Answer

Change the alert to use a log query instead of a metric condition.

Answer

Create a resource lock to prevent changes to the virtual machine.

Question 8

Match each Recovery Services vault setting or feature to the behavior an administrator should expect after changing it.

Question 9

The team already exports subscription activity logs to a Log Analytics workspace and wants an alert that can ignore delete operations performed by a known automation account. What should they create?

Accepted Answer

A scheduled query alert in Log Analytics using the AzureActivity table. Option B is correct because a scheduled query alert in Log Analytics can query the AzureActivity table to filter out delete operations performed by a specific automation account. This allows the alert to ignore those operations by excluding them in the query logic, which is not possible with activity log alerts that lack such granular filtering.

Answer

An activity log alert at the subscription scope

Answer

A metric alert on the subscription

Answer

A diagnostic setting on the resource group

Question 10

A security admin wants Key Vault audit logs and metrics sent to a Log Analytics workspace for later search. Which Azure setting should be configured on the vault?

Accepted Answer

Diagnostic settings. Diagnostic settings in Azure Key Vault allow you to stream platform logs and metrics to various destinations, including a Log Analytics workspace. By configuring diagnostic settings on the vault, you can send audit logs (e.g., AuditEvent) and metrics (e.g., ServiceApiLatency) to Log Analytics for querying with KQL, enabling security analysis and monitoring.

Answer

Azure Policy assignment

Answer

Network security group

Answer

Action group

Question 11

A file server VM is corrupted after a bad change. The team needs to recover the whole machine to the latest recovery point, not just one file. Which restore workflow should they use?

Accepted Answer

Restore virtual machine. Option A is correct because Azure Backup's 'Restore virtual machine' workflow creates a new VM from the latest recovery point, restoring the entire machine state including OS, applications, and data. This is the appropriate method when the goal is to recover the full VM after corruption, as it uses the VM-level restore point stored in the Recovery Services vault.

Answer

File and folder recovery

Answer

Modify the backup policy

Answer

Create an action group

Question 12

A production subscription contains 20 virtual machines across two resource groups. Operations needs an email and SMS notification whenever any single VM's average Percentage CPU stays above 85 for 10 minutes. The alert should be managed as one rule, and evaluation must happen independently for each VM. What should the administrator configure?

Accepted Answer

Create one metric alert scoped to the 20 VM resources, using Percentage CPU and the shared action group.. Option B is correct because a single metric alert rule can be scoped to multiple resources (up to 20 VMs) in Azure Monitor, allowing independent evaluation of each VM's Percentage CPU metric. When the average CPU exceeds 85% for 10 minutes on any individual VM, the alert fires and triggers the shared action group to send email and SMS notifications. This meets the requirement of one rule with per-VM independent evaluation.

Answer

Create a log query alert that uses the Heartbeat table and the existing action group.

Answer

Create one subscription-wide metric alert and average CPU across all virtual machines.

Answer

Configure diagnostic settings on each VM and use the action group for threshold processing.

Question 13

A platform team is tuning alerting for a production VM and the surrounding Azure resources. Match each Azure Monitor component to the function it performs in this design.

Question 14

Based on the exhibit, the operations team wants an alert that fires when any VM has not sent a heartbeat in the last 15 minutes. Which KQL query should they use as the condition for the log alert?

Accepted Answer

Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen < ago(15m). Option B is correct because the query uses `summarize max(TimeGenerated) by Computer` to get the latest heartbeat timestamp per VM, then filters with `where LastSeen < ago(15m)` to identify VMs whose last heartbeat is older than 15 minutes. This directly matches the alert condition: any VM that has not sent a heartbeat in the last 15 minutes.

Answer

Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen > ago(15m)

Answer

Heartbeat | where TimeGenerated > ago(15m) | summarize count() by Computer | where count() == 0

Answer

Heartbeat | distinct Computer | where Computer == "VM01"

Question 15

After a bad script ran, one file at C:\Finance\Q4.xlsx was deleted from a Windows VM. The VM is still running, and the team wants only that file restored without replacing the operating system disk or restarting the VM. What should the administrator use from Azure Backup?

Accepted Answer

Perform a file-level restore from the recovery point and copy only the missing file back.. Azure Backup for Azure VMs supports file-level restore (FLR) from recovery points without requiring a full VM restore or disk replacement. This allows you to mount the recovery point as a drive on the running VM, browse the file system, and copy only the missing file (C:\Finance\Q4.xlsx) back to its original location. The VM remains online and no OS disk replacement or restart is needed.

Answer

Restore the entire VM to a new instance so the deleted file comes back automatically.

Answer

Restore the managed disks and replace the existing disks on the running VM.

Answer

Use Azure Monitor logs to reconstruct the file because the backup vault stores telemetry.