AZ-104 Monitor and Maintain Azure Resources Practice Test 8 — 15 Questions

Question 1

Which two settings can you configure in an Azure Backup policy for a virtual machine? Select two.

Accepted Answer

Backup schedule. An Azure Backup policy for a virtual machine includes a 'Backup schedule' setting that defines how often (e.g., daily or weekly) and at what time the backup job runs. This schedule controls the frequency of recovery point creation, which is essential for meeting recovery point objectives (RPOs).

Answer

Virtual network peering

Answer

Network security group rules

Answer

Public IP allocation

Question 2

A storage account hosts application logs that security wants to search in Log Analytics for 30 days and keep in a separate retained copy for one year. They also want to monitor storage metrics in the same place for troubleshooting. What should be configured on the storage account?

Accepted Answer

Create a diagnostic setting that sends the storage resource logs and AllMetrics to Log Analytics and a storage account.. A diagnostic setting on a storage account can send both resource logs (e.g., StorageRead, StorageWrite) and AllMetrics (e.g., transactions, ingress) to a Log Analytics workspace for querying and to a secondary storage account for long-term retention. This meets the requirement to search logs for 30 days in Log Analytics (which has its own retention setting) and keep a separate archived copy for one year in the storage account.

Answer

Enable only the activity log export because it already includes all storage telemetry.

Answer

Create an action group that archives storage events and forwards them to investigators.

Answer

Create a metric alert on the storage account and use it as the retention mechanism.

Question 3

An operations lead must choose the right Azure Monitor target for each requirement. Match each requirement to the Azure component that best satisfies it.

Accepted Answer

Metrics Explorer: Shows real-time metrics. Metrics Explorer shows real-time metrics; Action Groups define notification actions; Log Analytics Workspace stores and queries logs; Alert Rules define conditions; Workbooks provide visualizations.

Answer

Log Analytics Workspace: Provides visualizations

Answer

Workbooks: Stores and queries logs

Question 4

A subscription admin wants to investigate who changed a resource and also review the platform-generated events for that subscription. Which two types of logs can be sent to Log Analytics and queried later? Select two.

Accepted Answer

Activity log entries. The Activity log (option A) records subscription-level events such as who created, modified, or deleted a resource, making it essential for investigating administrative changes. Resource diagnostic logs (option B) capture platform-generated events emitted by a resource itself (e.g., Azure SQL Database audit logs, network security group flow logs), which can be sent to Log Analytics for querying. Both log types can be configured to stream to a Log Analytics workspace, enabling Kusto Query Language (KQL) analysis.

Answer

Azure Backup vault names

Answer

Virtual network address spaces

Answer

Managed disk size settings

Question 5

A user deleted a single document from a backed-up Windows VM. Which two Azure Backup actions are appropriate if only that file must be recovered? Select two.

Accepted Answer

Use file recovery from the backup point. Azure Backup provides file-level recovery for Windows VMs via the 'File Recovery' option in the Recovery Services vault. This allows you to mount the recovery point as a drive on the VM (using iSCSI) and directly copy the deleted file back to its original location without restoring the entire VM. Option B is also correct because mounting the recovery point (via the same file recovery process) and copying the file back is the exact mechanism used; the two options describe the same action from different perspectives.

Answer

Recreate the VM in another region

Answer

Change the VM size

Answer

Disable the backup policy

Question 6

Which two statements about a Log Analytics workspace are correct? Select two.

Accepted Answer

It can store logs collected from Azure resources. A Log Analytics workspace is a centralized repository that can ingest and store log data from various Azure resources, including virtual machines, Azure Activity logs, and resource diagnostics, enabling monitoring and analysis. Option B is correct because Log Analytics workspaces support Kusto Query Language (KQL) queries, which allow users to perform complex searches, aggregations, and visualizations on the stored log data.

Answer

It creates backups of Azure virtual machines

Answer

It assigns permissions to Azure resources at scope

Answer

It blocks resource creation that violates a rule

Question 7

During a compliance review, the team must distinguish what each Azure Monitor object can and cannot do. Match each object to its primary operational scope.

Accepted Answer

Metrics: Collects numeric time-series data for performance and health.. Metrics collect numeric time-series data; Logs collect text logs for querying; Application Insights monitors web apps; Activity Log records subscription events; Diagnostic Logs capture resource logs; Service Health provides service incident info.

Answer

Activity Log: Captures resource-level logs from Azure resources.

Answer

Diagnostic Logs: Records subscription-level events and operations.

Answer

Service Health: Monitors web applications and provides diagnostics.

Question 8

Which two statements about Azure Backup soft delete are correct? Select two.

Accepted Answer

Deleted backup data is retained for a grace period. Azure Backup soft delete ensures that deleted backup data is not immediately purged but retained for a default grace period of 14 days. This allows recovery of accidentally deleted backup items, such as Recovery Services vault backup data, without data loss. Option A is correct because the grace period is a core feature of soft delete.

Answer

It permanently deletes backups immediately

Answer

It changes the VM to a different availability zone

Answer

It only applies to Azure Policy assignments

Question 9

A VM suffered corruption and an auditor also needs one missing file. Match each Azure Backup restore workflow to the recovery outcome it provides.

Accepted Answer

Restore VM: Creates a new VM. Azure Backup restore workflows: 'Restore VM' creates a new VM, 'Restore files' recovers individual files, 'Restore as unmanaged/managed disks' recovers disks, 'Replace existing VM' overwrites the original, and 'Cross-region restore' restores to another region.

Answer

Restore VM: Recovers individual files

Answer

Restore files: Overwrites the original VM

Question 10

A security analyst is reviewing deleted-resource evidence, exported diagnostics, and heartbeat data. Match each monitoring term to the best description.

Accepted Answer

Activity Log: Records control-plane operations like creating or deleting resources.. The monitoring terms relate to Azure Monitor data sources. Deleted-resource evidence comes from activity logs, exported diagnostics are resource logs sent elsewhere, heartbeat data indicates agent health, and the other terms are standard Azure Monitor components.

Answer

Metrics: Rules that trigger actions based on conditions.

Answer

Alerts: Numerical values collected at regular intervals from resources.

Question 11

The subscription admin wants to receive an alert whenever anyone deletes a resource group, regardless of which resource type was inside it. Which alert type should be used?

Accepted Answer

An activity log alert targeting the delete resource group operation. The 'Delete Resource Group' operation is an Azure Resource Manager control-plane action that is automatically logged in the Azure Activity Log. An activity log alert can be configured to fire whenever this specific operation is recorded, regardless of the resource types inside the group. This is the only alert type that directly monitors management-plane events like resource group deletion.

Answer

A metric alert on the deleted resource group's CPU

Answer

A log alert on a custom KQL query in a workspace only

Answer

A backup alert from a Recovery Services vault

Question 12

Based on the exhibit, a user deleted one file from a Windows Azure VM. The VM is still running, and the administrator wants to restore only that file instead of recovering the full machine. Which restore approach should be used?

Accepted Answer

Mount the recovery point and copy the file back to the VM.. Azure VM backup allows you to mount a recovery point as a disk on another VM or the same VM, enabling file-level restore without overwriting the entire VM. This approach uses the 'File Recovery' feature of Azure Backup, which presents the recovery point as an iSCSI target that can be mounted and browsed to copy individual files back to the running VM.

Answer

Use the VM restore option and overwrite the entire VM.

Answer

Increase the VM size and redeploy the workload.

Answer

Enable a diagnostic setting on the VM and recover the file from logs.

Question 13

Based on the exhibit, a subscription activity log is already being sent to Log Analytics. The operations team wants an alert that fires when any resource group is deleted, but it should ignore deletions performed by a known automation account. Which approach should the administrator use?

Accepted Answer

Create a log alert using the AzureActivity table and filter out the automation caller.. The AzureActivity table in Log Analytics captures all control-plane operations, including resource group deletions. By creating a log alert query that filters on OperationNameValue='MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/DELETE' and excludes Caller where it matches the automation account's service principal or object ID, the alert triggers only for non-automation deletions. This approach leverages the existing activity log stream to Log Analytics without additional configuration.

Answer

Create a metric alert on CPU percentage for the subscription.

Answer

Enable a diagnostic setting on the resource group object.

Answer

Apply an Azure Policy deny assignment to all deletions.

Question 14

In Log Analytics, you want an alert that fires if VM01 has not sent a Heartbeat record in the last 15 minutes. Which query should be used as the alert condition?

Accepted Answer

Heartbeat | where Computer == "VM01" | summarize LastHeartbeat = max(TimeGenerated) | where LastHeartbeat < ago(15m). The alert must fire when VM01 has *not* sent a Heartbeat in the last 15 minutes. The query uses `max(TimeGenerated)` to find the most recent heartbeat, then filters with `where LastHeartbeat < ago(15m)` to detect records older than 15 minutes. This condition evaluates to true when the last heartbeat is older than the threshold, triggering the alert.

Answer

Heartbeat | where Computer == "VM01" | summarize LastHeartbeat = max(TimeGenerated) | where LastHeartbeat > ago(15m)

Answer

Heartbeat | where Computer == "VM01" and TimeGenerated > ago(15m) | summarize count() by Computer

Answer

Heartbeat | where Computer == "VM01" | summarize count() by bin(TimeGenerated, 15m)

Question 15

Based on the exhibit, a production VM must send an email and SMS notification if average CPU stays above 85% for 10 minutes. The team created the alert rule, but no one receives notifications when the condition is met. What should the administrator add to the alert rule?

Accepted Answer

Attach an action group that includes email and SMS receivers.. The alert rule is correctly configured to trigger when the average CPU exceeds 85% for 10 minutes, but notifications are not being sent because no action group is attached. An action group defines the notification channels (e.g., email, SMS, webhook) that fire when the alert is activated. Without an action group, the alert can fire silently, so the administrator must attach an action group containing the desired email and SMS receivers.

Answer

Add a diagnostic setting that sends VM metrics to a Log Analytics workspace.

Answer

Change the alert to use a log query instead of a metric condition.

Answer

Create a resource lock to prevent changes to the virtual machine.