AZ-104 Monitor and Maintain Azure Resources Practice Test 9 — 15 Questions

Question 1

Match each Recovery Services vault setting or feature to the behavior an administrator should expect after changing it.

Accepted Answer

Changing replication to GRS: Replicates all existing recovery points. Changing replication to GRS replicates all existing recovery points. Soft delete retains deleted data for 14 days. Changing storage replication after backup requires reconfiguration. Custom managed identity grants specific resource access. Diagnostics settings send logs to Log Analytics. Cross Region Restore enables restore in paired region with GRS.

Answer

Cross Region Restore: Sends logs to Log Analytics

Answer

Diagnostics settings: Enables restore in paired region with GRS

Question 2

The team already exports subscription activity logs to a Log Analytics workspace and wants an alert that can ignore delete operations performed by a known automation account. What should they create?

Accepted Answer

A scheduled query alert in Log Analytics using the AzureActivity table. A scheduled query alert in Log Analytics can query the AzureActivity table to filter out delete operations performed by a specific automation account. This allows the alert to ignore those operations by excluding them in the query logic, which is not possible with activity log alerts that lack such granular filtering.

Answer

An activity log alert at the subscription scope

Answer

A metric alert on the subscription

Answer

A diagnostic setting on the resource group

Question 3

A security admin wants Key Vault audit logs and metrics sent to a Log Analytics workspace for later search. Which Azure setting should be configured on the vault?

Accepted Answer

Diagnostic settings. Diagnostic settings in Azure Key Vault allow you to stream platform logs and metrics to various destinations, including a Log Analytics workspace. By configuring diagnostic settings on the vault, you can send audit logs (e.g., AuditEvent) and metrics (e.g., ServiceApiLatency) to Log Analytics for querying with KQL, enabling security analysis and monitoring.

Answer

Azure Policy assignment

Answer

Network security group

Answer

Action group

Question 4

A file server VM is corrupted after a bad change. The team needs to recover the whole machine to the latest recovery point, not just one file. Which restore workflow should they use?

Accepted Answer

Restore virtual machine. Azure Backup's 'Restore virtual machine' workflow creates a new VM from the latest recovery point, restoring the entire machine state including OS, applications, and data. This is the appropriate method when the goal is to recover the full VM after corruption, as it uses the VM-level restore point stored in the Recovery Services vault.

Answer

File and folder recovery

Answer

Modify the backup policy

Answer

Create an action group

Question 5

A production subscription contains 20 virtual machines across two resource groups. Operations needs an email and SMS notification whenever any single VM's average Percentage CPU stays above 85 for 10 minutes. The alert should be managed as one rule, and evaluation must happen independently for each VM. What should the administrator configure?

Accepted Answer

Create one metric alert scoped to the 20 VM resources, using Percentage CPU and the shared action group.. A single metric alert rule can be scoped to multiple resources (up to 20 VMs) in Azure Monitor, allowing independent evaluation of each VM's Percentage CPU metric. When the average CPU exceeds 85% for 10 minutes on any individual VM, the alert fires and triggers the shared action group to send email and SMS notifications. This meets the requirement of one rule with per-VM independent evaluation.

Answer

Create a log query alert that uses the Heartbeat table and the existing action group.

Answer

Create one subscription-wide metric alert and average CPU across all virtual machines.

Answer

Configure diagnostic settings on each VM and use the action group for threshold processing.

Question 6

A platform team is tuning alerting for a production VM and the surrounding Azure resources. Match each Azure Monitor component to the function it performs in this design.

Accepted Answer

Azure Monitor Metrics: Collects and analyzes numerical data such as CPU and memory usage from Azure resources.. Azure Monitor Metrics handles numerical data, Logs handles log data; Application Insights is for app monitoring; Alerts notify on conditions; Workbooks and Dashboards are visualization tools.

Answer

Azure Monitor Metrics: Collects and analyzes log data such as event logs and error traces.

Answer

Application Insights: Collects and analyzes numerical data such as CPU and memory usage.

Question 7

Based on the exhibit, the operations team wants an alert that fires when any VM has not sent a heartbeat in the last 15 minutes. Which KQL query should they use as the condition for the log alert?

Accepted Answer

Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen < ago(15m). The query uses `summarize max(TimeGenerated) by Computer` to get the latest heartbeat timestamp per VM, then filters with `where LastSeen < ago(15m)` to identify VMs whose last heartbeat is older than 15 minutes. This directly matches the alert condition: any VM that has not sent a heartbeat in the last 15 minutes.

Answer

Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen > ago(15m)

Answer

Heartbeat | where TimeGenerated > ago(15m) | summarize count() by Computer | where count() == 0

Answer

Heartbeat | distinct Computer | where Computer == "VM01"

Question 8

After a bad script ran, one file at C:\Finance\Q4.xlsx was deleted from a Windows VM. The VM is still running, and the team wants only that file restored without replacing the operating system disk or restarting the VM. What should the administrator use from Azure Backup?

Accepted Answer

Perform a file-level restore from the recovery point and copy only the missing file back.. Azure Backup for Azure VMs supports file-level restore (FLR) from recovery points without requiring a full VM restore or disk replacement. This allows you to mount the recovery point as a drive on the running VM, browse the file system, and copy only the missing file (C:\Finance\Q4.xlsx) back to its original location. The VM remains online and no OS disk replacement or restart is needed.

Answer

Restore the entire VM to a new instance so the deleted file comes back automatically.

Answer

Restore the managed disks and replace the existing disks on the running VM.

Answer

Use Azure Monitor logs to reconstruct the file because the backup vault stores telemetry.

Question 9

Based on the exhibit, the team wants a single notification setup that can be reused by several alert rules across different subscriptions. What should the administrator create?

Accepted Answer

An action group. An action group is the correct choice because it is a reusable Azure Monitor resource that defines notification preferences (e.g., email, SMS, webhook, ITSM) and can be associated with multiple alert rules across different subscriptions. This allows the team to create a single notification setup once and reference it from any alert rule, ensuring consistent notification behavior without duplicating configuration.

Answer

A Log Analytics workspace with custom tables

Answer

A management group

Answer

A resource lock

Question 10

A developer deleted a single configuration file on a Windows Azure VM. The administrator wants to restore only that file from the latest backup without replacing the entire VM. Which restore workflow should be used?

Accepted Answer

Use file recovery from the backup item. Azure Backup provides file-level recovery for Azure VMs using the 'File Recovery' feature. This allows you to mount the recovery point as a drive on the VM (or another machine) and copy individual files without restoring the entire VM. It uses iSCSI to present the backup snapshot directly to the VM for granular file access.

Answer

Restore the entire VM to a new instance

Answer

Create a new storage account and copy the file from there

Answer

Enable a resource lock on the VM

Question 11

Several Azure Monitor alerts across different subscriptions must notify the same on-call group by email, SMS, and webhook whenever they fire. The operations team wants to define the notification target once and reuse it from future metric alerts, log alerts, and activity log alerts. What should be created?

Accepted Answer

An action group that can be attached to multiple Azure Monitor alert rules.. An action group in Azure Monitor is the correct solution because it defines a reusable collection of notification channels (email, SMS, webhook) that can be attached to multiple alert rules across different subscriptions. This allows the operations team to define the on-call group notification target once and reuse it for metric alerts, log alerts, and activity log alerts, ensuring consistent notification behavior.

Answer

A metric alert with the same threshold applied to every resource that needs notification.

Answer

A diagnostic setting on each resource so the contact list is stored with the logs.

Answer

A Log Analytics workbook used as the shared notification destination.

Question 12

An organization must retain Azure Key Vault audit data for 18 months, search the data in Log Analytics, and keep a second copy if the workspace retention policy is later shortened. The operations team already has an action group for notifications. What should be configured on the Key Vault?

Accepted Answer

Create a diagnostic setting that streams AuditEvent logs to Log Analytics and a storage account.. Azure Key Vault audit data is captured via the AuditEvent category in diagnostic settings. By configuring a diagnostic setting to stream AuditEvent logs to both a Log Analytics workspace (for querying and long-term retention up to 18 months) and a storage account (for a second copy independent of workspace retention policy changes), the organization meets all requirements. The existing action group is not needed for this data retention and search scenario.

Answer

Create an activity log alert and point it at the existing action group.

Answer

Create a metric alert on the Key Vault and archive the alert history.

Answer

Enable only resource metrics and rely on workspace retention for compliance.

Question 13

The operations team wants an email and SMS notification whenever any production virtual machine's average CPU stays above 85 percent for 10 minutes. They also want to reuse the same notification targets for future alerts. What should they configure?

Accepted Answer

An action group attached to a metric alert rule. An action group in Azure Monitor defines the notification targets (email, SMS, etc.) for alerts, and a metric alert rule can be configured to trigger when the average CPU percentage exceeds 85% for 10 minutes. By attaching the same action group to multiple alert rules, the operations team can reuse the notification targets for future alerts without reconfiguring them each time.

Answer

A diagnostic setting on each VM that sends metrics to a storage account

Answer

A Log Analytics query alert with no notification target

Answer

A resource lock on the virtual machines

Question 14

Based on the exhibit, a backup administrator accidentally stopped protection for a critical VM and then deleted its backup item. The team wants Azure Backup to retain the deleted item long enough to recover it after the mistake is discovered the next day. What should be enabled on the vault?

Accepted Answer

Soft delete for backup data. Soft delete for backup data is the correct answer because it provides a safety net for accidentally deleted backup items. When enabled, Azure Backup retains deleted backup data for an additional 14 days (default) in a soft-deleted state, allowing administrators to recover the data before it is permanently purged. This directly addresses the scenario where protection was stopped and the backup item was deleted, as the data remains recoverable within the retention period.

Answer

A read-only resource lock on the VM

Answer

A network security group rule allowing port 445

Answer

Instant restore snapshots set to 30 days

Question 15

A security team needs platform logs and metrics from an Azure Key Vault to be searchable later in a Log Analytics workspace so they can investigate administrative changes and access trends. What should you configure on the Key Vault?

Accepted Answer

A diagnostic setting that sends logs and metrics to the workspace. A diagnostic setting on Azure Key Vault allows you to stream platform logs (e.g., AuditEvent) and metrics (e.g., ServiceApiHit) to a Log Analytics workspace. This makes the data searchable via KQL queries for investigating administrative changes and access trends, fulfilling the security team's requirement.

Answer

Azure Monitor private link scope

Answer

An activity log alert on the subscription only

Answer

A resource lock on the Key Vault