AZ-104 Monitor and Maintain Azure Resources Practice Test 9 — 15 Questions

Question 1

Based on the exhibit, the team wants a single notification setup that can be reused by several alert rules across different subscriptions. What should the administrator create?

Accepted Answer

An action group. An action group is the correct choice because it is a reusable Azure Monitor resource that defines notification preferences (e.g., email, SMS, webhook, ITSM) and can be associated with multiple alert rules across different subscriptions. This allows the team to create a single notification setup once and reference it from any alert rule, ensuring consistent notification behavior without duplicating configuration.

Answer

A Log Analytics workspace with custom tables

Answer

A management group

Answer

A resource lock

Question 2

A developer deleted a single configuration file on a Windows Azure VM. The administrator wants to restore only that file from the latest backup without replacing the entire VM. Which restore workflow should be used?

Accepted Answer

Use file recovery from the backup item. Option B is correct because Azure Backup provides file-level recovery for Azure VMs using the 'File Recovery' feature. This allows you to mount the recovery point as a drive on the VM (or another machine) and copy individual files without restoring the entire VM. It uses iSCSI to present the backup snapshot directly to the VM for granular file access.

Answer

Restore the entire VM to a new instance

Answer

Create a new storage account and copy the file from there

Answer

Enable a resource lock on the VM

Question 3

Several Azure Monitor alerts across different subscriptions must notify the same on-call group by email, SMS, and webhook whenever they fire. The operations team wants to define the notification target once and reuse it from future metric alerts, log alerts, and activity log alerts. What should be created?

Accepted Answer

An action group that can be attached to multiple Azure Monitor alert rules.. An action group in Azure Monitor is the correct solution because it defines a reusable collection of notification channels (email, SMS, webhook) that can be attached to multiple alert rules across different subscriptions. This allows the operations team to define the on-call group notification target once and reuse it for metric alerts, log alerts, and activity log alerts, ensuring consistent notification behavior.

Answer

A metric alert with the same threshold applied to every resource that needs notification.

Answer

A diagnostic setting on each resource so the contact list is stored with the logs.

Answer

A Log Analytics workbook used as the shared notification destination.

Question 4

An organization must retain Azure Key Vault audit data for 18 months, search the data in Log Analytics, and keep a second copy if the workspace retention policy is later shortened. The operations team already has an action group for notifications. What should be configured on the Key Vault?

Accepted Answer

Create a diagnostic setting that streams AuditEvent logs to Log Analytics and a storage account.. Option B is correct because Azure Key Vault audit data is captured via the AuditEvent category in diagnostic settings. By configuring a diagnostic setting to stream AuditEvent logs to both a Log Analytics workspace (for querying and long-term retention up to 18 months) and a storage account (for a second copy independent of workspace retention policy changes), the organization meets all requirements. The existing action group is not needed for this data retention and search scenario.

Answer

Create an activity log alert and point it at the existing action group.

Answer

Create a metric alert on the Key Vault and archive the alert history.

Answer

Enable only resource metrics and rely on workspace retention for compliance.

Question 5

The operations team wants an email and SMS notification whenever any production virtual machine's average CPU stays above 85 percent for 10 minutes. They also want to reuse the same notification targets for future alerts. What should they configure?

Accepted Answer

An action group attached to a metric alert rule. Option B is correct because an action group in Azure Monitor defines the notification targets (email, SMS, etc.) for alerts, and a metric alert rule can be configured to trigger when the average CPU percentage exceeds 85% for 10 minutes. By attaching the same action group to multiple alert rules, the operations team can reuse the notification targets for future alerts without reconfiguring them each time.

Answer

A diagnostic setting on each VM that sends metrics to a storage account

Answer

A Log Analytics query alert with no notification target

Answer

A resource lock on the virtual machines

Question 6

Based on the exhibit, a backup administrator accidentally stopped protection for a critical VM and then deleted its backup item. The team wants Azure Backup to retain the deleted item long enough to recover it after the mistake is discovered the next day. What should be enabled on the vault?

Accepted Answer

Soft delete for backup data. Soft delete for backup data is the correct answer because it provides a safety net for accidentally deleted backup items. When enabled, Azure Backup retains deleted backup data for an additional 14 days (default) in a soft-deleted state, allowing administrators to recover the data before it is permanently purged. This directly addresses the scenario where protection was stopped and the backup item was deleted, as the data remains recoverable within the retention period.

Answer

A read-only resource lock on the VM

Answer

A network security group rule allowing port 445

Answer

Instant restore snapshots set to 30 days

Question 7

A security team needs platform logs and metrics from an Azure Key Vault to be searchable later in a Log Analytics workspace so they can investigate administrative changes and access trends. What should you configure on the Key Vault?

Accepted Answer

A diagnostic setting that sends logs and metrics to the workspace. A diagnostic setting on Azure Key Vault allows you to stream platform logs (e.g., AuditEvent) and metrics (e.g., ServiceApiHit) to a Log Analytics workspace. This makes the data searchable via KQL queries for investigating administrative changes and access trends, fulfilling the security team's requirement.

Answer

Azure Monitor private link scope

Answer

An activity log alert on the subscription only

Answer

A resource lock on the Key Vault

Question 8

A VM backup policy is being designed in a Recovery Services vault. Match each backup policy element to the behavior it controls.

Question 9

The team accidentally stopped protection for a VM and deleted its backup data. They want Azure Backup to keep deleted backup items recoverable for a grace period so the item can be undeleted if needed. Which vault feature should be enabled?

Accepted Answer

Soft delete. Soft delete is the correct feature because it provides a grace period (default 14 days) during which deleted backup data is retained in a soft-deleted state. This allows administrators to recover (undelete) backup items that were accidentally deleted, including cases where protection was stopped and data was removed. Without soft delete, deleted backup data is permanently purged and cannot be recovered.

Answer

Instant restore

Answer

A new backup policy

Answer

A private endpoint for the vault

Question 10

A security team wants platform logs from a storage account sent for long-term retention and later analysis. Which three destinations can an Azure diagnostic setting send data to? Select three.

Accepted Answer

A Log Analytics workspace. Azure Diagnostic Settings can stream platform logs and metrics to three destinations: a Log Analytics workspace for query-based analysis, a storage account for archival and long-term retention, and an Event Hub for real-time ingestion into SIEM or third-party tools. This is defined in the Azure Monitor diagnostic settings configuration, which supports these three outputs natively.

Answer

A Recovery Services vault

Answer

An availability zone

Question 11

An administrator accidentally stopped protection for a critical VM and then deleted its backup item. The mistake was discovered a day later, and the organization wants deleted backup data to remain recoverable for a grace period. Which feature should be enabled on the Recovery Services vault?

Accepted Answer

Soft delete on the Recovery Services vault.. Soft delete on the Recovery Services vault provides a grace period (default 14 days) during which deleted backup data is retained in a soft-deleted state, allowing recovery even after a backup item is deleted. This feature is specifically designed to protect against accidental deletion, as it prevents permanent removal of backup data until the soft-delete period expires or is manually purged.

Answer

An action group attached to the vault alerts.

Answer

Diagnostic settings that export vault events to Log Analytics.

Answer

Cross-region restore for the vault.

Question 12

A VM was corrupted and the team wants to recover it from Azure Backup without using the original damaged disks. Which two restore targets are supported? Select two.

Accepted Answer

Create a new virtual machine. Option A is correct because Azure Backup supports restoring a VM to a new virtual machine directly from the recovery point, which creates a new VM with the same configuration and data without using the original damaged disks. This is a common restore workflow when the original VM is corrupted or inaccessible.

Answer

Change the subscription automatically

Answer

Replace the Recovery Services vault name

Answer

Rebuild the virtual network

Question 13

A VM named VM01 stopped sending Heartbeat records to Log Analytics 15 minutes ago. Which KQL query should you run to confirm the VM's recent heartbeat entries?

Accepted Answer

Heartbeat | where Computer == "VM01" and TimeGenerated > ago(15m). The Heartbeat table in Log Analytics stores records sent by the Azure Monitor Agent (AMA) or Log Analytics agent every 5 minutes by default. Querying Heartbeat with a filter for Computer == 'VM01' and TimeGenerated > ago(15m) directly checks if any heartbeat records were generated in the last 15 minutes, confirming whether the VM is still reporting. This is the correct approach because Heartbeat is the dedicated table for agent health, and the time filter matches the 15-minute window specified in the question.

Answer

AzureActivity | where ResourceProviderValue == "Microsoft.Compute/virtualMachines"

Answer

Heartbeat | summarize count() by Computer

Answer

Perf | where CounterName == "% Processor Time"

Question 14

A virtual machine is already protected by Azure Backup. The business wants the VM backed up every day at 11:00 PM and wants daily recovery points retained for 30 days, without re-onboarding the VM. What should the administrator modify?

Accepted Answer

Modify the backup policy associated with the protected VM. Option B is correct because Azure Backup uses backup policies to define the backup schedule and retention rules for protected resources. By modifying the existing policy associated with the VM, you can change the backup time to 11:00 PM and set daily recovery point retention to 30 days without needing to re-onboard the VM or create a new vault.

Answer

Create a new Recovery Services vault and re-register the VM

Answer

Install a new VM extension to change retention behavior

Answer

Take a manual snapshot of the VM disk every night

Question 15

A virtual machine is already protected by Azure Backup. The current policy runs daily at 23:00 and keeps daily recovery points for 30 days. The business now wants the same schedule but wants new daily recovery points retained for 90 days. No new vault or re-registration should occur. What should the administrator do?

Accepted Answer

Edit the existing backup policy and change the daily retention for future recovery points.. Option B is correct because Azure Backup allows you to modify an existing backup policy to change the retention duration for future recovery points without creating a new vault or re-registering the VM. By editing the policy and setting the daily retention to 90 days, all new daily recovery points will be retained for the longer period, while existing recovery points remain unaffected by the change.

Answer

Create a new Recovery Services vault and enable backup again with the longer retention period.

Answer

Take nightly managed disk snapshots because snapshots automatically inherit the Recovery Services vault retention period.

Answer

Change the vault redundancy setting to increase the number of retained recovery points.

AZ-104 Monitor and Maintain Azure Resources Practice Test 9 — 15 Questions

Exhibit

AZ-104 Monitor and Maintain Azure Resources Practice Test 9 — 15 Questions

Exhibit