AZ-104 Monitor and Maintain Azure Resources Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  where

  Why this is correct

  The where operator filters rows based on a boolean predicate, evaluating each row and retaining only those that satisfy the condition. In this scenario, it is the correct choice because the team must return only failed jobs from the last 24 hours, which requires a row-level filter such as Status == "Failed" and TimeGenerated >= ago(24h). Without where, the query would include all jobs regardless of status or time, making it impossible to isolate the specific failed backup operations.

• ✓

  project

  Why this is correct

  The project operator reshapes the output by selecting a specific subset of columns from the input table, discarding all others. Once the where operator has filtered the rows to only failed jobs from the last 24 hours, project is used to trim the result set to the fields the backup operations team needs—for example, job ID, backup item name, and error message. It does not filter rows; it only trims columns, which complements the row-filtering performed by where.

• ✗

  summarize

  Why it's wrong here

  The summarize operator aggregates rows into groups and computes a single aggregate value per group, such as count(), avg(), or max(), collapsing detailed records into summary statistics. Applying summarize to the Recovery Services Vault logs would return a total count of failures or a grouped breakdown by error, but it would lose the individual job-level details—job IDs, timestamps, and specific error messages—that the team needs to review. The requirement to list specific failed job records and fields demands row-level output, not aggregation.

  When this WOULD be correct

  If the question asked for the count of failed jobs per vault or per protected item, summarize with count() would be required to produce the aggregated result.

• ✗

  join

  Why it's wrong here

  The join operator merges rows from two different tables by matching keys, which is useful for combining related data from separate log sources. Here, the source is a single stream of Recovery Services Vault logs; there is no second table to join. Even if a second table were available, join would not filter on job status or time; it would only produce a wider combined table. Because the task is to filter and shape one log stream, join is both unnecessary and functionally incorrect for this requirement.

  When this WOULD be correct

  A question that asks to correlate backup job failures with the corresponding vault properties stored in a separate table, e.g., 'Return the vault name and error description for failed jobs, joining the backup jobs table with the vault metadata table on vault ID.'

• ✗

  extend

  Why it's wrong here

  The extend operator creates one or more new calculated columns and adds them to each row in the result set, increasing the width of the table. It cannot filter rows because it does not evaluate a predicate to exclude records; it simply appends derived values like duration or error code to every row. Therefore, while extend could be used later to compute a field, it cannot by itself return only failed jobs from the last 24 hours—that task fundamentally requires a row filter.

  When this WOULD be correct

  A question that asks to add a new column, such as calculating the duration of backup jobs from start and end times, would require 'extend'.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question