Courseiva
← AZ-104
Full test
Monitor and Maintain Azure Resources →hardMatchingObjective-mapped

AZ-104 Monitor and Maintain Azure Resources Practice Question

A platform team is tuning alerting for a production VM and the surrounding Azure resources. Match each Azure Monitor component to the function it performs in this design.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Evaluates a numeric Azure Monitor metric and fires when a threshold or dynamic condition is met.

Runs a KQL query against workspace data and fires when the query result matches the condition.

Delivers notifications or automation such as email, SMS, webhook, or runbook execution.

Exports resource logs and metrics to a destination such as Log Analytics, storage, or Event Hub.

Monitors subscription-level control-plane events such as deletes, writes, or policy actions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Azure Monitor Metrics: Collects and analyzes numerical data such as CPU and memory usage from Azure resources.

Azure Monitor Metrics handles numerical data, Logs handles log data; Application Insights is for app monitoring; Alerts notify on conditions; Workbooks and Dashboards are visualization tools.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    Azure Monitor Metrics: Collects and analyzes numerical data such as CPU and memory usage from Azure resources.

    Why this is correct

    Azure Monitor Metrics is a time-series data store engineered for high-frequency numerical measurements. It ingests platform metrics from Azure resources and guest OS performance counters like CPU and memory percentages, with near-real-time collection and low latency. Because it holds only numeric values, it is ideal for dashboards and metric alerts, but it cannot store text-based logs or events. This definition directly matches the service's role in Azure Monitor.

  • ✓

    Azure Monitor Logs: Collects and analyzes log data such as event logs and error traces from Azure resources.

    Why this is correct

    Azure Monitor Logs, backed by a Log Analytics workspace, ingests and stores text-based data such as Windows Event logs, Syslog, custom application logs, and Azure resource logs. Data is queryable using KQL (Kusto Query Language) for deep correlation, trend analysis, and troubleshooting across long retention windows. It is not designed for high-frequency numerical alerting alone, but rather for rich investigative and historical log analysis. This makes it the correct service for event logs and error traces.

  • ✓

    Application Insights: Monitors the performance, availability, and usage of applications.

    Why this is correct

    Application Insights is a dedicated application performance management (APM) service within Azure Monitor. It tracks live application telemetry such as requests, dependencies, exceptions, page views, and traces, often instrumented via SDKs or agents. It also provides availability tests and distributed tracing to pinpoint performance bottlenecks. Because it focuses on the application layer rather than the underlying VM infrastructure, it does not natively collect host CPU or memory usage.

  • ✓

    Alerts: Proactively sends notifications when specified conditions are met based on metrics or logs.

    Why this is correct

    Azure Monitor Alerts is the notification and automation engine that continuously evaluates metric thresholds or log queries against defined rules. When a condition is met, it invokes action groups to send emails, SMS, push notifications, webhooks, or trigger ITSM and automation runbooks. Unlike the raw data collection services, alerts provide proactive, real-time response and can use dynamic thresholds to adapt to baseline patterns. Thus it is correct that alerts send notifications based on metrics or logs.

  • ✗

    Azure Monitor Metrics: Collects and analyzes log data such as event logs and error traces.

    Why it's wrong here

    This option reverses the core responsibilities of Azure Monitor Metrics and Azure Monitor Logs. Azure Monitor Metrics stores only numerical time-series values such as CPU and memory percentages; it has no schema for text payloads like event logs or error traces. Collecting and analyzing log data is exclusively the function of Azure Monitor Logs, which uses a Log Analytics workspace and KQL queries. Therefore, this statement is incorrect because it attributes log-handling capabilities to a metric-only platform.

  • ✗

    Application Insights: Collects and analyzes numerical data such as CPU and memory usage.

    Why it's wrong here

    While Application Insights can be configured with an SDK to send custom metrics or performance counters from within an application, it is not the service responsible for collecting host-level CPU and memory usage from Azure resources. That responsibility belongs to Azure Monitor Metrics, which gathers numerical performance data directly from the platform and guest OS agents. Application Insights focuses on application telemetry like requests, exceptions, and dependencies, so this definition misidentifies the tool. Hence it is an incorrect pairing of service and function.

Go deeper

Related to this question

Learn chapter

Managed Identities for Azure Resources

Key term

Application Insights

Application Insights is an Azure monitoring service that helps developers detect, diagnose, and understand issues in live web applications by collecting telemetry data like requests, exceptions, and performance counters.

Key term

Azure Monitor

Azure Monitor is a cloud service that collects, analyzes, and acts on telemetry data from your Azure and on-premises resources to help you understand performance and availability.

About these practice questions

Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on AZ-104

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A security analyst is reviewing deleted-resource evidence, exported diagnostics, and heartbeat data. Match each monitoring term to the best description.

hard
  • ✓ A.Activity Log: Records control-plane operations like creating or deleting resources.
  • ✓ B.Resource Logs: Logs generated by Azure resources, often exported for analysis.
  • ✓ C.Azure Monitor Agent: Collects monitoring data including heartbeats from virtual machines.
  • D.Metrics: Rules that trigger actions based on conditions.
  • E.Alerts: Numerical values collected at regular intervals from resources.

Why A: The monitoring terms relate to Azure Monitor data sources. Deleted-resource evidence comes from activity logs, exported diagnostics are resource logs sent elsewhere, heartbeat data indicates agent health, and the other terms are standard Azure Monitor components.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.