Azure Backup File-Level Recovery: Restore Deleted Files Without Full VM Restore
A user accidentally deleted a file from an Azure VM. The administrator wants to recover only the deleted file from the most recent backup instead of restoring the entire VM. What should the administrator use?
Quick Answer
The correct answer is file recovery from the Azure Backup restore process, because Azure Backup’s file-level recovery feature allows you to restore individual deleted files from a VM backup point without performing a full VM restore. This works by mounting the recovery point as a network drive on the same or a separate VM, enabling direct copy of the needed file. On the AZ-104 exam, this scenario tests your understanding of granular restore options versus full VM recovery, and a common trap is choosing “restore the entire VM to a new resource group” or “use Azure Site Recovery,” which are designed for disaster recovery, not item-level retrieval. Remember the key distinction: file-level recovery mounts the backup as a drive, so you can browse and copy files just like a local folder. A helpful memory tip is “Mount, don’t boot”—you mount the recovery point to grab the file, rather than booting up the whole VM.
⚠ Common exam trap
It's easy for candidates to confuse Azure Backup's full VM restore with its file-level recovery capability, assuming that only a complete VM restore is possible from a backup.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
File recovery from the Azure Backup restore process
Azure Backup's file-level recovery (also known as item-level restore) allows you to recover individual files or folders from a VM backup point without restoring the entire VM. This is achieved by mounting the recovery point as a drive on the same or another VM, enabling direct file copy. Option A is correct because this feature is specifically designed for granular recovery of deleted files from the most recent backup.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
File recovery from the Azure Backup restore process
Why this is correct
File recovery lets the administrator mount or browse backup data and restore only the needed files instead of the full VM.
- ✗
A new VM image
Why it's wrong here
A VM image is used to deploy or recreate VMs, not to restore an individual deleted file.
When this WOULD be correct
This option would be correct if the question asked for deploying multiple identical VMs from a customized configuration, such as scaling out a web application using a pre-configured VM image stored in Azure Compute Gallery.
- ✗
A metric alert
Why it's wrong here
A metric alert can notify on conditions, but it cannot recover deleted data.
When this WOULD be correct
An administrator needs to be notified when CPU usage exceeds 90% on a critical Azure VM to scale out resources automatically.
- ✗
An NSG flow log
Why it's wrong here
NSG flow logs record network traffic patterns and do not contain file data for recovery.
When this WOULD be correct
An administrator needs to analyze network traffic to or from a specific Azure VM to identify a security breach. NSG flow logs would be the correct tool to enable and query for this purpose.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓File recovery from the Azure Backup restore processCorrect answer▾
Why this is correct
File recovery lets the administrator mount or browse backup data and restore only the needed files instead of the full VM.
✗A new VM imageWrong answer — click to see why▾
Why this is wrong here
A new VM image would require creating an entirely new VM from a captured image, which does not allow selective file recovery from a backup. It would not restore the deleted file without redeploying the whole VM.
★ When this WOULD be the correct answer
This option would be correct if the question asked for deploying multiple identical VMs from a customized configuration, such as scaling out a web application using a pre-configured VM image stored in Azure Compute Gallery.
Why candidates choose this
Candidates may think creating a new VM image from the current VM state could serve as a backup, but it does not support granular file-level recovery from a specific backup point.
✗A metric alertWrong answer — click to see why▾
Why this is wrong here
A metric alert monitors performance metrics (e.g., CPU, memory) and triggers notifications; it cannot recover deleted files from backups.
★ When this WOULD be the correct answer
An administrator needs to be notified when CPU usage exceeds 90% on a critical Azure VM to scale out resources automatically.
Why candidates choose this
Candidates may confuse alerting with recovery actions, thinking an alert can trigger a file restore process.
✗An NSG flow logWrong answer — click to see why▾
Why this is wrong here
NSG flow logs capture IP traffic through a network security group, not file-level recovery from backups. They are used for network monitoring and troubleshooting, not for restoring deleted files.
★ When this WOULD be the correct answer
An administrator needs to analyze network traffic to or from a specific Azure VM to identify a security breach. NSG flow logs would be the correct tool to enable and query for this purpose.
Why candidates choose this
Candidates may confuse NSG flow logs with backup logs or think they provide a way to recover data by analyzing network activity, not understanding their focus on network traffic metadata.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A Windows VM in Azure is protected by Azure Backup. A developer accidentally deleted one application folder, but the VM must keep serving users while the administrator restores only that folder. What should the administrator do?
hard- A.Restore the entire VM from the latest recovery point into the production resource group.
- ✓ B.Use File Recovery from the appropriate recovery point and copy the folder back.
- C.Restore the managed disk and attach it to the running VM as a second OS disk.
- D.Create a new Recovery Services vault and re-protect the VM before restoring anything.
Why B: Azure Backup's File Recovery feature allows you to mount a recovery point as a drive on the running VM, enabling you to copy specific files or folders without restoring the entire VM or disrupting production. This is the only method that meets the requirement of restoring only the deleted folder while the VM continues serving users.
Variation 2. Based on the exhibit, a user accidentally deleted one file from the VM and you need to restore only that file without recovering the entire virtual machine. What should you use?
medium- ✓ A.Run file recovery from the available recovery point.
- B.Restore the entire VM to the original resource group.
- C.Create a new backup policy with longer retention and wait for the next backup.
- D.Use Azure Monitor alerts to trigger an automatic file restore.
Why A: Azure Backup for Azure VMs supports file-level recovery from VM backup snapshots without restoring the entire VM. By selecting 'File Recovery' from the backup item's recovery point, you can mount the backup as a drive on the VM or a recovery machine, browse the file system, and copy the deleted file back to its original location. This avoids the overhead and downtime of a full VM restore.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.