AZ-104 Monitor and Maintain Azure Resources Practice Question
A user deleted several files from an Azure VM, and the administrator wants to use Azure Backup file recovery. Which two items are needed to start the recovery process? Select two.
⚠ Common exam trap
It's easy for candidates to think a user-assigned managed identity (E) is needed for authentication to access the vault, but the file recovery script handles authentication via a temporary SAS token embedded in the script, not via managed identities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A recovery point
Azure Backup file recovery requires a recovery point (A) because it represents the snapshot of the VM's data at a specific time from which files can be restored. The file recovery script (C) is downloaded from the Recovery Services vault and mounts the recovery point as a drive on the VM, enabling file-level access. Without both, the recovery process cannot proceed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A recovery point
Why this is correct
A recovery point is the core artifact of Azure Backup: it is a point-in-time snapshot (crash-consistent or app-consistent) of the VM's disks, stored in the Recovery Services vault. To recover deleted files, you must have at least one successful recovery point that predates the deletion, because the actual file data is only available from that snapshot. Without a recovery point, there is no backed-up copy of the file system to restore, making the entire recovery operation impossible.
- ✗
An application security group
Why it's wrong here
An application security group is a logical grouping of VM network interfaces used to filter traffic in network security group (NSG) rules, allowing you to apply consistent network policies to workloads. It has absolutely no interaction with disk storage, backup snapshots, or the Azure Backup service. Since file recovery involves reading data from a snapshot and copying it to a VM's filesystem, an application security group cannot contribute to or enable that process—it is purely a network construct.
When this WOULD be correct
In a scenario where you need to restrict inbound traffic to a VM based on application workloads (e.g., allow only web traffic to web servers), an application security group would be the correct answer for a question about network security groups.
- ✓
The file recovery script downloaded from the vault
Why this is correct
The file recovery script is a downloadable PowerShell (or Python) script from the Recovery Services vault that automates mounting the selected recovery point as an iSCSI target on the VM or another machine. It establishes a secure connection to the vault, attaches the snapshot as a read-only volume, and lets you copy the deleted files back to the live VM. Even if you have a valid recovery point, you need this script to access its contents—it is the bridge between the backup data and the filesystem you want to restore.
- ✗
A metric alert rule
Why it's wrong here
A metric alert rule monitors Azure Monitor metrics (like CPU percentage, disk IOPS, or network throughput) and triggers notifications or actions when a threshold is crossed. While it might alert you to unusual activity, it does not have any mechanism to access backup snapshots or restore individual files. Even if you had an alert configured, it would only notify you of a potential problem; the actual restoration of deleted files requires a recovery point and a way to mount it, neither of which an alert can provide.
When this WOULD be correct
In a question about configuring notifications for backup failures or performance issues, a metric alert rule would be correct to alert on backup-related metrics like 'Backup Health Events' or 'Backup Item Size'.
- ✗
A user-assigned managed identity
Why it's wrong here
A user-assigned managed identity is an Azure Active Directory identity used to authenticate Azure resources (like a VM) to services such as Key Vault or Storage, without storing credentials in code. File recovery via Azure Backup does not require any managed identity; the recovery script uses the Azure CLI or PowerShell to authenticate to the vault with your Azure credentials, and the mount operation is performed by the Azure Backup service itself. Therefore, a managed identity is neither a dependency nor a prerequisite for recovering deleted files.
When this WOULD be correct
A user-assigned managed identity would be correct in a question about authenticating an Azure VM to access Azure Key Vault or other Azure resources without storing credentials in code.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A recovery pointCorrect answer▾
Why this is correct
A recovery point is the core artifact of Azure Backup: it is a point-in-time snapshot (crash-consistent or app-consistent) of the VM's disks, stored in the Recovery Services vault. To recover deleted files, you must have at least one successful recovery point that predates the deletion, because the actual file data is only available from that snapshot. Without a recovery point, there is no backed-up copy of the file system to restore, making the entire recovery operation impossible.
✗An application security groupWrong answer — click to see why▾
Why this is wrong here
An application security group is used to control network traffic to Azure VMs, not for file recovery from Azure Backup. File recovery requires a recovery point and the file recovery script, not network security components.
★ When this WOULD be the correct answer
In a scenario where you need to restrict inbound traffic to a VM based on application workloads (e.g., allow only web traffic to web servers), an application security group would be the correct answer for a question about network security groups.
Why candidates choose this
Candidates may confuse the term 'security group' with backup security or think that some security component is needed to authorize the recovery process, but application security groups are unrelated to backup operations.
✗A metric alert ruleWrong answer — click to see why▾
Why this is wrong here
A metric alert rule is used to monitor Azure resources and trigger actions based on performance or availability metrics, not to recover files from an Azure VM backup.
★ When this WOULD be the correct answer
In a question about configuring notifications for backup failures or performance issues, a metric alert rule would be correct to alert on backup-related metrics like 'Backup Health Events' or 'Backup Item Size'.
Why candidates choose this
Candidates may confuse monitoring and alerting with recovery processes, thinking that alerts are needed to initiate or manage file recovery steps.
✗A user-assigned managed identityWrong answer — click to see why▾
Why this is wrong here
Azure VM file recovery via Azure Backup requires a recovery point and the file recovery script from the vault; a user-assigned managed identity is not needed for this process.
★ When this WOULD be the correct answer
A user-assigned managed identity would be correct in a question about authenticating an Azure VM to access Azure Key Vault or other Azure resources without storing credentials in code.
Why candidates choose this
Candidates may confuse managed identities with authentication requirements for backup operations, mistakenly thinking an identity is needed to authorize the file recovery script.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Azure Backup
Azure Backup is a cloud-based service from Microsoft that protects your data by creating and storing backups of files, folders, virtual machines, databases, and entire servers in the Azure cloud.
Key term
Recovery Services vault
A Recovery Services vault is a secure storage container in Microsoft Azure that holds backup data and replication settings for virtual machines, databases, and other cloud resources, enabling you to restore them if something goes wrong.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.