AZ-104 Monitor and Maintain Azure Resources Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Heartbeat | where Computer == "VM01" and TimeGenerated > ago(15m)

  Why this is correct

  This query correctly queries the Heartbeat table, which is the dedicated Log Analytics table for agent health signals. The Heartbeat table is populated with a record from VM01 every minute by the Log Analytics agent, and the filter `TimeGenerated > ago(15m)` restricts results to records ingested in the last 15 minutes. If no rows are returned, it indicates that the agent on VM01 has stopped sending heartbeats, confirming the reported issue. The `Computer == "VM01"` filter ensures you isolate that specific virtual machine from other agents reporting to the same workspace.

• ✗

  AzureActivity | where ResourceProviderValue == "Microsoft.Compute/virtualMachines"

  Why it's wrong here

  The AzureActivity table contains Azure Resource Manager control-plane operation logs (e.g., create, start, stop, restart of a VM), not the telemetry data that the Log Analytics agent sends to the workspace. Filtering by `ResourceProviderValue == "Microsoft.Compute/virtualMachines"` would return administrative events like 'write Microsoft.Compute/virtualMachines/deallocate/action' or resource health status changes, but it will never contain heartbeat records. Heartbeat data is stored in the Log Analytics 'Heartbeat' table, which is populated by the agent every minute; therefore this query cannot diagnose whether the agent is still reporting. Even if a VM is operationally healthy, its heartbeat may be stopped, and only the Heartbeat table reveals that.

  When this WOULD be correct

  This query would be correct if the question asked: 'Which KQL query lists all recent Azure Resource Manager operations for a specific virtual machine?'

• ✗

  Heartbeat | summarize count() by Computer

  Why it's wrong here

  This query aggregates heartbeat counts per computer across the entire retention period of the workspace, with no time-bound filter such as `TimeGenerated > ago(15m)`. As a result, a VM that stopped sending heartbeats hours, days, or even weeks ago would still appear in the output with a high count, because the summarize counts all historical records. Additionally, this query does not filter to VM01, so it would return counts for every monitored machine, making it impossible to isolate the specific VM in question. To detect a stopped heartbeat, you need a time-filtered query that checks for absence of recent records, not historical totals.

  When this WOULD be correct

  This query would be correct for a question asking: 'Which KQL query shows the total number of heartbeat records per computer over the entire retention period?'

• ✗

  Perf | where CounterName == "% Processor Time"

  Why it's wrong here

  The Perf table stores performance counter samples (e.g., CPU, memory, disk I/O) collected from the agent, not the agent's heartbeat signal. Filtering by `CounterName == "% Processor Time"` would show CPU-utilization percentages for all computers, but it does not indicate whether the Log Analytics agent is alive or has stopped reporting. A VM may have zero recent performance records because the agent is down, but you cannot distinguish that from a lack of performance collection without cross-referencing the Heartbeat table. Moreover, this query does not filter to VM01 and would return performance data from every monitored machine, further obscuring the specific agent-health issue.

  When this WOULD be correct

  This query would be correct if the question asked: 'Which KQL query identifies a VM with high CPU usage in the last 15 minutes?' or 'Which query checks recent CPU performance for VM01?'

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question