AZ-104 Monitor and Maintain Azure Resources Practice Question
After a bad script ran, one file at C:\Finance\Q4.xlsx was deleted from a Windows VM. The VM is still running, and the team wants only that file restored without replacing the operating system disk or restarting the VM. What should the administrator use from Azure Backup?
⚠ Common exam trap
Watch out — candidates often assume file-level restore requires the VM to be stopped or that only full VM or disk restore options are available, but Azure Backup's file-level restore feature is specifically designed for granular recovery on a running VM.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform a file-level restore from the recovery point and copy only the missing file back.
Azure Backup for Azure VMs supports file-level restore (FLR) from recovery points without requiring a full VM restore or disk replacement. This allows you to mount the recovery point as a drive on the running VM, browse the file system, and copy only the missing file (C:\Finance\Q4.xlsx) back to its original location. The VM remains online and no OS disk replacement or restart is needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restore the entire VM to a new instance so the deleted file comes back automatically.
Why it's wrong here
Restoring the entire VM to a new instance would create a full copy of the VM from the recovery point with the deleted file present, but it requires keeping both the original and restored VMs running, which is costly and can cause name or IP conflicts. You would then have to manually migrate the file and shut down or decommission resources, and any data changed on the original VM after the recovery point would not appear on the new instance. This approach is far more disruptive and expensive than using file-level restore.
When this WOULD be correct
If the question required recovering a VM that is completely corrupted or unavailable, and the goal is to restore the entire system to a new VM for testing or replacement, then restoring the entire VM to a new instance would be correct.
- ✓
Perform a file-level restore from the recovery point and copy only the missing file back.
Why this is correct
File-level restore is the correct Azure Backup workflow when only a specific file or folder must be recovered. The administrator mounts the recovery point, browses the backed-up file system, and copies back the missing file without replacing disks or redeploying the VM. This keeps the running server intact and minimizes recovery time and operational risk. It is the least disruptive way to recover a single deleted file.
- ✗
Restore the managed disks and replace the existing disks on the running VM.
Why it's wrong here
Restoring the managed disks and replacing them on the running VM would first require stopping and deallocating the VM to detach the current disks, then reattaching the restored disks—this replaces the entire OS and data disk state with the recovery point, discarding any changes written since that point. It also carries a risk of drive letter mismatches or boot issues. A single-file recovery should never require a disk swap when the Azure Backup vault already exposes the recovery point's file system.
- ✗
Use Azure Monitor logs to reconstruct the file because the backup vault stores telemetry.
Why it's wrong here
Azure Monitor logs collect metrics, diagnostics, and activity data from resources, not file-system snapshots or user-data content; the backup vault stores recovery points, not telemetry, and there is no query or reconstruction capability that can rebuild a deleted file from log entries. Even if there were log artifacts, they would not include the binary contents of a deleted Excel file. Therefore, relying on Monitor logs for file recovery is technically impossible.
When this WOULD be correct
If the question asked how to investigate the cause of a VM performance issue or to analyze historical CPU/memory usage, Azure Monitor logs would be the correct tool to query telemetry data.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Perform a file-level restore from the recovery point and copy only the missing file back.Correct answer▾
Why this is correct
File-level restore is the correct Azure Backup workflow when only a specific file or folder must be recovered. The administrator mounts the recovery point, browses the backed-up file system, and copies back the missing file without replacing disks or redeploying the VM. This keeps the running server intact and minimizes recovery time and operational risk. It is the least disruptive way to recover a single deleted file.
✗Restore the entire VM to a new instance so the deleted file comes back automatically.Wrong answer — click to see why▾
Why this is wrong here
Restoring the entire VM to a new instance is unnecessary and inefficient for recovering a single file; it would create a new VM, not restore the file to the existing running VM without restart.
★ When this WOULD be the correct answer
If the question required recovering a VM that is completely corrupted or unavailable, and the goal is to restore the entire system to a new VM for testing or replacement, then restoring the entire VM to a new instance would be correct.
Why candidates choose this
Candidates may think that restoring the entire VM is the only way to recover deleted files, not knowing that Azure Backup supports file-level restore for Windows VMs.
✗Use Azure Monitor logs to reconstruct the file because the backup vault stores telemetry.Wrong answer — click to see why▾
Why this is wrong here
Azure Monitor logs collect performance and diagnostic data, not file contents. They cannot reconstruct deleted files, and the backup vault does not store telemetry for file recovery.
★ When this WOULD be the correct answer
If the question asked how to investigate the cause of a VM performance issue or to analyze historical CPU/memory usage, Azure Monitor logs would be the correct tool to query telemetry data.
Why candidates choose this
Candidates may confuse Azure Monitor's logging capabilities with backup data storage, assuming that telemetry logs contain file content or that backup vaults store operational logs.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.