AZ-104 Monitor and Maintain Azure Resources Practice Question
Backup protection was enabled on a new Azure VM, but every backup job fails immediately with a message indicating the guest agent is not ready. What should the administrator verify first?
⚠ Common exam trap
The trap here is that candidates may jump to network or vault configuration issues (like private endpoints or storage redundancy) when the error message explicitly points to the guest agent, which is a common first-check item in Azure Backup troubleshooting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
That the Azure VM agent is installed, running, and up to date inside the guest operating system.
The Azure Backup extension requires the Azure VM agent to be installed, running, and up to date inside the guest OS to coordinate backup operations. When the agent is not ready, the backup job fails immediately because the extension cannot communicate with the VM to take snapshots. Verifying the agent's status is the first troubleshooting step before investigating network or configuration issues.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
That the Azure VM agent is installed, running, and up to date inside the guest operating system.
Why this is correct
Azure VM Backup depends on the VM agent to coordinate snapshot operations and communicate status back to Azure. If the portal reports that the guest agent is not ready, the first troubleshooting step is to verify that the agent exists, is running, and is current. Fixing the agent often resolves immediate backup failures without changing vault settings, policies, or storage configuration.
- ✗
That the recovery vault uses GZRS storage redundancy.
Why it's wrong here
The Recovery Services vault's GZRS (Geo-Zone-Redundant Storage) setting governs how backup copies are replicated across zones and regions for durability, but it has no effect on the live interaction between the Azure Backup service and the VM agent inside the protected VM. Misconfiguring redundancy may impact storage resilience, yet it would never produce a 'guest agent is not ready' error. The correct fix is to check and repair the agent itself.
When this WOULD be correct
In a scenario where backup jobs fail due to a 'storage account not found' or 'backup data not accessible' error, and the question asks about ensuring data durability or compliance, verifying that the vault uses GZRS would be correct.
- ✗
That the VM has a private endpoint to the Recovery Services vault.
Why it's wrong here
A private endpoint provides a private network path to the Recovery Services vault, but Azure VM Backup's snapshot orchestration is handled by the Azure Backup service communicating with the VM agent, not by the VM directly reaching the vault's endpoint. The agent readiness status is reported through the agent's control channel, independent of vault networking. Adding or checking a private endpoint does not address the missing or broken guest agent.
When this WOULD be correct
This option would be correct if the question described backup failures due to connectivity issues, such as 'Backup jobs fail with a timeout error' or 'Cannot connect to the Recovery Services vault from a VM in a restricted network'. In that scenario, verifying a private endpoint or network configuration would be the first step.
- ✗
That a resource lock has not been applied to the VM.
Why it's wrong here
A resource lock restricts management-plane operations like deleting or modifying the Azure Resource Manager resource, but it does not influence the guest-agent heartbeat or the execution of the backup extension inside the OS. The backup failure is tied to the agent's state, not the lock policy. Removing a lock would not make the guest agent ready.
When this WOULD be correct
If the question described backup jobs failing with an error like 'Cannot delete or modify the resource' or 'Operation not allowed due to resource lock', then verifying and removing a resource lock would be the correct first step.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓That the Azure VM agent is installed, running, and up to date inside the guest operating system.Correct answer▾
Why this is correct
Azure VM Backup depends on the VM agent to coordinate snapshot operations and communicate status back to Azure. If the portal reports that the guest agent is not ready, the first troubleshooting step is to verify that the agent exists, is running, and is current. Fixing the agent often resolves immediate backup failures without changing vault settings, policies, or storage configuration.
✗That the recovery vault uses GZRS storage redundancy.Wrong answer — click to see why▾
Why this is wrong here
The backup failure message explicitly indicates the guest agent is not ready, which points to an issue with the Azure VM agent inside the guest OS, not the storage redundancy type of the Recovery Services vault.
★ When this WOULD be the correct answer
In a scenario where backup jobs fail due to a 'storage account not found' or 'backup data not accessible' error, and the question asks about ensuring data durability or compliance, verifying that the vault uses GZRS would be correct.
Why candidates choose this
Candidates may confuse storage redundancy settings with backup agent readiness, thinking that a misconfigured vault replication type could cause immediate backup failures.
✗That the VM has a private endpoint to the Recovery Services vault.Wrong answer — click to see why▾
Why this is wrong here
The immediate failure with 'guest agent not ready' indicates a problem with the Azure VM agent inside the guest OS, not network connectivity. A private endpoint is used for secure access to the vault, but it does not affect the guest agent's readiness.
★ When this WOULD be the correct answer
This option would be correct if the question described backup failures due to connectivity issues, such as 'Backup jobs fail with a timeout error' or 'Cannot connect to the Recovery Services vault from a VM in a restricted network'. In that scenario, verifying a private endpoint or network configuration would be the first step.
Why candidates choose this
Candidates may confuse network connectivity issues with agent readiness issues, or think that a private endpoint is required for backup to function. They might also assume that any backup failure is due to network restrictions, especially in secure environments.
✗That a resource lock has not been applied to the VM.Wrong answer — click to see why▾
Why this is wrong here
A resource lock prevents deletion or modification of the VM, but it does not affect the guest agent's ability to communicate with Azure Backup. The immediate failure with 'guest agent not ready' indicates an agent issue, not a lock.
★ When this WOULD be the correct answer
If the question described backup jobs failing with an error like 'Cannot delete or modify the resource' or 'Operation not allowed due to resource lock', then verifying and removing a resource lock would be the correct first step.
Why candidates choose this
Candidates may confuse resource locks with backup failures, thinking locks block all operations, or they may have seen locks cause issues in other scenarios and incorrectly assume they affect backup agent communication.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.