Backup protection was enabled on a new Azure VM, but every backup job fails immediately with a message indicating the guest agent is not ready. What should the administrator verify first?

That the recovery vault uses GZRS storage redundancy.

Vault redundancy affects storage resilience, but it does not fix a guest agent readiness problem on the protected VM.

That the VM has a private endpoint to the Recovery Services vault.

Recovery Services vault backup traffic does not require a private endpoint as the first response to a guest agent failure message.

That a resource lock has not been applied to the VM.

A lock can block certain management actions, but it does not cause the guest agent to report as not ready.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: That the Azure VM agent is installed, running, and up to date inside the guest operating system. — The message indicates that Azure Backup cannot properly communicate with the VM guest environment. The first thing to check is the Azure VM agent, because it is required for coordinating backup operations and reporting status. If the agent is missing, stopped, or outdated, backup jobs can fail immediately. Verifying the agent is the fastest and most relevant fix before looking at redundancy, networking, or vault design. Why others are wrong: Vault redundancy does not resolve a guest-side agent issue. Private endpoints may be useful in some network designs, but they are not the primary cause of an agent readiness error. Resource locks affect management operations, not the internal health of the VM agent. The correct troubleshooting start point is the Azure VM agent on the guest OS.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.