AZ-104 Monitor and Maintain Azure Resources Practice Question
Exhibit
AzureActivity | where TimeGenerated >= ago(24h) | where OperationNameValue == "Microsoft.Compute/virtualMachines/deallocate/action" | where ActivityStatusValue == "Failed"
Based on the exhibit, what does the query return?
⚠ Common exam trap
The trap here is that candidates may overlook the explicit 'Status' filter and assume the query returns all deallocate operations, or confuse 'deallocate' with 'start' or 'restart' operations, leading them to select a wrong answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Failed deallocate operations on virtual machines during the last 24 hours.
The query filters for 'Status' equal to 'Failed' and 'Operation' equal to 'Deallocate Virtual Machines', returning only failed deallocate operations. The time filter restricts results to the last 24 hours. Therefore, the query returns failed deallocate operations on virtual machines during the last 24 hours.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
All successful deallocate operations on virtual machines during the last 24 hours.
Why it's wrong here
The query applies an explicit filter on the Status field to equal 'Failed', not 'Succeeded'. In the AzureActivity table, each control-plane operation generates separate log records with a discrete Status value; successful deallocations would have Succeeded or Started and would therefore be excluded by this predicate. The result set is intentionally limited to events where the resource provider reported a failure, so the phrase 'all successful deallocate operations' directly contradicts the query's logic.
When this WOULD be correct
If the query were modified to filter for 'Status eq 'Succeeded'' and 'OperationName eq 'Deallocate Virtual Machine'', it would return all successful deallocate operations on virtual machines during the last 24 hours.
- ✓
Failed deallocate operations on virtual machines during the last 24 hours.
Why this is correct
The query filters the AzureActivity table to the last 24 hours, selects the virtual machine deallocate operation, and then limits results to records whose status is Failed. That combination means it returns only failed deallocation events for virtual machines in the time window shown.
- ✗
Any operations related to starting or restarting virtual machines in the last 24 hours.
Why it's wrong here
The query's TimeGenerated and OperationName filters scope the result to a single action: deallocate. In AzureActivity, starting a VM is recorded as Microsoft.Compute/virtualMachines/start/action and restarting as Microsoft.Compute/virtualMachines/restart/action. Because the query explicitly matches deallocate/action, any start or restart events are filtered out even if they occurred within the 24-hour window. Additionally, the Status filter further removes any start/restart activity that might appear under a different operation name.
When this WOULD be correct
If the query were modified to filter on operations like 'Start VM' or 'Restart VM' (e.g., with 'OperationName' in ('Start VM', 'Restart VM')), then option C would be correct for returning any such operations in the last 24 hours.
- ✗
Administrative changes made only from the Azure portal in the last 24 hours.
Why it's wrong here
Nothing in the query references the Caller, Claims, or HTTP request source columns. The AzureActivity table records whether an operation was invoked through portal, Azure CLI, PowerShell, REST API, or automation; however, this query filters only on TimeGenerated, OperationName, and Status. Consequently, a failed deallocation triggered by a Service Principal or an Azure CLI script is returned just as readily as one initiated in the portal. The only dimensions that matter are operation type, status, and time window, not the client interface.
When this WOULD be correct
Option D would be correct if the query filtered for operations where the 'Caller' is from the Azure portal (e.g., 'Microsoft Azure Portal') and the operation name includes 'write' or 'action' for administrative changes, with a time range of the last 24 hours.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Failed deallocate operations on virtual machines during the last 24 hours.Correct answer▾
Why this is correct
The query filters the AzureActivity table to the last 24 hours, selects the virtual machine deallocate operation, and then limits results to records whose status is Failed. That combination means it returns only failed deallocation events for virtual machines in the time window shown.
✗All successful deallocate operations on virtual machines during the last 24 hours.Wrong answer — click to see why▾
Why this is wrong here
The query filters for 'deallocate' operations with a 'Failed' status, so it does not return successful deallocate operations.
★ When this WOULD be the correct answer
If the query were modified to filter for 'Status eq 'Succeeded'' and 'OperationName eq 'Deallocate Virtual Machine'', it would return all successful deallocate operations on virtual machines during the last 24 hours.
Why candidates choose this
Candidates may misread the query or assume that the default filter is for successful operations, overlooking the explicit 'Failed' status filter.
✗Any operations related to starting or restarting virtual machines in the last 24 hours.Wrong answer — click to see why▾
Why this is wrong here
The query in the exhibit filters for 'Deallocate VM' operations with a status of 'Failed', not operations related to starting or restarting virtual machines.
★ When this WOULD be the correct answer
If the query were modified to filter on operations like 'Start VM' or 'Restart VM' (e.g., with 'OperationName' in ('Start VM', 'Restart VM')), then option C would be correct for returning any such operations in the last 24 hours.
Why candidates choose this
Candidates may confuse 'deallocate' with 'stop' or 'restart' operations, or they might misread the query and think it captures all VM state changes rather than specifically failed deallocations.
✗Administrative changes made only from the Azure portal in the last 24 hours.Wrong answer — click to see why▾
Why this is wrong here
The query in the exhibit filters for 'deallocate' operations with a failed status, not for administrative changes from the Azure portal. Option D is incorrect because the query does not restrict by source (portal) or operation type (administrative changes).
★ When this WOULD be the correct answer
Option D would be correct if the query filtered for operations where the 'Caller' is from the Azure portal (e.g., 'Microsoft Azure Portal') and the operation name includes 'write' or 'action' for administrative changes, with a time range of the last 24 hours.
Why candidates choose this
Candidates may confuse 'deallocate' with a broader category of administrative changes, or assume that the query's time filter and operation scope implicitly cover all portal changes, overlooking the specific operation and status filters.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.