Monitor and Maintain Azure Resources

The subscription activity log is being sent to a Log Analytics workspace. An alert must fire when any resource group is deleted, but delete operations initiated by the automation account rg-cleaner@contoso.com must be ignored. Which query should be used in the alert rule?

An administrator enabled diagnostic settings on a storage account and selected the resource-specific table format for Log Analytics. A coworker later queried AzureDiagnostics and received no rows. What should the administrator tell the coworker to do?

A Windows VM in Azure is protected by Azure Backup. A developer accidentally deleted one application folder, but the VM must keep serving users while the administrator restores only that folder. What should the administrator do?

A support engineer is investigating a failed Azure VM backup job in Log Analytics. Match each KQL operator to the result it produces.

An administrator is reviewing a KQL query used to investigate failed operations in a Log Analytics workspace. Match each KQL operator to the effect it has on the query output.

Based on the exhibit, which KQL query should you use to find failed storage account delete operations in the last hour and count them by caller?

A backup administrator manages three Recovery Services vaults. They need a single place to review the latest job outcome across all vaults, and then drill into the failed job details for one VM. Which two Azure experiences should they use? Select two.

Based on the exhibit, the security team needs 30 days of searchable log data for a storage account and wants to create queries that can be used in workbooks and alerts. The current configuration only sends data to an archive location. What should the administrator configure?

A production team wants to match common Azure Monitor components to the action each one performs. Match each item on the left to the best description on the right.

Which two settings can you configure in an Azure Backup policy for a virtual machine? Select two.

A helpdesk engineer wants to determine whether a VM issue is caused by a Microsoft platform problem or a problem limited to one specific VM. Which two Azure features should they use? Select two.

The team needs alerts for VM CPU and storage capacity thresholds, but they want to keep telemetry ingestion costs as low as possible. Which approach is best?

An operations team wants to know when Azure marks a specific storage account unhealthy because of a regional platform issue. They do not want to depend on a custom metric, a Log Analytics query, or any polling script. What should they create?

A VM must be backed up every day, and backups must be retained for several days after creation. Which two settings are configured in an Azure Backup policy? Select two.

A storage account hosts application logs that security wants to search in Log Analytics for 30 days and keep in a separate retained copy for one year. They also want to monitor storage metrics in the same place for troubleshooting. What should be configured on the storage account?

An operations team monitors a group of Azure VMs and storage accounts. Match each Azure Monitor component to the behavior it provides in day-to-day operations.

An operations lead must choose the right Azure Monitor target for each requirement. Match each requirement to the Azure component that best satisfies it.

A production VM needs an email and SMS notification when CPU percentage stays above 80 percent for five minutes. Which two Azure Monitor components should the administrator configure? Select two.

A backup administrator is learning how Azure VM backup actions map to their purpose. Match each Recovery Services or backup item to the best description.

A help desk analyst wants a query in Log Analytics that returns Azure virtual machines that have stopped sending a heartbeat for more than 15 minutes. Which KQL query should the analyst run?

You need to collect performance counters and event logs from multiple Azure virtual machines and query the data centrally by using Kusto Query Language. Which Azure resource should you deploy?

A subscription admin wants to investigate who changed a resource and also review the platform-generated events for that subscription. Which two types of logs can be sent to Log Analytics and queried later? Select two.

A support engineer is narrowing a Log Analytics query to only failed backup jobs and wants to show only the needed columns. Which two KQL operators should they use? Select two.

You want Azure to recommend ways to reduce cost, improve performance, and strengthen security across your subscriptions. Which service should you use?

A help desk analyst needs a KQL query that identifies each VM's most recent heartbeat so computers can be flagged if their last check-in is older than 20 minutes. Which two KQL elements should be used? Select two.

You want to send a storage account's platform logs to a workspace so they can be queried with KQL later. Which two items are part of the required configuration? Select two.

You need to collect guest operating system performance counters and Windows event logs from several Azure virtual machines into a central queryable platform. Which Azure component should you configure?

An administrator is comparing Azure monitoring data sources and destinations during an investigation. Match each item to the best operational use.

You need to notify the operations team by email when average CPU utilization on VM-App01 exceeds 80 percent for 15 minutes. Which Azure Monitor components should you configure?

A user deleted a single document from a backed-up Windows VM. Which two Azure Backup actions are appropriate if only that file must be recovered? Select two.

Which two statements about a Log Analytics workspace are correct? Select two.

A production VM must generate an alert when average CPU exceeds 80 percent for 10 minutes. The alert must be evaluated continuously, but email notifications should be suppressed outside 08:00 to 18:00 on weekdays. What should the administrator configure?

A production Azure VM farm runs customer-facing APIs. Operations wants an automatic notification when the average Percentage CPU on any VM stays above 85 percent for 10 minutes, and the notification must reach both email and SMS recipients. Which two Azure Monitor items must be configured? Select two.

Based on the exhibit, the OS disk on a production VM is corrupted, but the VM must stay in place and keep its NIC and data disks. Which restore option should you choose?

An administrator accidentally deletes a VM backup item from a Recovery Services vault. The company wants a built-in protection feature that helps recover the deleted backup item during the retention window. Which feature is this?

Based on the exhibit, the backup policy must support 30-day recovery for daily backups while keeping 12 months of monthly copies. Which setting should be changed?

Based on the exhibit, which restore option should the administrator choose?

During a compliance review, the team must distinguish what each Azure Monitor object can and cannot do. Match each object to its primary operational scope.

Based on the exhibit, what should the administrator add to send an email and SMS notification?

A user deleted one Excel file from a Windows Server VM that is protected by Azure Backup. The VM must keep running, and the administrator must restore only that file as quickly as possible. What should the administrator do?

Based on the exhibit, a metric alert already exists for VM01, but the on-call team never receives an email when CPU exceeds 80% for 5 minutes. What should you configure to deliver the notification?

An admin enables backup on a newly deployed Azure VM, but every backup job fails immediately with a message that the VM agent is not ready. What should the administrator verify first?

Your operations team needs to receive a Microsoft Teams or email notification whenever a production application becomes unavailable. You have already created an availability test in Azure Monitor. What should you configure next?

Which two statements about Azure Backup soft delete are correct? Select two.

The operations team manages several Azure VMs in one resource group. They need an alert whenever average CPU percentage on any VM in the group stays above 80% for 10 minutes, and the alert must send email and SMS to the on-call team. What should the administrator configure?

A VM suffered corruption and an auditor also needs one missing file. Match each Azure Backup restore workflow to the recovery outcome it provides.

A security analyst is reviewing deleted-resource evidence, exported diagnostics, and heartbeat data. Match each monitoring term to the best description.

A help desk engineer needs a Log Analytics query that returns each computer whose most recent heartbeat is older than 20 minutes. Which query should they use?

The subscription admin wants to receive an alert whenever anyone deletes a resource group, regardless of which resource type was inside it. Which alert type should be used?

Based on the exhibit, a user deleted one file from a Windows Azure VM. The VM is still running, and the administrator wants to restore only that file instead of recovering the full machine. Which restore approach should be used?

Based on the exhibit, a subscription activity log is already being sent to Log Analytics. The operations team wants an alert that fires when any resource group is deleted, but it should ignore deletions performed by a known automation account. Which approach should the administrator use?

You need to receive an email when average CPU usage on VM-App01 exceeds 85 percent for 10 minutes. Which Azure Monitor components should you configure?

In Log Analytics, you want an alert that fires if VM01 has not sent a Heartbeat record in the last 15 minutes. Which query should be used as the alert condition?

A user deleted a file from an Azure VM, and the administrator wants to use Azure Backup file-level recovery rather than restore the whole VM. Which two prerequisites are required before mounting the recovery point from the portal? Select two.

A team already has a metric alert on a production VM. The alert should continue evaluating 24/7, but email notifications must be sent only Monday through Friday from 08:00 to 18:00 local time. What should the administrator add or change?

Backup protection was enabled on a new Azure VM, but every backup job fails immediately with a message indicating the guest agent is not ready. What should the administrator verify first?

Based on the exhibit, the support team needs a searchable 90-day history of who deleted Azure resources and when. The current workspace only contains VM guest logs. Which configuration should you add?

A Windows VM protected by Azure Backup is missing one application file, but the VM must stay online during recovery. Which restore approach should the administrator use?

After enabling Azure VM backup, an administrator wants to confirm whether the nightly backup succeeded. Where should the administrator check the backup status?

You want Azure to identify underutilized virtual machines and recommend ways to reduce cost and improve security posture. Which service should you use?

Based on the exhibit, you want the resource logs for the storage account to appear in Log Analytics so you can investigate read and write failures. What should you configure?

Your company has a hybrid infrastructure with Azure VMs and on-premises servers. You need to configure Azure Monitor to collect and analyze performance and event data from all servers in a centralized workspace. Which three of the following steps are required to achieve this? (Choose three.)

Based on the exhibit, a production VM must send an email and SMS notification if average CPU stays above 85% for 10 minutes. The team created the alert rule, but no one receives notifications when the condition is met. What should the administrator add to the alert rule?

Based on the exhibit, compliance requires one backup every week to be kept for 52 weeks, in addition to the daily backups already configured. What should you change in the backup policy?

You need an alert that emails administrators when CPU on VM-DB01 exceeds a threshold. Which two Azure Monitor components work together to achieve this?

A team wants to monitor average CPU on a small set of Linux VMs and OS disk free space, but they want the lowest telemetry ingestion cost possible. Which two actions should they take? Select two.

A team wants to keep Azure platform logs for a storage account in a central location and analyze them with queries. The logs should be queryable together with other Azure resource logs. What destination should the administrator choose for the diagnostic setting?

A line-of-business app must keep serving users if an entire Azure region becomes unavailable. Is Azure Backup by itself enough to meet this requirement?

An operations team manages an Azure virtual machine scale set that hosts a stateless API. They already collect guest logs in Log Analytics, but they do not want to ingest extra performance data just to watch CPU. They need an alert when average CPU across the scale set stays above 80% for 10 minutes, and the notification must support email and a webhook. What should they configure?

A Recovery Services vault protects 40 VMs by using one daily backup policy that retains recovery points for 7 days. One finance VM must keep daily recovery points for 30 days, but the other VMs should remain on the 7-day policy. What should the administrator do?

Engineers need a single Log Analytics workspace to investigate incidents by querying Windows event logs from a VM and Azure resource logs from a storage account. What should the administrator configure?

A response team is designing notification paths for Azure Monitor alerts. Match each action group receiver or action to the outcome it provides.

You need to view recommendations about underutilized virtual machines, security improvements, and cost-saving opportunities in Azure. Which service should you use?

Based on the exhibit, the alert rule is firing, but the operations team is not receiving any notification. What should you change to make the alert send an email when the condition is met?

Match each Recovery Services vault setting or feature to the behavior an administrator should expect after changing it.

Based on the exhibit, the team wants to validate that a protected Azure VM can be recovered without affecting production. Which restore approach best meets the requirement?

You need to be notified whenever the average CPU usage of VM-App01 exceeds 80 percent for 10 minutes. The solution must send an email to the operations team automatically. What should you configure?

A support engineer needs to search a Log Analytics workspace for only failed sign-in records. Which KQL query should they use?

Based on the exhibit, which restore option should the administrator use to recover only the deleted file while keeping the VM online?

The team already exports subscription activity logs to a Log Analytics workspace and wants an alert that can ignore delete operations performed by a known automation account. What should they create?

A production virtual machine is experiencing intermittent performance spikes. The operations team wants an alert when average CPU usage stays above 80 percent for 10 minutes and wants email and SMS notifications sent automatically. What should the administrator configure in Azure Monitor?

A security admin wants Key Vault audit logs and metrics sent to a Log Analytics workspace for later search. Which Azure setting should be configured on the vault?

An employee deleted one spreadsheet from a Windows VM that is protected by Azure Backup. The VM must stay online while the administrator recovers only that file. Which two restore methods are supported? Select two.

Based on the exhibit, what does the query return?

You need to retain Azure Firewall logs for long-term analysis in a Log Analytics workspace and also archive them in a storage account for compliance. What should you configure on the Azure Firewall resource?

Based on the exhibit, which KQL query should you use in a scheduled query alert to trigger only when five or more failed events occur within any 15-minute window?

You want to send a storage account's read, write, and delete events to a Log Analytics workspace for later investigation. Which feature should you configure?

A storage account experiences a brief regional platform issue. The team wants an alert whenever Azure marks the resource as unavailable, even if no custom metric changes are detected. What should the administrator use?

A file server VM is corrupted after a bad change. The team needs to recover the whole machine to the latest recovery point, not just one file. Which restore workflow should they use?

Arrange the steps to configure Azure Load Balancer with a backend pool.

Based on the exhibit, what should the administrator configure so the alert sends email and SMS when CPU stays above the threshold?

A production VM is using too much CPU. You want Azure to notify the operations team by email when Average Percentage CPU stays above 80 percent for 5 minutes. What should you configure?

A production subscription contains 20 virtual machines across two resource groups. Operations needs an email and SMS notification whenever any single VM's average Percentage CPU stays above 85 for 10 minutes. The alert should be managed as one rule, and evaluation must happen independently for each VM. What should the administrator configure?

An employee deleted one spreadsheet stored on a Windows VM that is protected by Azure Backup. The administrator must recover only that file without restoring the entire VM. What should be used?

Based on the exhibit, what should the administrator deploy to monitor CPU and free disk space on a small set of VMs while keeping telemetry cost low?

The Azure portal shows that a storage service in the region is experiencing an outage that affects several Microsoft customers. The administrator wants to view official Azure status updates for that issue. Which Azure Monitor feature should be used?

A platform team is tuning alerting for a production VM and the surrounding Azure resources. Match each Azure Monitor component to the function it performs in this design.

Order the steps to configure Azure Traffic Manager for geographic routing.

A team is choosing the right Azure Monitor alert type for different operational signals. Match each alert type to the situation it is best suited for.

Based on the exhibit, the security team wants an alert whenever someone changes the configuration of a storage account, such as disabling public network access. The current rule is a metric alert on transaction count. What should you use instead?

You are an Azure administrator for a company that runs critical virtual machines (VMs) in Azure. You need to configure a monitoring solution that will alert you when the average CPU usage of a specific VM exceeds 90% for more than 15 minutes. Which three of the following actions should you take to set up this alert? (Choose three.)

Your operations team wants to query collected VM log data by using Kusto Query Language and retain it centrally for analysis. Which Azure resource should you deploy?

Based on the exhibit, the operations team wants an alert that fires when any VM has not sent a heartbeat in the last 15 minutes. Which KQL query should they use as the condition for the log alert?

Your company must retain Azure Activity Log data beyond the built-in retention period and make it available for long-term analysis. Which configuration should you use?

A storage account's platform logs must be searchable later with KQL in a central workspace. Which two actions should the administrator take? Select two.

You are responsible for managing a large Azure environment with multiple subscriptions. You need to ensure compliance with company policies by auditing resource changes and enabling automated remediation for non-compliant resources. Which three of the following Azure services or features should you use? (Choose three.)

After a bad script ran, one file at C:\Finance\Q4.xlsx was deleted from a Windows VM. The VM is still running, and the team wants only that file restored without replacing the operating system disk or restarting the VM. What should the administrator use from Azure Backup?

Based on the exhibit, the team wants a single notification setup that can be reused by several alert rules across different subscriptions. What should the administrator create?

Your company wants to know when an Azure service outage in the region might affect subscribed resources, even if no metric threshold has been crossed yet. Which alert type should you configure?

Based on the exhibit, you need to return only the failed operations from the log entries. Which KQL query should you use?

You need to notify the security team whenever anyone deletes a resource group in the subscription. Which alert type should you configure?

Your operations team needs to run Kusto queries across collected sign-in logs, VM performance counters, and Azure Activity Log data in a central location. What should you deploy?

A team needs an alert that emails the operations group whenever a VM's average CPU percentage stays above 85% for 10 minutes. Which two Azure Monitor components must you configure? Select two.

Based on the exhibit, the VM backup item was accidentally deleted from the vault yesterday, but the VM itself still exists. What should you do to resume protection with the existing backup item?

You want Azure to identify security improvements, underutilized resources, and cost-saving opportunities across your subscriptions. Which Azure service should you use?

A developer deleted a single configuration file on a Windows Azure VM. The administrator wants to restore only that file from the latest backup without replacing the entire VM. Which restore workflow should be used?

Several Azure Monitor alerts across different subscriptions must notify the same on-call group by email, SMS, and webhook whenever they fire. The operations team wants to define the notification target once and reuse it from future metric alerts, log alerts, and activity log alerts. What should be created?

Based on the exhibit, what should the administrator configure so the operations team receives an email when the VM's average CPU stays above 80% for 10 minutes?

A backup engineer is reviewing policy-related settings in a Recovery Services vault. Match each backup setting to the behavior it controls.

An organization must retain Azure Key Vault audit data for 18 months, search the data in Log Analytics, and keep a second copy if the workspace retention policy is later shortened. The operations team already has an action group for notifications. What should be configured on the Key Vault?

Your company needs to retain Azure Activity Log data longer than the built-in retention period and make it available for future analysis. What should you configure?

Based on the exhibit, what should the administrator change if the business wants backups to be kept for 30 days instead of 7 days?

The operations team wants an email and SMS notification whenever any production virtual machine's average CPU stays above 85 percent for 10 minutes. They also want to reuse the same notification targets for future alerts. What should they configure?

A user accidentally deleted a file from an Azure VM. The administrator wants to recover only the deleted file from the most recent backup instead of restoring the entire VM. What should the administrator use?

Your team wants every protected Azure VM in a vault to be backed up once each day and kept for 30 days. Which Recovery Services vault setting should you configure?

A backup operations team exports Recovery Services vault logs to Log Analytics. They need a query that returns only failed backup jobs from the last 24 hours and displays just the vault name, protected item name, and error description. Which two KQL operators should the query include? Select two.

Based on the exhibit, a backup administrator accidentally stopped protection for a critical VM and then deleted its backup item. The team wants Azure Backup to retain the deleted item long enough to recover it after the mistake is discovered the next day. What should be enabled on the vault?

You need to monitor CPU on a small set of VMs while keeping ingestion costs low. Which two actions are the best choices? Select two.

A storage account is failing writes, and the team also wants to correlate those errors with subscription-level changes such as role assignments or deployments. What should the administrator configure?

You need to keep Azure activity log data for longer than the default retention period and make it available for analysis. What should you configure?

Based on the exhibit, which Azure feature should the administrator use to track this kind of platform-wide service issue?

A security team needs platform logs and metrics from an Azure Key Vault to be searchable later in a Log Analytics workspace so they can investigate administrative changes and access trends. What should you configure on the Key Vault?

A company wants an alert to be sent by email and SMS whenever a production virtual machine's CPU percentage goes above 80 percent. The administrator also wants the notification targets to be reusable by other alerts later. What should the administrator configure first?

A user deleted several files from an Azure VM, and the administrator wants to use Azure Backup file recovery. Which two items are needed to start the recovery process? Select two.

Based on the exhibit, which alert type should the administrator create to detect when Azure marks the storage account unhealthy because of a platform issue?

A company wants to enable backup for an Azure virtual machine and later restore the VM if needed. Which Azure service should the administrator use to manage the backup plan and restores?

Based on the exhibit, why does a query against AzureDiagnostics return no rows after the storage account diagnostic setting was changed?

An administrator wants to send a virtual machine's guest logs to a central workspace so they can search them later with queries. Which configuration should be created on the VM or its resource provider first?

Based on the exhibit, an administrator needs to recover one deleted configuration file from a running Azure VM without replacing the VM. Which restore option should be used?

A VM backup policy is being designed in a Recovery Services vault. Match each backup policy element to the behavior it controls.

A team manages a production VM and its supporting storage account. Match each operational requirement to the Azure Monitor component that should be configured.

The team accidentally stopped protection for a VM and deleted its backup data. They want Azure Backup to keep deleted backup items recoverable for a grace period so the item can be undeleted if needed. Which vault feature should be enabled?

A security team wants platform logs from a storage account sent for long-term retention and later analysis. Which three destinations can an Azure diagnostic setting send data to? Select three.

Based on the exhibit, the operations team says the alert is too noisy because short CPU spikes after nightly maintenance trigger notifications. They want an alert only when VM1's average CPU stays above 80% for at least 10 minutes. What should you change?

You need to collect Windows event logs and performance counters from multiple Azure virtual machines and query the data by using Kusto Query Language. Which Azure resource should you use?

A finance VM is backed up daily. The team wants short-lived snapshots so recently changed files can be recovered quickly, but they also need daily recovery points retained for 30 days. Which two backup policy settings should be configured? Select two.

A Recovery Services vault currently keeps daily Azure VM recovery points for 7 days. The business changes the requirement to keep daily recovery points for 30 days. Where should the administrator change the setting?

A storage account becomes unavailable because Azure has a regional platform issue. The operations team wants a notification whenever Azure marks the resource or region unhealthy, and they want to avoid continuous log ingestion just to detect the outage. What should they configure?

Based on the exhibit, which KQL operator should replace the blank to return only those columns?

Based on the exhibit, a user accidentally deleted one file from the VM and you need to restore only that file without recovering the entire virtual machine. What should you use?

An administrator accidentally stopped protection for a critical VM and then deleted its backup item. The mistake was discovered a day later, and the organization wants deleted backup data to remain recoverable for a grace period. Which feature should be enabled on the Recovery Services vault?

You need to suppress alert notifications for a group of virtual machines every Sunday during a planned maintenance window, without deleting the underlying alert rules. What should you configure?

A VM was corrupted and the team wants to recover it from Azure Backup without using the original damaged disks. Which two restore targets are supported? Select two.

A VM named VM01 stopped sending Heartbeat records to Log Analytics 15 minutes ago. Which KQL query should you run to confirm the VM's recent heartbeat entries?

You already created a metric alert rule. You want the alert to send email and call a webhook when it fires. Which component should you link to the alert rule?

A help desk analyst needs to find Azure VM heartbeat records in Log Analytics and limit results to the last 30 minutes. Which two KQL elements should be used? Select two.

A customer wants official information about whether an Azure service issue is affecting their subscription or the wider Azure platform. Which two sources should they check? Select two.

Your company wants to query performance and event data from multiple Azure virtual machines by using Kusto Query Language. The operations team also wants to centralize retention and analysis of this data. What should you deploy?

A virtual machine is already protected by Azure Backup. The business wants the VM backed up every day at 11:00 PM and wants daily recovery points retained for 30 days, without re-onboarding the VM. What should the administrator modify?

An administrator enabled diagnostic settings on an Azure Storage account using the resource-specific schema. A coworker then ran a query against AzureDiagnostics and got no rows, even though failed blob writes occurred during the last hour. What is the best fix?

Based on the exhibit, what should the administrator configure so storage logs can be queried later with KQL?

Based on the exhibit, which KQL clause should replace the blank to show only heartbeat records from the last 30 minutes?

A virtual machine is already protected by Azure Backup. The current policy runs daily at 23:00 and keeps daily recovery points for 30 days. The business now wants the same schedule but wants new daily recovery points retained for 90 days. No new vault or re-registration should occur. What should the administrator do?

A Virtual Machine Scale Set must add instances automatically when average CPU usage is above 75 percent and remove instances when CPU drops below 30 percent. Which feature should you configure?

Based on the exhibit, what should the administrator check first to resolve the backup failure for the Azure VM?

Based on the exhibit, a VM is protected by Azure Backup. The business wants daily backups at 11:00 PM, retention of daily recovery points for 30 days, and no changes to the existing vault or VM. The current policy already backs up every day but keeps recovery points for only 7 days. What should the administrator modify?

In Log Analytics, you need to find AzureActivity records for VM stop or deallocate operations from the last 24 hours. Which query should you use?

A team wants an email and SMS notification whenever the average CPU on a production VM stays above 85% for 10 minutes. The same notification setup may be reused by other alerts later. Which Azure feature should you configure?

A platform team wants to investigate incidents involving Azure VM performance, storage failures, and subscription-level changes in one place. They want to minimize Log Analytics ingestion cost. Which telemetry approach should they use?

Based on the exhibit, where should the administrator go next to review the failed backup job details?

A Windows VM fails shortly after startup when a custom extension runs, and the administrator cannot use RDP to inspect the machine. The goal is to see what happened during boot and confirm whether the failure occurred before the guest OS finished loading. Which two features should be used first? Select two.

An administrator enabled Azure VM backup yesterday and now wants to confirm whether the most recent backup job succeeded. Which two places can they check? Select two.

A VM suddenly stops responding, and the operations team needs to determine whether the issue is caused by a Microsoft platform problem or is isolated to that specific VM. Which two Azure portal features should be reviewed? Select two.

Based on the exhibit, a security team wants to search Key Vault audit events in Log Analytics for 30 days and create alerts when secrets are accessed unexpectedly. The current diagnostic configuration is not sending the right data. What should the administrator enable?