AZ-104 Monitor and Maintain Azure Resources Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use a metric alert for the VM CPU metric.

  Why this is correct

  Azure Monitor exposes the Percentage CPU metric for Azure VMs at the hypervisor level, independent of the guest OS or any agent. A metric alert can evaluate this time series continuously, trigger on average CPU thresholds, and does not incur Log Analytics ingestion costs since the data is already collected by the platform. For a small set of Linux VMs, this is the most direct and cost-effective monitoring path because it produces no additional telemetry and supports sub-minute evaluation frequencies.

• ✓

  Install Azure Monitor Agent and collect only the disk-free-space counter by using a minimal data collection rule.

  Why this is correct

  Guest OS disk free space is not exposed as a platform metric, so you must collect it from inside the VM with an agent. Installing the Azure Monitor Agent and creating a narrow data collection rule (DCR) that limits collection to just the free-space performance counter minimizes ingestion volume and keeps Log Analytics costs predictable. This targeted DCR streams only the necessary metric into the workspace, allowing you to create a log alert on the Perf table without ingesting unrelated syslog or event data. The minimal footprint directly aligns with the requirement to monitor only average CPU and disk free space.

• ✗

  Enable full VM Insights for every guest performance counter.

  Why it's wrong here

  Enabling full VM Insights turns on a large predefined set of guest health, performance, and dependency telemetry, including memory, network, logical disk, and process information. That goes far beyond the stated requirement of average CPU and disk free space, causing unnecessary Log Analytics ingestion and higher operational overhead. VM Insights also deploys the Dependency Agent, adding more listener endpoints and data flows. For only two metrics, a lightweight Azure Monitor Agent with a focused DCR is the appropriate alternative.

  When this WOULD be correct

  If the question asked for comprehensive monitoring of VM performance and health, including memory, network, and disk I/O, with cost being a secondary concern, enabling full VM Insights would be appropriate.

• ✗

  Stream all syslog and event logs to a workspace before creating any alert.

  Why it's wrong here

  Streaming all syslog and event logs to a Log Analytics workspace before creating alerts is an overly broad monitoring strategy. Syslog captures kernel, daemon, and authentication messages, while event logs include application and security events, none of which are needed to track average CPU or disk free space. This indiscriminate ingestion increases per‑GB costs, complicates alert queries, and creates noisy data that can trigger false positives. The correct approach is to collect only the specific performance counters required, as a permissive logging rule is antithetical to cost minimization.

  When this WOULD be correct

  If the question required comprehensive security auditing or compliance logging for all VMs, and cost was not a primary constraint, then streaming all syslog and event logs to a workspace would be correct to ensure full log collection and analysis.

• ✗

  Rely on Azure Resource Health to measure guest OS disk free space.

  Why it's wrong here

  Azure Resource Health is designed to report on the availability of Azure services, the underlying physical host, and the network connectivity between them—it does not see inside the guest operating system. Disk free space is an in‑guest metric that depends on the OS file system state, which Resource Health cannot access or measure. Relying on it would never produce a disk capacity alert because it only detects platform-level failures like host reboots or network outages. Guest disk monitoring requires an agent such as the Azure Monitor Agent to emit performance counters.

  When this WOULD be correct

  If the question asked about monitoring the health of Azure resources (e.g., VM availability, platform issues) without needing guest OS metrics, Azure Resource Health would be the correct choice for low-cost, built-in monitoring.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question