AZ-104 Monitor and Maintain Azure Resources Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use Azure Monitor metric alerts for the threshold conditions.

  Why this is correct

  Metric alerts evaluate native platform metrics directly and do not require broad log ingestion, so they are usually the most cost-aware option for threshold monitoring. For CPU and capacity-type measurements that are available as metrics, this approach gives near real-time alerting with minimal telemetry overhead. It fits the requirement to monitor multiple resources while keeping data collection costs down.

• ✗

  Send all VM diagnostic logs to Log Analytics and create only log search alerts.

  Why it's wrong here

  Routing all VM diagnostic logs into Log Analytics and creating only log search alerts would require continuous ingestion, indexing, and retention of performance data, incurring significant costs. Log search alerts also run KQL queries at fixed intervals (e.g., every 5 minutes), which delays detection and adds query processing fees. For simple threshold conditions on CPU and storage, Azure Monitor metric alerts are cheaper, faster, and avoid the overhead of log ingestion entirely.

  When this WOULD be correct

  This option would be correct if the question required detailed log-based analysis (e.g., custom queries, error patterns) and cost was not a primary constraint, or if the organization already had a Log Analytics workspace with unused data capacity.

• ✗

  Create a Recovery Services vault backup policy with a short retention period.

  Why it's wrong here

  A Recovery Services vault backup policy defines how often VM backups run and how long recovery points are retained to enable restores. It does not interact with live VM performance counters, nor does it evaluate storage capacity or CPU load in real time. Because it is strictly a data-protection mechanism, it cannot emit threshold-triggered alerts for operational health.

  When this WOULD be correct

  This option would be correct if the question asked for a cost-effective way to ensure VM backups are retained for a minimal duration to reduce storage costs while meeting compliance requirements.

• ✗

  Assign Azure Policy to the subscription to audit CPU and storage trends.

  Why it's wrong here

  Azure Policy is a governance service that enforces and audits compliance of resource configurations (like tagging or allowed VM SKUs) against custom definitions. It never collects runtime telemetry such as CPU utilization or storage free space, and its evaluation cycle is event-driven or periodic, not threshold-based. As a result, it cannot generate the operational alerts required for CPU and storage capacity thresholds.

  When this WOULD be correct

  When the requirement is to enforce compliance rules (e.g., ensuring all VMs have a specific tag or disk encryption) and audit historical configuration changes, not to alert on performance thresholds.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question