AZ-104 Monitor and Maintain Azure Resources Practice Question
You want Azure to identify security improvements, underutilized resources, and cost-saving opportunities across your subscriptions. Which Azure service should you use?
⚠ Common exam trap
Candidates often confuse Azure Advisor's proactive recommendations with Azure Policy's reactive compliance enforcement, mistakenly thinking Policy can identify underutilized resources or cost-saving opportunities when it only enforces rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Advisor
Azure Advisor is the correct service because it provides personalized recommendations across five categories: Reliability, Security, Performance, Operational Excellence, and Cost. It analyzes your deployed resources and usage patterns to identify security improvements (e.g., missing network security groups), underutilized resources (e.g., idle virtual machines), and cost-saving opportunities (e.g., reserved instance purchases). This aligns directly with the question's requirement for a unified service that delivers these insights across subscriptions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Advisor
Why this is correct
Azure Advisor is a built-in, free service that provides personalized best-practice recommendations by analyzing your Azure resources. It categorizes recommendations into Security, Reliability, Performance, and Cost, and for the security category it surfaces issues such as missing network security group rules, unencrypted storage, and exposed SQL databases, often sourced from Defender for Cloud. It also identifies underutilized virtual machines through metrics like CPU and network usage, giving it the unique ability to fulfill both 'security improvements' and 'underutilized' requirements.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is a governance service that creates, assigns, and enforces policy definitions to audit or deny resources that violate corporate standards—for example, forcing a specific VM size or requiring encryption at rest. While security-related policy effects can flag non-compliant resources, the service does not analyze dynamic utilization metrics (like CPU over a 30-day window) or provide advisory recommendations for improvements. Policy enforces what you define; Azure Advisor proactively recommends best practices you haven't yet configured, so Policy isn't the primary tool for this task.
When this WOULD be correct
Azure Policy would be correct if the question asked: 'You need to enforce tagging standards and ensure resources comply with corporate governance rules across your subscriptions. Which service should you use?'
- ✗
Azure Backup
Why it's wrong here
Azure Backup is a data protection and disaster recovery solution that securely backs up VMs, SQL/SAP databases, and file shares to Recovery Services vaults. Its primary function is to restore data after corruption, accidental deletion, or ransomware attacks; it does not perform any analysis of resource utilization or security posture. Because it neither evaluates CPU/memory usage for idle VMs nor reviews tactical security settings, it cannot generate recommendations for security improvements or underutilized resources.
When this WOULD be correct
Azure Backup would be correct if the question asked: 'Which Azure service should you use to protect your virtual machines and files from data loss by creating scheduled backups?'
- ✗
Virtual network peering
Why it's wrong here
Virtual network peering is a Layer 3 networking connectivity feature that links two VNets so resources communicate across the Microsoft backbone with low latency. Peering only changes the routing path between networks; it has no telemetry, intelligence, or recommendation engine and cannot inspect resource configuration or usage patterns. Consequently, it is a fundamental networking mechanism but lacks any capability to identify security improvements or underutilized resources.
When this WOULD be correct
When the question asks for connecting two virtual networks in different regions to enable private IP communication with low latency, Virtual network peering is the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure AdvisorCorrect answer▾
Why this is correct
Azure Advisor is a built-in, free service that provides personalized best-practice recommendations by analyzing your Azure resources. It categorizes recommendations into Security, Reliability, Performance, and Cost, and for the security category it surfaces issues such as missing network security group rules, unencrypted storage, and exposed SQL databases, often sourced from Defender for Cloud. It also identifies underutilized virtual machines through metrics like CPU and network usage, giving it the unique ability to fulfill both 'security improvements' and 'underutilized' requirements.
✗Azure PolicyWrong answer — click to see why▾
Why this is wrong here
Azure Policy enforces compliance rules and governance, but it does not proactively identify security improvements, underutilized resources, or cost-saving opportunities. Those are the specific functions of Azure Advisor.
★ When this WOULD be the correct answer
Azure Policy would be correct if the question asked: 'You need to enforce tagging standards and ensure resources comply with corporate governance rules across your subscriptions. Which service should you use?'
Why candidates choose this
Candidates may confuse Azure Policy's role in governance and compliance with Advisor's advisory capabilities, thinking policy can also provide recommendations for optimization.
✗Azure BackupWrong answer — click to see why▾
Why this is wrong here
Azure Backup is a service for backing up data and workloads, not for identifying security improvements, underutilized resources, or cost-saving opportunities. The question asks for a service that provides recommendations, which is Azure Advisor's function.
★ When this WOULD be the correct answer
Azure Backup would be correct if the question asked: 'Which Azure service should you use to protect your virtual machines and files from data loss by creating scheduled backups?'
Why candidates choose this
Candidates might confuse 'security improvements' with backup and disaster recovery, thinking that backup contributes to security posture, but Azure Backup does not analyze or recommend optimizations.
✗Virtual network peeringWrong answer — click to see why▾
Why this is wrong here
Virtual network peering connects virtual networks for traffic routing, but does not provide security recommendations, identify underutilized resources, or offer cost-saving insights.
★ When this WOULD be the correct answer
When the question asks for connecting two virtual networks in different regions to enable private IP communication with low latency, Virtual network peering is the correct answer.
Why candidates choose this
Candidates may confuse network-level connectivity with advisory services, thinking that peering can help optimize network costs or improve security by segmenting traffic.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Azure Advisor
Azure Advisor is a free, personalized cloud consultant that continuously analyzes your Azure resources and provides best practice recommendations to optimize for reliability, security, performance, operational excellence, and cost.
Key term
Network security
Network security is the practice of protecting a computer network from unauthorized access, misuse, malfunction, modification, destruction, or improper disclosure, ensuring the confidentiality, integrity, and availability of data and resources.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You want Azure to recommend ways to reduce cost, improve performance, and strengthen security across your subscriptions. Which service should you use?
medium- ✓ A.Azure Advisor
- B.Azure Policy
- C.Azure Backup
- D.Virtual network peering
Why A: Azure Advisor is the correct service because it provides personalized recommendations across your Azure subscriptions to optimize for cost, performance, reliability, and security. It analyzes your resource configuration and usage telemetry, then generates actionable recommendations such as right-sizing underutilized VMs, enabling geo-redundant storage, or applying security rules. This directly matches the question's requirement for a unified tool that suggests improvements in all three areas.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.