AZ-104 Monitor and Maintain Azure Resources Practice Questions

Free AZ-104 Monitor and Maintain Azure Resources practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main AZ-104 page. Sign up free to practice the full set.

1. Question 1Monitor and Maintain Azure Resources

   You are writing a KQL query to find events from the last 24 hours. Which function represents 'the current time minus 24 hours'?

   • Alast(24h)
   • Btimespan(24h)
   • Cwithin(24h)
   • Dago(24h)Correct
   ✓ Correct answer: D

   The ago() function in Kusto Query Language (KQL) returns a datetime value equal to the current UTC clock time minus the specified timespan. The expression ago(24h) evaluates to exactly 24 hours before the current time. This function is commonly used in where clauses to filter records to a specific time window, for example: | where TimeGenerated > ago(24h). The timespan parameter supports various units including d (days), h (hours), m (minutes), and s (seconds).

   Why the other options are wrong

   • Alast(24h) is incorrect because last() is not a valid KQL time function; KQL uses ago() for relative time calculations.
   • Btimespan(24h) is incorrect because timespan is a data type in KQL, not a function that returns the current time minus a duration.
   • Cwithin(24h) is incorrect because within() is not a valid KQL function for time-based filtering.
2. Question 2Monitor and Maintain Azure Resources

   Litware Inc. needs to configure diagnostic settings for their Azure resources. They want to send platform logs and metrics to a Log Analytics workspace for analysis, to a storage account for long-term archival, and to an event hub for integration with a third-party SIEM solution. You need to configure this. What should you do?

   • AEnable diagnostic settings at the subscription scope to inherit down to all three destinations for each resource.
   • BCreate a single diagnostic setting on each resource sending data to a Log Analytics workspace, storage account, and event hub.Correct
   • CCreate three separate diagnostic settings on each resource, one for each of the three destinations.
   • DUse an Azure Policy deployIfNotExists initiative that assigns diagnostic settings to only one destination per resource.
   ✓ Correct answer: B

   Azure diagnostic settings allow you to configure a single diagnostic setting on each resource that sends platform logs and metrics to multiple destinations simultaneously, including a Log Analytics workspace, a storage account, and an event hub. This is the most efficient approach because it requires only one diagnostic setting per resource while satisfying all three routing requirements. Each destination serves a different purpose: Log Analytics for interactive analysis, storage for long-term archival, and event hub for streaming to external systems like a SIEM.

   Why the other options are wrong

   • ADiagnostic settings are configured per resource and do not inherit from the subscription scope down to individual resources.
   • CThree separate settings work but add needless management overhead when one setting can target all three destinations at once.
   • DA deployIfNotExists policy can create settings at scale, but this option routes to only one destination and omits the other two.
3. Question 3Monitor and Maintain Azure Resources

   Fabrikam Inc wants to centralize logs from all Azure resources, including activity logs, diagnostic logs, and application logs, into a single location for analysis and querying. What should you use?

   • AAzure Queue Storage
   • BAzure Event Hub
   • CAzure Log Analytics workspaceCorrect
   • DAzure Blob Storage
   ✓ Correct answer: C

   A Log Analytics workspace is the central repository in Azure Monitor for collecting, storing, and analyzing log data from multiple sources. It supports ingestion of activity logs, diagnostic logs, resource logs, and application telemetry from Application Insights. Once centralized in a Log Analytics workspace, you can use Kusto Query Language (KQL) to perform powerful queries, create visualizations, and set up log-based alerts. This makes it the ideal solution for organizations that need a unified location for log analysis across all Azure resources.

   Why the other options are wrong

   • AAzure Queue Storage is incorrect because Queue Storage is a messaging service for decoupling application components and does not provide log collection, storage, or query capabilities.
   • BAzure Event Hub is incorrect because Event Hubs is a streaming data ingestion service designed for high-throughput event processing and is typically used to stream logs to third-party SIEM solutions, not for direct querying and analysis.
   • DAzure Blob Storage is incorrect because while Blob Storage can archive log data for long-term retention, it does not provide built-in query or analysis capabilities like KQL.
4. Question 4Monitor and Maintain Azure Resources

   You manage a Recovery Services vault that backs up 20 Azure VMs. You need to verify that all VMs were successfully backed up in the last 24 hours and identify any failed backup jobs. What should you use?

   • AAzure Advisor reliability recommendations
   • BAzure Activity Log for the resource group
   • CVM boot diagnostics
   • DThe Backup Jobs view in the Recovery Services vaultCorrect
   ✓ Correct answer: D

   The Backup Jobs view in the Recovery Services vault provides a centralized dashboard showing all backup and restore operations, including their status (completed, failed, in progress, or completed with warnings), duration, data transferred, and recovery point details. You can filter jobs by time range, job status, resource type, and specific VMs to quickly identify any failed backup jobs within the last 24 hours. The view also provides detailed error information for failed jobs, enabling you to diagnose and remediate backup failures promptly.

   Why the other options are wrong

   • AAzure Advisor reliability recommendations is incorrect because Advisor provides general reliability recommendations for improving resource availability and resilience, but it does not show the detailed status of individual backup jobs or identify specific backup failures.
   • BAzure Activity Log for the resource group is incorrect because the Activity Log records management plane operations performed on Azure resources, and while it may show some backup-related events, it does not provide the detailed backup job status, failure reasons, and job-level filtering available in the Backup Jobs view.
   • CVM boot diagnostics is incorrect because boot diagnostics captures VM startup screenshots and serial console output to help diagnose VM boot issues, and it has no relation to backup job monitoring or status.
5. Question 5Monitor and Maintain Azure Resources

   Parnell Aerospace has implemented Azure Update Manager to manage OS updates across their fleet of Azure VMs. They need to schedule monthly patch deployments during a maintenance window on the first Saturday of each month. Which feature should they configure?

   • AMaintenance configurations with a scheduled recurring windowCorrect
   • BAzure Automation Update Management with a one-time deployment
   • CAzure Policy to enforce automatic OS updates
   • DCustom Script Extension running Windows Update on a schedule
   ✓ Correct answer: A

   Azure Update Manager uses maintenance configurations to define scheduled maintenance windows for patch deployments. You can configure recurring schedules that specify the exact timing, such as the first Saturday of each month, along with the start time, duration, time zone, and reboot preferences. Maintenance configurations provide enterprise-grade scheduling capabilities that ensure patches are deployed during approved maintenance windows, minimizing disruption to production workloads while maintaining compliance with patching requirements.

   Why the other options are wrong

   • BAzure Automation Update Management with a one-time deployment is incorrect because a one-time deployment does not recur monthly and Azure Update Manager has replaced the legacy Azure Automation Update Management solution.
   • CAzure Policy to enforce automatic OS updates is incorrect because Azure Policy can audit update compliance and enforce configurations but does not provide the scheduling capabilities needed for controlled monthly patch deployments.
   • DCustom Script Extension running Windows Update on a schedule is incorrect because Custom Script Extensions lack the robust scheduling, reporting, compliance tracking, and maintenance window management capabilities provided by Azure Update Manager.
6. Question 6Monitor and Maintain Azure Resources

   You review the backup status shown in the table. Which backup item has a potential problem?

   • AVM-Prod-SQL
   • BVM-Prod-WebCorrect
   • CFileShare-Prod
   • DVM-Dev
   ✓ Correct answer: B

   VM-Prod-Web is configured for daily backups, yet the last successful backup was 3 days ago. This indicates that backup jobs have been failing for at least 2 consecutive days. In Azure Backup, when a backup item misses its scheduled backup for more than the expected interval, it should be flagged as having a potential problem. Consistent backup failures can lead to data loss in the event of a disaster, making this a critical issue that requires immediate investigation. Common causes include VM agent communication issues, insufficient storage account permissions, or locked resources preventing snapshots.

   Why the other options are wrong

   • AVM-Prod-SQL is incorrect because its backup status shows it is completing backups on schedule according to its configured policy.
   • CFileShare-Prod is incorrect because its backup status indicates successful backups within the expected timeframe for its configured backup frequency.
   • DVM-Dev is incorrect because its backup status shows it is completing backups within the expected schedule, and as a development resource, it may have a less frequent backup policy that is still being met.
7. Question 7Monitor and Maintain Azure Resources

   Fabrikam Inc uses Azure Site Recovery (ASR) to replicate Azure VMs from the East US region to the West US 2 region. The disaster recovery configuration has been active for six months. The compliance team requires that the DR setup be tested quarterly without any impact on production workloads. A junior administrator proposes running a test failover to validate the recovery plan. During a test failover in Azure Site Recovery, the original source VMs in East US continue to run without interruption. The test failover creates temporary VMs in West US 2 using an isolated virtual network, and production replication continues unaffected throughout the test. Statement: The junior administrator's understanding is correct that a test failover in Azure Site Recovery does NOT stop replication or affect the source VMs in the primary region.

   • ATrueCorrect
   • BFalse
   ✓ Correct answer: A

   A test failover in Azure Site Recovery is specifically designed to validate disaster recovery configurations without any impact on production workloads. During a test failover, ASR creates temporary replica VMs in the target region using an isolated virtual network that has no connectivity to the production environment. The source VMs in the primary region (East US) continue running without interruption, and ongoing replication from the source to the target region continues unaffected throughout the test. After validation is complete, the test failover can be cleaned up, which deletes the temporary VMs. This makes test failover the recommended method for quarterly DR drills required by compliance mandates. This is confirmed by Microsoft Azure documentation for the AZ-104 exam.

   Why the other options are wrong

   • BFalse is incorrect. The statement is true: A test failover in Azure Site Recovery is specifically designed to validate disaster recovery configurations without any impact on production workloads.
8. Question 8Monitor and Maintain Azure Resources

   You have the action groups shown in the table. During a major incident, the AG-Critical action group is triggered 20 times in 10 minutes. How many SMS messages does the on-call person receive?

   • A20 messages
   • B2 messagesCorrect
   • C10 messages
   • D1 message
   ✓ Correct answer: B

   Azure Monitor action groups enforce rate limiting on SMS notifications to prevent notification flooding. The SMS-OnCall action in the AG-Critical action group has a rate limit of maximum 1 SMS per 5 minutes. When the action group is triggered 20 times within a 10-minute window, the first trigger immediately sends an SMS. After that, the 5-minute rate limit cooldown begins. During the next 5 minutes, all additional triggers are suppressed for SMS. After the 5-minute cooldown expires, the next trigger sends a second SMS. The remaining triggers within the 10-minute window do not produce additional SMS messages. Rate limiting applies independently per notification type, so email and webhook actions in the same action group are not affected by the SMS rate limit.

   Why the other options are wrong

   • A20 messages is incorrect because SMS rate limiting restricts delivery to 1 message per 5 minutes, not 1 per trigger.
   • C10 messages is incorrect because the rate limit is 1 per 5 minutes, not 1 per minute.
   • D1 message is incorrect because the 10-minute window allows for two 5-minute intervals, so 2 messages can be delivered.

How Monitor and Maintain Azure Resources is tested

This domain holds 142 of the 956 questions in the AZ-104 bank, about 15%. The mix is 67 single-answer multiple choice, 19 multiple-response, 16 yes/no scenario, 15 true/false, 15 hotspot and 10 ordering, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill Monitor and Maintain Azure Resources on its own rather than re-running full-length mocks.

Other AZ-104 exam domains

• Manage Azure Identities and Governance225 questions
• Implement and Manage Storage195 questions
• Deploy and Manage Azure Compute Resources200 questions
• Implement and Manage Virtual Networking194 questions
• All AZ-104 practice questions956 total
• Monitor and Maintain Azure Resources study notesKey concepts
• Microsoft practice examsAll Microsoft

AZ-104 Monitor and Maintain Azure Resources FAQ