AZ-104 Monitor and Maintain Azure Resources Practice Questions

Free AZ-104 Monitor and Maintain Azure Resources practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main AZ-104 page. A free account includes a fixed set of 20 questions for this exam; paid access unlocks the full bank.

1. Question 1Monitor and Maintain Azure Resources

   You are writing a KQL query to find events from the last 24 hours. Which function represents 'the current time minus 24 hours'?

   • Alast(24h)
   • Btimespan(24h)
   • Cwithin(24h)
   • Dago(24h)Correct
   ✓ Correct answer: D

   The ago() function in Kusto Query Language (KQL) returns a datetime value equal to the current UTC clock time minus the specified timespan. The expression ago(24h) evaluates to exactly 24 hours before the current time. This function is commonly used in where clauses to filter records to a specific time window, for example: | where TimeGenerated > ago(24h). The timespan parameter supports various units including d (days), h (hours), m (minutes), and s (seconds).

   Why the other options are wrong

   • Alast(24h) is incorrect because last() is not a valid KQL time function; KQL uses ago() for relative time calculations.
   • Btimespan(24h) is incorrect because timespan is a data type in KQL, not a function that returns the current time minus a duration.
   • Cwithin(24h) is incorrect because within() is not a valid KQL function for time-based filtering.
2. Question 2Monitor and Maintain Azure Resources

   Litware Inc. needs to configure diagnostic settings for their Azure resources. They want to send platform logs and metrics to a Log Analytics workspace for analysis, to a storage account for long-term archival, and to an event hub for integration with a third-party SIEM solution. You need to configure this. What should you do?

   • AEnable diagnostic settings at the subscription scope to inherit down to all three destinations for each resource.
   • BCreate a single diagnostic setting on each resource sending data to a Log Analytics workspace, storage account, and event hub.Correct
   • CCreate three separate diagnostic settings on each resource, one for each of the three destinations.
   • DUse an Azure Policy deployIfNotExists initiative that assigns diagnostic settings to only one destination per resource.
   ✓ Correct answer: B

   Azure diagnostic settings allow you to configure a single diagnostic setting on each resource that sends platform logs and metrics to multiple destinations simultaneously, including a Log Analytics workspace, a storage account, and an event hub. This is the most efficient approach because it requires only one diagnostic setting per resource while satisfying all three routing requirements. Each destination serves a different purpose: Log Analytics for interactive analysis, storage for long-term archival, and event hub for streaming to external systems like a SIEM.

   Why the other options are wrong

   • ADiagnostic settings are configured per resource and do not inherit from the subscription scope down to individual resources.
   • CThree separate settings work but add needless management overhead when one setting can target all three destinations at once.
   • DA deployIfNotExists policy can create settings at scale, but this option routes to only one destination and omits the other two.
3. Question 3Monitor and Maintain Azure Resources

   Fabrikam Inc wants to centralize logs from all Azure resources, including activity logs, diagnostic logs, and application logs, into a single location for analysis and querying. What should you use?

   • AAzure Queue Storage messages
   • BAn Azure Event Hubs namespace
   • CAzure Log Analytics workspaceCorrect
   • DAzure Blob Storage archive tier
   ✓ Correct answer: C

   A Log Analytics workspace is the central repository in Azure Monitor for collecting, storing, and analyzing log data from multiple sources. It supports ingestion of activity logs, diagnostic logs, resource logs, and application telemetry from Application Insights. Once centralized in a Log Analytics workspace, you can use Kusto Query Language (KQL) to perform powerful queries, create visualizations, and set up log-based alerts. This makes it the ideal solution for organizations that need a unified location for log analysis across all Azure resources.

   Why the other options are wrong

   • AQueue Storage messages decouple application components and offer no log retention or query language.
   • BAn Event Hubs namespace streams high-volume events onward to a SIEM and cannot itself be queried with KQL.
   • DThe Blob Storage archive tier holds log files cheaply for years but provides no built-in query capability.
4. Question 4Monitor and Maintain Azure Resources

   You manage a Recovery Services vault that backs up 20 Azure VMs. You need to verify that all VMs were successfully backed up in the last 24 hours and identify any failed backup jobs. What should you use?

   • AAzure Advisor reliability recommendations for the vault
   • BAzure Activity Log filtered to the resource group
   • CVM boot diagnostics screenshots
   • DThe Backup Jobs view in the Recovery Services vaultCorrect
   ✓ Correct answer: D

   The Backup Jobs view in the Recovery Services vault provides a centralized dashboard showing all backup and restore operations, including their status (completed, failed, in progress, or completed with warnings), duration, data transferred, and recovery point details. You can filter jobs by time range, job status, resource type, and specific VMs to quickly identify any failed backup jobs within the last 24 hours. The view also provides detailed error information for failed jobs, enabling you to diagnose and remediate backup failures promptly.

   Why the other options are wrong

   • AAdvisor reliability recommendations propose resilience improvements and never list individual backup job outcomes.
   • BThe Activity Log records management-plane operations and lacks the per-job status, failure reason and 24-hour filter this check needs.
   • CBoot diagnostics screenshots help with startup problems and hold nothing about backup job status.
5. Question 5Monitor and Maintain Azure Resources

   Parnell Aerospace has implemented Azure Update Manager to manage OS updates across their fleet of Azure VMs. They need to schedule monthly patch deployments during a maintenance window on the first Saturday of each month. Which feature should they configure?

   • AMaintenance configurations with a scheduled recurring windowCorrect
   • BAzure Automation Update Management with a one-time deployment
   • CAzure Policy to enforce automatic OS updates
   • DCustom Script Extension running Windows Update on a schedule
   ✓ Correct answer: A

   Azure Update Manager uses maintenance configurations to define scheduled maintenance windows for patch deployments. You can configure recurring schedules that specify the exact timing, such as the first Saturday of each month, along with the start time, duration, time zone, and reboot preferences. Maintenance configurations provide enterprise-grade scheduling capabilities that ensure patches are deployed during approved maintenance windows, minimizing disruption to production workloads while maintaining compliance with patching requirements.

   Why the other options are wrong

   • BAzure Automation Update Management with a one-time deployment is incorrect because a one-time deployment does not recur monthly and Azure Update Manager has replaced the legacy Azure Automation Update Management solution.
   • CAzure Policy to enforce automatic OS updates is incorrect because Azure Policy can audit update compliance and enforce configurations but does not provide the scheduling capabilities needed for controlled monthly patch deployments.
   • DCustom Script Extension running Windows Update on a schedule is incorrect because Custom Script Extensions lack the robust scheduling, reporting, compliance tracking, and maintenance window management capabilities provided by Azure Update Manager.
6. Question 6Monitor and Maintain Azure Resources

   You review the backup status shown in the table. Which backup item has a potential problem?

   • AVM-Prod-SQL
   • BVM-Prod-WebCorrect
   • CFileShare-Prod
   • DVM-Dev
   ✓ Correct answer: B

   VM-Prod-Web is configured for daily backups, yet the last successful backup was 3 days ago. This indicates that backup jobs have been failing for at least 2 consecutive days. In Azure Backup, when a backup item misses its scheduled backup for more than the expected interval, it should be flagged as having a potential problem. Consistent backup failures can lead to data loss in the event of a disaster, making this a critical issue that requires immediate investigation. Common causes include VM agent communication issues, insufficient storage account permissions, or locked resources preventing snapshots.

   Why the other options are wrong

   • AVM-Prod-SQL is incorrect because its backup status shows it is completing backups on schedule according to its configured policy.
   • CFileShare-Prod is incorrect because its backup status indicates successful backups within the expected timeframe for its configured backup frequency.
   • DVM-Dev is incorrect because its backup status shows it is completing backups within the expected schedule, and as a development resource, it may have a less frequent backup policy that is still being met.
7. Question 7Monitor and Maintain Azure Resources

   Fabrikam Inc uses Azure Site Recovery (ASR) to replicate Azure VMs from the East US region to the West US 2 region. The disaster recovery configuration has been active for six months. The compliance team requires that the DR setup be tested quarterly without any impact on production workloads. A junior administrator proposes running a test failover to validate the recovery plan. During a test failover in Azure Site Recovery, the original source VMs in East US continue to run without interruption. The test failover creates temporary VMs in West US 2 using an isolated virtual network, and production replication continues unaffected throughout the test. Statement: The junior administrator's understanding is correct that a test failover in Azure Site Recovery does NOT stop replication or affect the source VMs in the primary region.

   • ATrueCorrect
   • BFalse
   ✓ Correct answer: A

   A test failover in Azure Site Recovery is specifically designed to validate disaster recovery configurations without any impact on production workloads. During a test failover, ASR creates temporary replica VMs in the target region using an isolated virtual network that has no connectivity to the production environment. The source VMs in the primary region (East US) continue running without interruption, and ongoing replication from the source to the target region continues unaffected throughout the test. After validation is complete, the test failover can be cleaned up, which deletes the temporary VMs. This makes test failover the recommended method for quarterly DR drills required by compliance mandates. This is confirmed by Microsoft Azure documentation for the AZ-104 exam.

   Why the other options are wrong

   • BFalse is incorrect. The statement is true: A test failover in Azure Site Recovery is specifically designed to validate disaster recovery configurations without any impact on production workloads.
8. Question 8Monitor and Maintain Azure Resources

   You have the action groups shown in the table. During a major incident, the AG-Critical action group is triggered 20 times in 10 minutes. How many SMS messages does the on-call person receive?

   • A20 messages
   • B2 messagesCorrect
   • C10 messages
   • D1 message
   ✓ Correct answer: B

   Azure Monitor action groups enforce rate limiting on SMS notifications to prevent notification flooding. The SMS-OnCall action in the AG-Critical action group has a rate limit of maximum 1 SMS per 5 minutes. When the action group is triggered 20 times within a 10-minute window, the first trigger immediately sends an SMS. After that, the 5-minute rate limit cooldown begins. During the next 5 minutes, all additional triggers are suppressed for SMS. After the 5-minute cooldown expires, the next trigger sends a second SMS. The remaining triggers within the 10-minute window do not produce additional SMS messages. Rate limiting applies independently per notification type, so email and webhook actions in the same action group are not affected by the SMS rate limit.

   Why the other options are wrong

   • A20 messages is incorrect because SMS rate limiting restricts delivery to 1 message per 5 minutes, not 1 per trigger.
   • C10 messages is incorrect because the rate limit is 1 per 5 minutes, not 1 per minute.
   • D1 message is incorrect because the 10-minute window allows for two 5-minute intervals, so 2 messages can be delivered.

How Monitor and Maintain Azure Resources is tested

This domain holds 142 of the 955 questions in the AZ-104 bank, about 15%. The mix is 67 single-answer multiple choice, 19 multiple-response, 16 yes/no scenario, 15 true/false, 15 hotspot and 10 ordering, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill Monitor and Maintain Azure Resources on its own rather than re-running full-length mocks.

Other AZ-104 exam domains

• Manage Azure Identities and Governance224 questions
• Implement and Manage Storage195 questions
• Deploy and Manage Azure Compute Resources200 questions
• Implement and Manage Virtual Networking194 questions
• All AZ-104 practice questions955 total
• Monitor and Maintain Azure Resources study notesKey concepts
• Microsoft practice examsAll Microsoft

AZ-104 Monitor and Maintain Azure Resources FAQ