AZ-104 Questions 41-50: Azure Monitor, Backup, and Recovery

0
0

Focus keyphrase: AZ-104 practice questions

Use these AZ-104 practice questions to review the Monitor and maintain Azure resources objective domain for the Microsoft Azure Administrator exam. This batch focuses on Azure Monitor, metric alerts, action groups, Log Analytics, Activity Log, Service Health, Azure Backup, soft delete, file restore, Azure Site Recovery, and autoscale.

These are original certification-style practice questions based on public Microsoft exam objectives and official Azure documentation. They are realistic and exam-like, but they are not copied, paraphrased, or reconstructed from real exam-dump content.

AZ-104Questions 41-50Monitor and maintain Azure resourcesAzure Administrator
Where this fits in the series: This post continues the AZ-104 sequence after AZ-104 Questions 31-40: Azure Virtual Networking, Routing, and Load Balancing, which is currently in the review queue. Questions 41-50 move into monitoring, backup, and recovery. You can also browse the AZ-104 category for reviewed posts.

AZ-104 Questions 41-50: Azure Monitor, Backup, and Recovery practice

For each item, choose the best answer unless the question explicitly says otherwise. AZ-104 monitoring questions usually test whether you can map a requirement to the right operational tool: metric alerts, Activity Log alerts, Service Health, Log Analytics, Recovery Services vaults, Azure Backup, Azure Site Recovery, or autoscale.

Exam lens: Resource performance threshold? Think metric alert plus action group.
Exam lens: Subscription control-plane event? Think Activity Log alert.
Exam lens: Backup, restore, soft delete, or regional DR? Think Azure Backup or Site Recovery — not monitoring.
Exam tip: The fastest way through this domain is to separate observability from recoverability. Azure Monitor tells you what is happening. Azure Backup and Azure Site Recovery help you recover when the thing already happened. Tiny distinction, huge score saver.
Domain: Monitor and maintain Azure resources — configure metric alerts and action groups

Question 41: Alerting when VM CPU stays above a threshold

Scenario: A production virtual machine runs a business application. The operations team wants to be notified when the VM average Percentage CPU is greater than 90 percent for 10 minutes. The notification must send email to the on-call team and post to a webhook used by the ticketing system.

Choose one answer.

  1. Create an Activity Log alert rule for the Microsoft.Compute/virtualMachines/write operation
  2. Create an Azure Monitor metric alert rule scoped to the VM and attach an action group with email and webhook actions
  3. Create a Service Health alert for the Azure region that hosts the VM
  4. Enable boot diagnostics and review the screenshot every 10 minutes

Correct answer: B — Create an Azure Monitor metric alert rule scoped to the VM and attach an action group with email and webhook actions

Explanation: CPU percentage is a platform metric for a VM. A metric alert evaluates the metric over a window, and an action group defines the notification and automation channels such as email, SMS, webhook, Azure Functions, or ITSM integrations.

Why the other options are wrong

  • A. Activity Log alerts watch control-plane events such as create, update, delete, restart, or policy operations. They do not evaluate CPU metrics.
  • C. Service Health alerts notify you about Azure service incidents, planned maintenance, and health advisories, not one VM’s CPU usage.
  • D. Boot diagnostics can help troubleshoot VM startup and console output, but it is not an automated alerting solution.

Official reference: Azure Monitor overview and Azure Monitor alerts overview

Domain: Monitor and maintain Azure resources — collect logs with Azure Monitor Agent

Question 42: Collecting Windows event logs from Azure and hybrid servers

Scenario: A company needs to collect Windows Security event logs and performance counters from Azure VMs and from several on-premises Windows servers. The logs must be stored in a Log Analytics workspace. The on-premises servers can be onboarded to Azure Arc.

Choose one answer.

  1. Install the Azure Monitor Agent and associate the machines with a data collection rule that sends the required data to the Log Analytics workspace
  2. Create a storage account lifecycle management rule for the VM disks
  3. Enable Azure Bastion on the virtual network that contains the Azure VMs
  4. Create a metric alert on the Log Analytics workspace resource provider

Correct answer: A — Install the Azure Monitor Agent and associate the machines with a data collection rule that sends the required data to the Log Analytics workspace

Explanation: Azure Monitor Agent uses data collection rules to define what data to collect and where to send it. Azure Arc-enabled servers let you manage monitoring extensions and policies for machines outside Azure, so the same collection model can cover Azure and hybrid servers.

Why the other options are wrong

  • B. Storage lifecycle management moves or deletes blobs based on rules; it does not collect OS event logs.
  • C. Azure Bastion provides secure RDP/SSH access to VMs. It does not collect telemetry.
  • D. A metric alert can evaluate metrics, but it does not install an agent or define Windows event log collection.

Official reference: Azure Monitor overview and Data collection rules in Azure Monitor

Domain: Monitor and maintain Azure resources — configure Activity Log alerts

Question 43: Detecting deletion of a production public IP address

Scenario: The networking team wants to be notified whenever any public IP address in the production subscription is deleted. The alert should trigger from Azure control-plane events and should not depend on a VM agent.

Choose one answer.

  1. Create a VM guest performance counter alert for Network Interface Bytes Sent/sec
  2. Configure a Recovery Services vault backup policy for the public IP address
  3. Create an Activity Log alert for the Delete operation on the Microsoft.Network/publicIPAddresses resource type and attach an action group
  4. Create an Azure DNS private zone named privatelink.monitor.azure.com

Correct answer: C — Create an Activity Log alert for the Delete operation on the Microsoft.Network/publicIPAddresses resource type and attach an action group

Explanation: The Azure Activity Log records subscription-level control-plane operations, including resource deletes. Activity Log alerts are the correct tool when the requirement is to detect management operations such as delete, write, action, or policy events.

Why the other options are wrong

  • A. Guest performance counters measure workload or OS behavior, not Azure Resource Manager delete operations.
  • B. Recovery Services vaults protect supported workloads such as Azure VMs, files, SQL/SAP workloads, and similar backup items. A public IP resource is not protected this way.
  • D. Private DNS zones provide name resolution. They do not alert on resource deletions.

Official reference: Azure Monitor overview and Azure Activity Log

Domain: Monitor and maintain Azure resources — configure Service Health alerts

Question 44: Notifying application owners about Azure planned maintenance

Scenario: Application owners want advance notification when Azure planned maintenance or service incidents might affect resources in their subscription and regions. The notification must go to an email distribution list and should be based on Azure platform health information.

Choose one answer.

  1. Create a Network Watcher packet capture on every VM in the subscription
  2. Enable soft delete on every storage account
  3. Create a Log Analytics query that counts successful HTTP requests from the application gateway access log
  4. Create a Service Health alert scoped to the relevant subscriptions, regions, and event types, then attach an action group

Correct answer: D — Create a Service Health alert scoped to the relevant subscriptions, regions, and event types, then attach an action group

Explanation: Azure Service Health provides personalized information about Azure service issues, planned maintenance, and health advisories that can affect your resources. Service Health alerts can target subscriptions, services, regions, and event types, and action groups handle notifications.

Why the other options are wrong

  • A. Packet captures are useful for network troubleshooting but do not provide Azure platform maintenance notifications.
  • B. Soft delete protects data or backup items from accidental deletion depending on the service. It does not notify owners about platform health events.
  • C. A Log Analytics query against application traffic does not know whether Azure has announced a service incident or planned maintenance event.

Official reference: Azure Monitor overview and Azure Service Health documentation

Domain: Monitor and maintain Azure resources — configure Azure VM backup

Question 45: Protecting Azure VMs with daily backups

Scenario: A team needs daily backups for 40 Azure virtual machines. The solution should provide centralized backup management, retention policies, and restore points for the VMs. The team wants to use a native Azure service with minimal custom scripting.

Choose one answer.

  1. Create a Recovery Services vault, define a backup policy, and enable Azure VM backup for the VMs
  2. Create an Azure Load Balancer and add all VM NICs to the backend pool
  3. Create an Azure Policy initiative that audits missing tags only
  4. Create a Standard public IP address for each VM

Correct answer: A — Create a Recovery Services vault, define a backup policy, and enable Azure VM backup for the VMs

Explanation: Azure Backup can protect Azure VMs by storing recovery points in a Recovery Services vault. Backup policies define schedule and retention, giving administrators centralized management for backup and restore operations.

Why the other options are wrong

  • B. Load Balancer distributes traffic; it does not create VM recovery points.
  • C. An audit-only tag policy can improve governance metadata, but it does not protect VM disks or provide restores.
  • D. Public IP addresses provide inbound reachability. They do not back up VM data.

Official reference: Azure Monitor overview and Azure Backup overview and Back up Azure VMs in a Recovery Services vault

Domain: Monitor and maintain Azure resources — restore files from Azure Backup

Question 46: Restoring one accidentally deleted file from a VM

Scenario: A user accidentally deletes a configuration file from a Windows VM. The VM is protected by Azure Backup. The administrator needs to restore only that file from last night’s recovery point without replacing the entire VM or restoring all disks.

Choose one answer.

  1. Use Redeploy from the VM blade to move the VM to a new host
  2. Use File Recovery from the VM backup recovery point, run the generated script to mount the recovery point, and copy the file back to the VM
  3. Delete the VM and choose Restore VM from the oldest recovery point
  4. Create an Activity Log alert for the Microsoft.Compute/virtualMachines/restart/action operation

Correct answer: B — Use File Recovery from the VM backup recovery point, run the generated script to mount the recovery point, and copy the file back to the VM

Explanation: Azure VM backup supports file recovery. Instead of restoring the full VM or full disk, you can mount a recovery point with a generated script and copy selected files from the mounted volumes.

Why the other options are wrong

  • A. Redeploy moves a VM to a new Azure host to address host-level issues. It does not restore deleted guest files.
  • C. Full VM restore is heavier than required and may cause unnecessary downtime or overwrite changes.
  • D. Activity Log alerts detect management operations. They do not recover files.

Official reference: Azure Monitor overview and Recover files from an Azure VM backup

Domain: Monitor and maintain Azure resources — recover soft-deleted backup items

Question 47: Recovering a backup item that was accidentally deleted

Scenario: An administrator accidentally stops protection for an Azure VM backup item and deletes the backup data. Soft delete is enabled for Azure Backup. The team realizes the mistake within the soft-delete retention period and needs to recover the backup data.

Choose one answer.

  1. Create a new availability set and move the VM into it
  2. Create a new route table with a next hop type of Virtual appliance
  3. Undelete the backup item in the Recovery Services vault, then resume protection or perform a restore from the recovered recovery points
  4. Enable just-in-time VM access in Microsoft Defender for Cloud

Correct answer: C — Undelete the backup item in the Recovery Services vault, then resume protection or perform a restore from the recovered recovery points

Explanation: Soft delete for Azure Backup helps protect backup data from accidental or malicious deletion. During the retention window, soft-deleted backup items can be undeleted, after which protection can be resumed or recovery points can be used for restore.

Why the other options are wrong

  • A. Availability sets improve VM placement for availability but do not recover backup data.
  • B. Route tables affect network paths. They have no relationship to backup item recovery.
  • D. Just-in-time access reduces exposure of management ports. It does not undelete backup items.

Official reference: Azure Monitor overview and Soft delete for Azure Backup

Domain: Monitor and maintain Azure resources — configure disaster recovery

Question 48: Replicating a VM to another Azure region for disaster recovery

Scenario: A business-critical VM runs in East US. The organization needs a native Azure disaster recovery solution that continuously replicates the VM to West US and can orchestrate failover if the primary region becomes unavailable.

Choose one answer.

  1. Enable Azure Site Recovery replication for the VM to the target region and create a recovery plan if orchestration is required
  2. Create a read-access geo-redundant storage account and manually copy the OS disk VHD once a month
  3. Create an Azure Monitor metric alert for Available Memory Bytes
  4. Place the VM behind an internal Azure Load Balancer in the same virtual network

Correct answer: A — Enable Azure Site Recovery replication for the VM to the target region and create a recovery plan if orchestration is required

Explanation: Azure Site Recovery provides disaster recovery by replicating workloads and enabling failover and failback scenarios. For Azure VMs, it can replicate to another Azure region and recovery plans can coordinate multi-VM failover steps.

Why the other options are wrong

  • B. A monthly manual disk copy is not continuous replication and does not provide orchestrated failover.
  • C. Metric alerts help detect conditions but do not replicate workloads to another region.
  • D. A load balancer can distribute traffic within a region or network design. It does not provide regional disaster recovery replication.

Official reference: Azure Monitor overview and Azure Site Recovery overview

Domain: Monitor and maintain Azure resources — configure autoscale

Question 49: Scaling a VM scale set when CPU load increases

Scenario: A web tier runs on a Virtual Machine Scale Set. The team wants Azure to add instances when average CPU is above 75 percent for 15 minutes and remove instances when average CPU is below 35 percent for 30 minutes. The rule must maintain a minimum and maximum instance count.

Choose one answer.

  1. Create an inbound NAT rule on Azure Load Balancer for each instance
  2. Create a Recovery Services vault backup policy with hourly snapshots
  3. Create a private endpoint for the VM scale set
  4. Configure Azure Monitor autoscale settings for the VM scale set with scale-out and scale-in metric rules and min/max/default instance limits

Correct answer: D — Configure Azure Monitor autoscale settings for the VM scale set with scale-out and scale-in metric rules and min/max/default instance limits

Explanation: Azure Monitor autoscale can automatically adjust supported resources, including VM scale sets, based on metric rules and configured capacity boundaries. Separate scale-out and scale-in rules help respond to demand while avoiding unnecessary capacity.

Why the other options are wrong

  • A. Inbound NAT rules expose individual instance ports for management or access patterns. They do not adjust scale set capacity.
  • B. Backups protect data and recovery points. They do not add or remove running instances based on load.
  • C. Private endpoints provide private connectivity to supported PaaS resources. They are not an autoscale mechanism for VM scale sets.

Official reference: Azure Monitor overview and Autoscale in Azure Monitor

Domain: Monitor and maintain Azure resources — query logs and create workbook-style evidence

Question 50: Investigating failed requests with Log Analytics

Scenario: Application Gateway diagnostic logs are sent to a Log Analytics workspace. An administrator needs to identify the backend pool, URL path, and count of failed requests over the last 24 hours. The result should be reusable in a workbook or saved query.

Choose one answer.

  1. Create an Azure Service Health alert for all regions
  2. Write a Kusto Query Language query in Logs against the relevant Application Gateway log table, filter failed status codes and the last 24 hours, then summarize by backend pool and URL path
  3. Use Azure Bastion to connect to every backend VM and manually inspect browser history
  4. Create a site-to-site VPN connection to the on-premises network

Correct answer: B — Write a Kusto Query Language query in Logs against the relevant Application Gateway log table, filter failed status codes and the last 24 hours, then summarize by backend pool and URL path

Explanation: When diagnostic logs are collected in Log Analytics, Azure Monitor Logs uses Kusto Query Language for analysis. Filtering by time and status code and summarizing by useful dimensions is the exam-style pattern for operational investigation and workbook evidence.

Why the other options are wrong

  • A. Service Health alerts report Azure platform health, not application gateway request details.
  • C. Bastion gives secure administrative access to VMs; it is not the right way to query centralized gateway logs.
  • D. VPN Gateway creates network connectivity and does not analyze diagnostic logs.

Official reference: Study guide for Exam AZ-104: Microsoft Azure Administrator and Azure Monitor overview

Answer key: AZ-104 Questions 41-50

Question Correct answer Objective/domain
41 B configure metric alerts and action groups
42 A collect logs with Azure Monitor Agent
43 C configure Activity Log alerts
44 D configure Service Health alerts
45 A configure Azure VM backup
46 B restore files from Azure Backup
47 C recover soft-deleted backup items
48 A configure disaster recovery
49 D configure autoscale
50 B query logs and create workbook-style evidence
Watch out: If a stem says Azure platform incident, reach for Service Health. If it says delete/write/restart operation, reach for Activity Log. If it says CPU, memory, disk, or request count threshold, reach for a metric alert or log query. Azure loves these split-second tool choices.

Sources

📚 More questions from: AZ-104: Azure Administrator

Related QuestionMORE FROM AUTHOR