AZ-104 practice by domain

AZ-104 Monitoring Practice Questions

Ten practice questions from the CramHQ AZ-104 bank for Monitor and Maintain Azure Resources, with answers and explanations. No signup needed.

Start the free AZ-104 diagnostic AZ-104 practice tests
Question 1 of 10Monitor and Maintain Azure Resources

CramHQ runs regional inference VM scale sets that call a private control API over peered virtual networks. After route changes, brief failures and latency spikes occur, but manual checks usually pass by the time engineers investigate. Operations need recurring evidence from each region, trend data for the application connection, and Azure-side location of future degradation. Which recommendation best meets the requirement?

  1. Create an Azure Network Watcher connection monitor with the API FQDN as source, VM scale sets as destinations, TCP/HTTP tests, metrics, logs, and alerts.
  2. Use Azure Network Watcher next hop from each VM instance to the API private IP during route changes, and compare the returned next hop to expected routes.
  3. Create an Azure Network Watcher connection monitor with VM scale set sources, the API FQDN or IP as destination, TCP/HTTP tests, metrics, logs, and alerts.
  4. Run Azure Network Watcher connection troubleshoot from each affected VM instance to the API FQDN after incidents, using TCP/HTTP probes and exporting results for review.
Show answer and explanation

Answer: C

This uses supported workload-side sources and repeatedly probes the target with protocol-specific tests. It provides reachability and latency trends plus diagnostics that can show where Azure-side degradation appears.

If you picked A

Why it is tempting: The choice includes TCP/HTTP tests, metrics, logs, and alerts, which match the continuous monitoring requirement.

Why it is wrong: For Connection Monitor, place supported compute resources such as VM instances or VM scale sets as sources and the API FQDN or IP address as the destination.

If you picked B

Why it is tempting: Next hop is relevant when you need to verify route selection from a VM network interface to a destination IP.

Why it is wrong: Use next hop for point-in-time route inspection, not for recurring protocol success, latency trends, logs, and alerts.

If you picked D

Why it is tempting: Connection troubleshoot can test connectivity from a VM to a target and can be useful during an active incident.

Why it is wrong: Use Connection Monitor when evidence must be collected continuously before, during, and after intermittent failures.

Question 2 of 10Monitor and Maintain Azure Resources

CramHQ has many existing Azure Monitor alerts across resource groups. During regional maintenance, responders must not receive pages for affected test resources in one subscription, but alert records should still be created and normal routing must resume automatically afterward. Which recommendation best meets this need with minimal rule changes?

  1. Create an Azure Monitor alert processing rule in the same subscription, scope it to the affected resources, choose Suppress notifications, and configure the maintenance schedule.
  2. Create a scheduled query rule that excludes maintenance resources during the window and attach the existing Azure Monitor action group to the new rule.
  3. Create a new Azure Monitor action group for maintenance, update the affected alert rules to use it, and remove recipients until maintenance ends.
  4. Disable the affected Azure Monitor alert rules before maintenance, then re-enable them after the maintenance window by using Automation runbooks.
Show answer and explanation

Answer: A

This preserves fired alert records while preventing associated notifications only for matching resources during the configured time window. The same-subscription scope and schedule let existing alert rules return to normal without per-rule edits.

If you picked B

Why it is tempting: Scheduled query rules sound schedule-aware and can filter log data, so they can look useful during maintenance.

Why it is wrong: Choose the alert rule type based on the monitored signal; choose a processing rule when existing fired alerts need different notification handling.

If you picked C

Why it is tempting: Action groups do control who gets notified, so editing them can appear to solve a paging problem.

Why it is wrong: Use action groups for normal notification destinations; use alert processing rules for scoped, scheduled suppression across matching fired alerts.

If you picked D

Why it is tempting: Disabling alert rules is a direct way to stop noise during maintenance and automation can re-enable them later.

Why it is wrong: Do not disable alert rules when the requirement says alert records must still be created; suppress notifications after the alert fires.

Question 3 of 10Monitor and Maintain Azure Resources

CramHQ research teams store experiment outputs on an Azure file share mounted by short-lived compute nodes. Operators must recover accidentally deleted folders from that share for 30 days, even after the nodes are rebuilt. Which configuration should you recommend?

  1. Use Azure Backup for Azure Blobs in a Backup vault; protect the storage account with a policy that retains operational recovery points for 30 days.
  2. Use Azure Disk Backup in a Backup vault; protect the managed disks attached to the compute nodes with a policy that retains snapshots for 30 days.
  3. Use Azure Backup for Azure Files in a Recovery Services vault; protect the file share with a backup policy that retains daily recovery points for 30 days.
  4. Use Azure Backup for Azure virtual machines in a Recovery Services vault; protect each compute node with a VM backup policy that retains daily recovery points for 30 days.
Show answer and explanation

Answer: C

This targets the shared file data directly and applies retention to recovery points for that share, so folder-level recovery remains available even when the mounting compute nodes are replaced.

If you picked A

Why it is tempting: The option mentions storage protection and a 30-day recovery window, which mirrors part of the requirement.

Why it is wrong: Azure Blob backup protects blob data; Azure file shares require Azure Backup for Azure Files at the file-share boundary.

If you picked B

Why it is tempting: The nodes process the data, so protecting their managed disks can seem like it protects the files they access.

Why it is wrong: Azure Disk Backup protects managed disks; it does not protect independent Azure file share contents mounted by those machines.

If you picked D

Why it is tempting: VM backup in a Recovery Services vault supports scheduled retention, so it can look aligned with the 30-day requirement.

Why it is wrong: Azure VM backup protects VM state and attached disks; it is not the correct protected item for a separate Azure file share.

Show all 10 practice questions
Question 4 of 10Monitor and Maintain Azure Resources

CramHQ changed several Azure route tables and security rules after deploying a new fraud analytics subnet. A specific VM can no longer receive HTTPS requests from an app subnet, and the team needs the fastest way to identify whether Azure currently allows that exact inbound flow and which rule is involved. What should you recommend?

  1. Use Packet capture on the VM and filter for TCP port 443 from the app subnet.
  2. Use Next hop from the VM to the app subnet address and review the selected route for the path.
  3. Use IP flow verify for the VM, specifying inbound TCP traffic from the app subnet to port 443.
  4. Use Connection troubleshoot from the VM to the app subnet address on TCP port 443.
Show answer and explanation

Answer: C

IP flow verify evaluates whether traffic is allowed or denied to or from a VM for a specified direction, protocol, local and remote IP, and port, and returns the security rule affecting the decision.

“whether Azure currently allows that exact inbound flow and which rule is involved”

What to notice

The requirement is not just to observe packets or inspect routing; it asks for a current allow-or-deny decision for one specified inbound flow and the rule behind that decision.

How to decide

Compare tools by whether they can test a single source, destination, protocol, port, and direction and return the rule that controls the result.

If you picked A

Why it is tempting: Filtering a capture for TCP port 443 sounds targeted and can help inspect traffic after it appears on the VM.

Why it is wrong: Use IP flow verify when the required output is whether Azure allows or denies a specified VM flow and which security rule controls it.

If you picked B

Why it is tempting: Route tables changed, so checking the selected next hop can look relevant to the outage.

Why it is wrong: Use Next hop for route-selection questions; use IP flow verify for allow or deny decisions caused by effective security rules.

If you picked D

Why it is tempting: Testing a connection to TCP port 443 sounds aligned with an HTTPS connectivity failure.

Why it is wrong: Use IP flow verify when the decisive requirement is the effective security decision for a specific VM flow.

Question 5 of 10Monitor and Maintain Azure Resources

CramHQ's dispatch service runs on an Azure VM protected by Azure Backup. At 10:20 UTC, engineers found that a deployment at 09:40 overwrote several routing configuration files. The VM is healthy and must keep serving traffic while the previous files are retrieved. Available backups include application-consistent points at 08:00 and 10:00, and a crash-consistent point at 09:50. Which recommendation best meets the goal?

  1. Use Restore disks from the 09:50 crash-consistent restore point, attach the restored disk to a helper VM, and copy the files.
  2. Use Azure Backup File Recovery from the 10:00 application-consistent restore point and copy the affected files back to the running VM.
  3. Use Replace existing disks from the 08:00 application-consistent restore point, then restart the VM with the earlier disk state.
  4. Use Azure Backup File Recovery from the 08:00 application-consistent restore point and copy the affected files back to the running VM.
Show answer and explanation

Answer: D

This uses a backup taken before the overwrite and the documented file recovery capability for Azure VM backups, allowing selected files to be copied back without replacing the VM disks.

If you picked A

Why it is tempting: Attaching a restored disk to a helper VM can seem like a safe way to extract files without directly replacing the running VM.

Why it is wrong: A recovery point must contain the desired file state, so it must be before the 09:40 overwrite.

If you picked B

Why it is tempting: The method matches a file-level restore, and application-consistent points often look preferable to crash-consistent points.

Why it is wrong: Consistency does not make a post-change recovery point valid when the goal is to retrieve the earlier file contents.

If you picked C

Why it is tempting: Replacing disks from 08:00 sounds complete because it rolls the VM back to a known earlier state.

Why it is wrong: For a healthy running VM with only several files affected, use file recovery to copy back the selected files instead of replacing existing disks.

Question 6 of 10Monitor and Maintain Azure Resources

CramHQ protects engineering VMs in Recovery Services vaults across several subscriptions. Operations wants one notification path when scheduled protection stops meeting expectations or vault safety is weakened. Planned recovery tests and retention-policy edits should remain reviewable but should not page on-call engineers. Which recommendation best fits this requirement?

  1. Use Azure Monitor activity log alerts for Microsoft.RecoveryServices vault operations, invoke an action group for failed or risky writes, and review restores or policy edits separately.
  2. Use Azure Service Health alerts for Azure Backup incidents, invoke an action group for affected regions, and review restores or policy edits separately.
  3. Use Azure Monitor scheduled query rules over AzureDiagnostics AzureBackupReport records, invoke an action group for matching records, and review restores or policy edits separately.
  4. Use built-in Azure Monitor alerts for Azure Backup job and security conditions, invoke an action group with an alert processing rule, and review restores or policy edits separately.
Show answer and explanation

Answer: D

This aligns notification with documented platform signals for job failure and security-impacting protection changes, then uses centralized notification routing. Successful restore tests and ordinary policy edits remain operational records rather than paging events.

If you picked A

Why it is tempting: Activity log alerts can call action groups and show Recovery Services vault operations, so they look like a general monitoring answer.

Why it is wrong: Use Azure Backup built-in Azure Monitor alerts for backup job and vault safety conditions; use activity logs mainly to review management-plane changes.

If you picked B

Why it is tempting: Service Health alerts are legitimate Azure notifications and can involve regional service issues that affect availability.

Why it is wrong: Use Service Health for Microsoft-reported platform incidents; use Azure Backup alerts for backup job failures and vault protection-risk conditions.

If you picked C

Why it is tempting: AzureBackupReport records can help analyze backup status and failures, and scheduled queries can send action group notifications.

Why it is wrong: Use backup reports and job views to validate protection state and analyze trends; use built-in Azure Backup alerts for documented job and security conditions that should page responders.

Question 7 of 10Monitor and Maintain Azure Resources

CramHQ is onboarding Azure VMs for a patient scheduling system in a region with multiple independent datacenters. During a datacenter-level incident, operations must restore in that same region, not a paired region. Auditors also want recovery points protected through their scheduled expiry if a compromised backup administrator tries to reduce retention or delete them. Which configuration should you recommend?

  1. Use a Recovery Services vault with Geo-redundant storage; enable Cross Region Restore and lock immutability after validation.
  2. Use a Recovery Services vault with Zone-redundant storage; enable immutability and lock the setting after validation.
  3. Use a Recovery Services vault with Zone-redundant storage; configure soft-delete retention for 180 days and leave immutability disabled.
  4. Use a Backup vault with Zone-redundant storage; enable immutability and lock the setting after validation.
Show answer and explanation

Answer: B

Azure VM backup uses a Recovery Services vault. Zone-redundant storage is designed for availability across datacenters within the region, and a locked immutable vault blocks deletion or retention-reduction operations before recovery points reach their configured expiry.

If you picked A

Why it is tempting: Geo-redundant storage sounds stronger because it protects against regional loss and Cross Region Restore adds a visible restore capability.

Why it is wrong: Use zone-redundant storage when the requirement is continuity across datacenters or availability zones within the primary region.

If you picked C

Why it is tempting: The zone-redundant storage part matches the same-region incident, and a 180-day soft-delete window sounds like strong deletion protection.

Why it is wrong: Use locked immutable vault protection when the requirement is to block deletion and retention-reducing changes before recovery points reach configured expiry.

If you picked D

Why it is tempting: The storage redundancy and locked immutability pieces align with the scenario, so the incorrect vault type is easy to overlook.

Why it is wrong: Choose the vault type based on the protected workload before evaluating vault protection settings; Azure VM backups belong in a Recovery Services vault.

Question 8 of 10Monitor and Maintain Azure Resources

CramHQ analysts investigate weekly ingestion slowdowns that may involve compute hosts, storage accounts, and virtual networks in several subscriptions. Existing platform metrics and Log Analytics data are already available. For incident reviews, they need a reusable Azure portal page where reviewers can choose the time window and affected region, then compare charts and query results across those resources. Which recommendation best supports this workflow?

  1. Create an Azure Monitor workbook with time, region, and resource parameters; add metric charts and Log Analytics query visualizations for the relevant resources.
  2. Enable Azure Monitor VM insights for the compute hosts; use the performance and map views, then pin selected charts for related storage and network resources.
  3. Use Azure Monitor storage insights for each storage account; filter the workbook templates by subscription and pin capacity, transaction, and availability views to a dashboard.
  4. Create an Azure dashboard with metric charts for the hosts, storage accounts, and virtual networks; configure each tile to show the standard incident review time range.
Show answer and explanation

Answer: A

This fits because the reviewers need a reusable portal experience that can combine existing metrics and log query results, accept parameters, and present comparisons across multiple resource types and subscriptions.

If you picked B

Why it is tempting: VM insights provides useful performance and map views for machines, which matches part of the slowdown investigation.

Why it is wrong: Use a resource-specific insight view when the operational question is centered on that resource type; use a workbook when the review must compose telemetry across several resource types.

If you picked C

Why it is tempting: Storage insights can surface capacity, transaction, and availability information, so it appears relevant when ingestion slowdowns may involve storage.

Why it is wrong: Match built-in insight views to resource-specific troubleshooting needs; choose a workbook when the review must pivot across compute, storage, and network data in one experience.

If you picked D

Why it is tempting: Azure dashboards can show metric charts for multiple resources and can look like a shared incident review page.

Why it is wrong: Use a workbook when reviewers must interactively select scope and combine metric charts with log query visualizations; use dashboards for more fixed presentation of pinned monitoring tiles.

Question 9 of 10Monitor and Maintain Azure Resources

CramHQ's payment API runs on Azure virtual machines across three application tiers. During checkout incidents, host CPU and memory stay normal, but engineers must quickly determine whether delays are concentrated on specific machine-to-machine calls inside the tier chain. Which recommendation best supports that investigation?

  1. Use Network Insights for the virtual network and review topology and health across the subnets that contain the application tiers.
  2. Use VM insights for the application machines and review the dependency map with per-machine performance data during the incident window.
  3. Use Storage insights for the payment storage accounts and compare transaction latency, availability, and error metrics during checkout failures.
  4. Use an Azure Monitor workbook scoped to the resource group and chart platform metrics for the virtual machines, NICs, and load balancer.
Show answer and explanation

Answer: B

VM insights is built for monitored machines and can show performance together with discovered dependencies, making it the best fit when the question is whether latency is tied to calls between specific instances.

If you picked A

Why it is tempting: The application tiers sit in subnets, so a virtual network view can seem like the natural place to start.

Why it is wrong: Use Network Insights for Azure network resource topology and health; use VM insights dependency mapping when the question is about calls between monitored machines.

If you picked C

Why it is tempting: Payment systems often depend on storage, and checkout failures can involve transaction latency or errors.

Why it is wrong: Use Storage insights when the operational question is about storage accounts; use VM insights when the question is about dependencies between application machines.

If you picked D

Why it is tempting: Workbooks can combine charts for VMs, NICs, and load balancers, so they can look like a comprehensive investigation surface.

Why it is wrong: Use workbooks for interactive cross-resource analysis, but do not replace VM dependency mapping with platform metric charts when the question asks which machine-to-machine call is slow.

Question 10 of 10Monitor and Maintain Azure Resources

CramHQ's avionics team runs several Azure App Service instances behind a global entry point. After intermittent failures, engineers must reconstruct which caller addresses and request paths produced server errors during a 30-minute window last week. Existing threshold alerts only show that failures increased. Which recommendation best supports the investigation?

  1. Configure App Service diagnostic settings to send AllMetrics to an Azure Storage account, then review the exported files for the affected interval.
  2. Use Metrics Explorer for the App Service HTTP server errors metric, pin the chart to a dashboard, and adjust the time grain to one minute.
  3. Create an Azure Monitor metric alert on the App Service HTTP 5xx metric with dimensions split by instance and action group notifications enabled.
  4. Configure App Service diagnostic settings to send AppServiceHTTPLogs to a Log Analytics workspace, then query the workspace with Kusto Query Language.
Show answer and explanation

Answer: D

This captures per-request records in a queryable workspace, allowing engineers to filter the affected time window and analyze fields such as client address, path, and status code.

If you picked A

Why it is tempting: The option uses diagnostic settings and keeps data for the affected interval, so it looks like a retention fix.

Why it is wrong: Route the log category that contains the needed records to a destination designed for analysis, such as Log Analytics for Kusto queries.

If you picked B

Why it is tempting: A one-minute time grain can narrow the failure spike and makes the investigation feel more targeted.

Why it is wrong: Metrics summarize behavior over time; logs provide records with fields that can identify callers, paths, statuses, and timestamps.

If you picked C

Why it is tempting: Metric alerts with dimensions and action groups sound operationally strong for server errors.

Why it is wrong: Use metric alerts to detect threshold conditions; use logs when you must investigate retained event records and their fields.

CramHQ links wrong answers to the mistake behind them. The free diagnostic finds yours, then your Pass Plan works on them.