AZ-104 Monitor and maintain Azure resources: 112 practice questions

12 of the 112 Monitor and maintain Azure resources questions in the Certsqill AZ-104 bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for AZ-104? Take the free 5-min readiness check →

1. Schedule action-group suppression for the resource: Which action should the administrator take?

1. Schedule action-group suppression for the resource with an alert processing rule. ✓

   An alert processing rule can suppress action groups for fired alerts during a scheduled window while leaving alert evaluation enabled.
2. Remove the notification actions from the alert’s action group for the maintenance window, then restore them afterward.

   Action groups define notification and other actions, but changing one affects its configuration rather than providing a scheduled suppression of fired-alert actions.
3. Disable the metric alert rule at the start of maintenance and re-enable it afterward.

   Disabling the rule stops it from firing during the window, so it does not preserve continuous alert evaluation.
4. Add a diagnostic setting that sends the resource metrics to a Log Analytics workspace during maintenance.

   Diagnostic settings route selected metrics and logs to destinations; they do not suppress alert action groups or control notifications.

Use an alert processing rule with a maintenance schedule to suppress actions without disabling alert evaluation.

2. Probe a readiness endpoint that returns 200 only when: What should the administrator change to make backend el

1. Create a diagnostic setting that sends the load balancer’s platform metrics to Log Analytics.

   This can route platform metrics for analysis, but it does not change the health probe’s eligibility decision or the endpoint it tests.
2. Add email notifications to a metric alert monitoring the load balancer.

   Notification actions do not change the health probe used to determine backend eligibility.
3. Probe a readiness endpoint that returns 200 only when dependencies are available. ✓

   The probe determines backend eligibility, and an unrelated healthy path can conceal application unavailability. A readiness endpoint makes the probe test the condition that matters.
4. Replace the HTTPS probe with a TCP probe on port 443.

   A TCP connection can succeed while a required application dependency is unavailable.

Change the probe to a readiness path that returns HTTP 200 only when the application is ready. The probe, not diagnostics or an action group, controls backend eligibility.

3. Allow health-probe traffic from the AzureLoadBalancer: Which requirement remains unmet?

1. Change the HTTPS probe to a TCP probe so that it checks only whether the port is reachable.

   A TCP probe would not verify that `/ready` returns HTTP 200, so it would weaken the intended application-readiness check rather than satisfy it.
2. Add the backend instances to a second load-balancing rule using the same frontend.

   A load-balancing rule distributes flows but does not resolve an NSG denial of health-probe traffic. The existing probe can remain associated with its rule.
3. Configure the frontend IP address as an additional backend-pool member.

   The frontend and backend pool have distinct roles. Adding the frontend as a backend member does not permit the health probe through the denying NSG.
4. Allow health-probe traffic from the AzureLoadBalancer service tag in the applicable NSG. ✓

   The probe path now tests application readiness, but the NSG still denies the probe traffic. The NSG must allow AzureLoadBalancer traffic for the backend to be evaluated as healthy.

The readiness path is correctly configured, but the NSG still blocks Azure Load Balancer probe traffic.

4. Limit the processing rule to rg-test: Which change fixes the scope while retaining suppression for all test re

1. Limit the processing rule to rg-test. ✓

   Scoping suppression to the test group leaves production alerts unaffected.
2. Extend the subscription-wide maintenance schedule.

   A longer schedule does not fix an overly broad scope.
3. Limit the processing rule to rg-prod.

   This retains suppression on the wrong resources.
4. Disable the metric alert rules in rg-test.

   Production remains within the subscription-wide suppression rule.

Scoping suppression to the test group leaves production alerts unaffected.

5. Create an alert processing rule scoped to lb-prod: Which two actions meet both requirements?

Select two. More than one option is correct — every correct one is ticked below.

1. Create an alert processing rule scoped to lb-prod with a schedule that suppresses its action groups during the maintenance window. ✓

   An alert processing rule can suppress action groups on fired alerts for a schedule while leaving alert evaluation enabled.
2. Disable each metric alert for the duration of the maintenance window, then re-enable it afterward.

   Disabling an alert rule stops it from firing and therefore does not preserve alert evaluation during maintenance.
3. Configure guest OS telemetry collection on a backend virtual machine to obtain lb-prod resource logs.

   Guest OS telemetry concerns the virtual machine; it does not collect the Load Balancer's platform or resource logs.
4. Add law-prod as a destination of the metric alert's action group so the action group collects load balancer logs.

   Action groups define notification or other alert actions; they do not collect resource logs. A diagnostic setting is required.
5. Create a diagnostic setting on lb-prod that sends the required resource log categories to law-prod. ✓

   Diagnostic settings collect selected resource logs and route them to Log Analytics, making the required logs queryable.

Use a diagnostic setting for Load Balancer logs and an alert processing rule to suppress notifications without stopping metric evaluation.

6. Configure an HTTPS health probe for the application: Which action should you take?

1. Configure a TCP health probe on port 443 and verify that the instance remains eligible after a successful TLS handshake.

   A TCP probe verifies connectivity to the port, and a TLS handshake does not test whether the application can process HTTP requests or its dependencies are available.
2. Verify that the frontend, backend pool, and load-balancing rule exist, then treat the backend as healthy without changing the probe.

   Those resources define Load Balancer configuration but do not verify backend application readiness. Backend eligibility is determined by the health probe result.
3. Configure an HTTPS health probe for the application readiness path requiring HTTP 200, and verify that the backend becomes ineligible when the path returns a failure status. ✓

   This probe tests the required result: application-level readiness. HTTP/HTTPS probes require HTTP 200 on the configured path, and the Load Balancer uses the result to determine backend eligibility.
4. Configure an HTTP probe for the site root, verify that it returns HTTP 200, and use that result as the readiness decision.

   The site root may remain healthy while the actual application dependency is unavailable. An unrelated healthy path can conceal application unavailability.

Use an HTTP or HTTPS probe against the application’s readiness endpoint and require HTTP 200; test failure by making that endpoint return an error.

7. Yes; processing rules suppress actions after alerts fire: Is this expected?

1. No; suppression should disable the metric alert rule.

   An alert processing rule does not disable the alert rule.
2. No; suppression should prevent the metric from being collected.

   Metric collection is separate from action processing.
3. Yes; processing rules suppress actions after alerts fire. ✓

   Action suppression does not stop alert generation.
4. No; suppression should delete each matching fired alert.

   Suppressing actions does not delete the alert.

Action suppression does not stop alert generation.

8. Configure VM backup in an East US Recovery Services vault: Which action should the administrator take?

1. Create a Backup vault in East US, configure a backup policy, and enable protection for the virtual machine.

   A Backup vault is a different resource type from the Recovery Services vault used for Azure VM backup in this requirement.
2. Enable Azure Site Recovery replication to a secondary region and use the replicated VM to recover deleted files.

   Site Recovery replication addresses disaster-recovery needs, not the backup schedule and retention requirement for recovering deleted files.
3. Create a Recovery Services vault in East US and enable VM protection, without configuring a backup policy or checking recovery points.

   Enabling protection alone does not establish the required schedule and retention, and configuration is not proof that a usable recovery point exists.
4. Configure VM backup in an East US Recovery Services vault with the required policy; confirm a recovery point. ✓

   This uses the required vault type and region, defines schedule and retention through a policy, and verifies that protection has produced an actual recovery point.

Use a same-region Recovery Services vault, define schedule and retention with a backup policy, and verify a recovery point.

9. Create or use a Recovery Services vault in East US: What should the administrator do?

1. Keep the West US Backup vault and wait for the configured protection to create a recovery point.

   A Backup vault is a different resource type from the Recovery Services vault used for Azure VM backup, so waiting does not correct the configuration.
2. Create or use a Recovery Services vault in East US, configure VM backup, and verify that a backup job produces a recovery point. ✓

   Azure VM backup uses a Recovery Services vault in the VM’s region. Verifying a completed job and recovery point confirms protection beyond initial configuration.
3. Treat the completed initial protection configuration as proof that a usable recovery point already exists.

   Initial protection configuration is not proof of a completed recovery point; backup jobs and recovery points must be verified.
4. Create a Recovery Services vault in West US and move the VM’s backup configuration to it.

   Using the correct vault type does not fix the regional scope: the Recovery Services vault must be in the same region as the VM.

Use a same-region Recovery Services vault for Azure VM backup, then verify a completed backup job and recovery point.

10. Review the backup job status and confirm that a recovery: Which action addresses the remaining requirement?

1. Create a Backup vault in the VM's region and use it instead of the existing Recovery Services vault.

   Azure VM backup uses a Recovery Services vault; creating a different Backup vault does not verify completion of the VM's configured backup.
2. Move the Recovery Services vault to another region so the backup is protected from a regional outage.

   The vault must be in the same region as the VM for Azure VM backup, and changing its region would not establish that a recovery point has completed.
3. Review the backup job status and confirm that a recovery point has been created for the VM. ✓

   Enabling protection and assigning a policy do not prove that a completed recovery point exists. Reviewing the job and recovery point verifies that backup has actually completed.
4. Configure Site Recovery replication to a secondary region and treat replication status as the VM's backup confirmation.

   Site Recovery replication supports a different recovery need and does not replace verification of a completed backup recovery point.

Confirm a completed backup job and recovery point; configuring protection alone is not proof of recoverability.

11. Run a Site Recovery test failover to an isolated: Which action should the administrator take?

1. Confirm that Site Recovery protection is configured and use the configuration status as proof that a recovery point has been successfully tested.

   Protection configuration alone is not proof of a completed recovery or successful recovery point. The required validation is an actual Site Recovery test failover.
2. Create a Recovery Services vault in the secondary region and enable Azure VM backup there to validate Site Recovery recovery.

   VM backup and Site Recovery address different recovery needs. Azure VM backup also uses a Recovery Services vault in the same region as the protected VM, so this does not validate Site Recovery recovery.
3. Perform a Site Recovery failover to the production network and treat the recovered VM as the validation environment.

   A production failover is a cutover action, not a non-disruptive validation. It can affect production and does not satisfy the isolation requirement.
4. Run a Site Recovery test failover to an isolated nonproduction target network, then clean up the test resources. ✓

   A test failover validates recovery without affecting production or ongoing replication; the isolated network prevents the test VM from conflicting with production.

Use Site Recovery test failover with an isolated nonproduction network; it validates recovery without disrupting production or replication.

12. Confirm that a backup job has completed successfully: Which two actions should the administrator take?

Select two. More than one option is correct — every correct one is ticked below.

1. Run a Site Recovery test failover to the production network and use the test result as the VM backup.

   A Site Recovery test failover validates replicated recovery and is not a backup operation. It should use an isolated nonproduction network rather than the production network.
2. Confirm that a backup job has completed successfully and that a recovery point is available before making the change. ✓

   Configuring protection does not prove that a usable backup exists. A completed job and recovery point provide that verification.
3. Configure App01 in a Backup vault in East US and treat the protection configuration as the completed backup.

   A Backup vault is a different resource type; the supplied VM-backup configuration requires a Recovery Services vault. Configuration alone also does not prove a completed recovery point.
4. Create a backup policy with the required retention and proceed immediately without checking backup jobs or recovery points.

   A policy specifies schedule and retention, but it does not establish that the initial backup has completed or that a recovery point exists.
5. Protect App01 in a Recovery Services vault located in East US, using a backup policy that defines its schedule and retention. ✓

   Azure VM backup uses a Recovery Services vault in the VM's region, and the policy defines when backups run and how long they are retained.

Choose A and B. Use the correct regional Recovery Services vault and policy, then verify a completed job and recovery point.

Other AZ-104 domains

• Manage Azure identities and governance — 213 questions →
• Deploy and manage Azure compute resources — 196 questions →
• Implement and manage storage — 164 questions →
• Implement and manage virtual networking — 149 questions →
• All 834 AZ-104 questions →
• AZ-104 certification: requirements, cost and exam format →