AZ-104 Monitor and maintain Azure resources: 96 practice questions

12 of the 96 Monitor and maintain Azure resources questions in the Certsqill AZ-104 bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for AZ-104? Take the free 5-min readiness check →

1. Schedule action-group suppression for the resource: Which action should the administrator take?

1. Schedule action-group suppression for the resource with an alert processing rule. ✓

   An alert processing rule can suppress action groups for fired alerts during a scheduled window while leaving alert evaluation enabled.
2. Remove the notification actions from the alert’s action group for the maintenance window, then restore them afterward.

   Action groups define notification and other actions, but changing one affects its configuration rather than providing a scheduled suppression of fired-alert actions.
3. Disable the metric alert rule at the start of maintenance and re-enable it afterward.

   Disabling the rule stops it from firing during the window, so it does not preserve continuous alert evaluation.
4. Add a diagnostic setting that sends the resource metrics to a Log Analytics workspace during maintenance.

   Diagnostic settings route selected metrics and logs to destinations; they do not suppress alert action groups or control notifications.

Use an alert processing rule with a maintenance schedule to suppress actions without disabling alert evaluation.

2. Probe a readiness endpoint that returns 200 only when: What should the administrator change to make backend el

1. Create a diagnostic setting that sends the load balancer’s platform metrics to Log Analytics.

   This can route platform metrics for analysis, but it does not change the health probe’s eligibility decision or the endpoint it tests.
2. Add email notifications to a metric alert monitoring the load balancer.

   Notification actions do not change the health probe used to determine backend eligibility.
3. Probe a readiness endpoint that returns 200 only when dependencies are available. ✓

   The probe determines backend eligibility, and an unrelated healthy path can conceal application unavailability. A readiness endpoint makes the probe test the condition that matters.
4. Replace the HTTPS probe with a TCP probe on port 443.

   A TCP connection can succeed while a required application dependency is unavailable.

Change the probe to a readiness path that returns HTTP 200 only when the application is ready. The probe, not diagnostics or an action group, controls backend eligibility.

3. Allow health-probe traffic from the AzureLoadBalancer: Which requirement remains unmet?

1. Change the HTTPS probe to a TCP probe so that it checks only whether the port is reachable.

   A TCP probe would not verify that `/ready` returns HTTP 200, so it would weaken the intended application-readiness check rather than satisfy it.
2. Add the backend instances to a second load-balancing rule using the same frontend.

   A load-balancing rule distributes flows but does not resolve an NSG denial of health-probe traffic. The existing probe can remain associated with its rule.
3. Configure the frontend IP address as an additional backend-pool member.

   The frontend and backend pool have distinct roles. Adding the frontend as a backend member does not permit the health probe through the denying NSG.
4. Allow health-probe traffic from the AzureLoadBalancer service tag in the applicable NSG. ✓

   The probe path now tests application readiness, but the NSG still denies the probe traffic. The NSG must allow AzureLoadBalancer traffic for the backend to be evaluated as healthy.

The readiness path is correctly configured, but the NSG still blocks Azure Load Balancer probe traffic.

4. Limit the processing rule to rg-test: Which change fixes the scope while retaining suppression for all test re

1. Limit the processing rule to rg-test. ✓

   Scoping suppression to the test group leaves production alerts unaffected.
2. Extend the subscription-wide maintenance schedule.

   A longer schedule does not fix an overly broad scope.
3. Limit the processing rule to rg-prod.

   This retains suppression on the wrong resources.
4. Disable the metric alert rules in rg-test.

   Production remains within the subscription-wide suppression rule.

Scoping suppression to the test group leaves production alerts unaffected.

5. Configure an HTTPS health probe for the application: Which action should you take?

1. Configure a TCP health probe on port 443 and verify that the instance remains eligible after a successful TLS handshake.

   A TCP probe verifies connectivity to the port, and a TLS handshake does not test whether the application can process HTTP requests or its dependencies are available.
2. Verify that the frontend, backend pool, and load-balancing rule exist, then treat the backend as healthy without changing the probe.

   Those resources define Load Balancer configuration but do not verify backend application readiness. Backend eligibility is determined by the health probe result.
3. Configure an HTTPS health probe for the application readiness path requiring HTTP 200, and verify that the backend becomes ineligible when the path returns a failure status. ✓

   This probe tests the required result: application-level readiness. HTTP/HTTPS probes require HTTP 200 on the configured path, and the Load Balancer uses the result to determine backend eligibility.
4. Configure an HTTP probe for the site root, verify that it returns HTTP 200, and use that result as the readiness decision.

   The site root may remain healthy while the actual application dependency is unavailable. An unrelated healthy path can conceal application unavailability.

Use an HTTP or HTTPS probe against the application’s readiness endpoint and require HTTP 200; test failure by making that endpoint return an error.

6. Yes; processing rules suppress actions after alerts fire: Is this expected?

1. No; suppression should disable the metric alert rule.

   An alert processing rule does not disable the alert rule.
2. No; suppression should prevent the metric from being collected.

   Metric collection is separate from action processing.
3. Yes; processing rules suppress actions after alerts fire. ✓

   Action suppression does not stop alert generation.
4. No; suppression should delete each matching fired alert.

   Suppressing actions does not delete the alert.

Action suppression does not stop alert generation.

7. Configure VM backup in an East US Recovery Services vault: Which action should the administrator take?

1. Create a Backup vault in East US, configure a backup policy, and enable protection for the virtual machine.

   A Backup vault is a different resource type from the Recovery Services vault used for Azure VM backup in this requirement.
2. Enable Azure Site Recovery replication to a secondary region and use the replicated VM to recover deleted files.

   Site Recovery replication addresses disaster-recovery needs, not the backup schedule and retention requirement for recovering deleted files.
3. Create a Recovery Services vault in East US and enable VM protection, without configuring a backup policy or checking recovery points.

   Enabling protection alone does not establish the required schedule and retention, and configuration is not proof that a usable recovery point exists.
4. Configure VM backup in an East US Recovery Services vault with the required policy; confirm a recovery point. ✓

   This uses the required vault type and region, defines schedule and retention through a policy, and verifies that protection has produced an actual recovery point.

Use a same-region Recovery Services vault, define schedule and retention with a backup policy, and verify a recovery point.

8. Create or use a Recovery Services vault in East US: What should the administrator do?

1. Keep the West US Backup vault and wait for the configured protection to create a recovery point.

   A Backup vault is a different resource type from the Recovery Services vault used for Azure VM backup, so waiting does not correct the configuration.
2. Create or use a Recovery Services vault in East US, configure VM backup, and verify that a backup job produces a recovery point. ✓

   Azure VM backup uses a Recovery Services vault in the VM’s region. Verifying a completed job and recovery point confirms protection beyond initial configuration.
3. Treat the completed initial protection configuration as proof that a usable recovery point already exists.

   Initial protection configuration is not proof of a completed recovery point; backup jobs and recovery points must be verified.
4. Create a Recovery Services vault in West US and move the VM’s backup configuration to it.

   Using the correct vault type does not fix the regional scope: the Recovery Services vault must be in the same region as the VM.

Use a same-region Recovery Services vault for Azure VM backup, then verify a completed backup job and recovery point.

9. Review the backup job status and confirm that a recovery: Which action addresses the remaining requirement?

1. Create a Backup vault in the VM's region and use it instead of the existing Recovery Services vault.

   Azure VM backup uses a Recovery Services vault; creating a different Backup vault does not verify completion of the VM's configured backup.
2. Move the Recovery Services vault to another region so the backup is protected from a regional outage.

   The vault must be in the same region as the VM for Azure VM backup, and changing its region would not establish that a recovery point has completed.
3. Review the backup job status and confirm that a recovery point has been created for the VM. ✓

   Enabling protection and assigning a policy do not prove that a completed recovery point exists. Reviewing the job and recovery point verifies that backup has actually completed.
4. Configure Site Recovery replication to a secondary region and treat replication status as the VM's backup confirmation.

   Site Recovery replication supports a different recovery need and does not replace verification of a completed backup recovery point.

Confirm a completed backup job and recovery point; configuring protection alone is not proof of recoverability.

10. Run a Site Recovery test failover to an isolated: Which action should the administrator take?

1. Confirm that Site Recovery protection is configured and use the configuration status as proof that a recovery point has been successfully tested.

   Protection configuration alone is not proof of a completed recovery or successful recovery point. The required validation is an actual Site Recovery test failover.
2. Create a Recovery Services vault in the secondary region and enable Azure VM backup there to validate Site Recovery recovery.

   VM backup and Site Recovery address different recovery needs. Azure VM backup also uses a Recovery Services vault in the same region as the protected VM, so this does not validate Site Recovery recovery.
3. Perform a Site Recovery failover to the production network and treat the recovered VM as the validation environment.

   A production failover is a cutover action, not a non-disruptive validation. It can affect production and does not satisfy the isolation requirement.
4. Run a Site Recovery test failover to an isolated nonproduction target network, then clean up the test resources. ✓

   A test failover validates recovery without affecting production or ongoing replication; the isolated network prevents the test VM from conflicting with production.

Use Site Recovery test failover with an isolated nonproduction network; it validates recovery without disrupting production or replication.

11. Run Clean up test failover: What should you do to finish the drill?

1. Start another test failover before cleanup.

   Another drill does not complete cleanup of this one.
2. Commit a production failover.

   A test drill does not require committing a production failover.
3. Run Clean up test failover. ✓

   The cleanup action completes the drill and removes its test resources.
4. Disable replication for the source VMs.

   Stopping protection is unnecessary and defeats the ongoing recovery setup.

The cleanup action completes the drill and removes its test resources.

12. Create a Recovery Services vault in East US: Which action satisfies both requirements?

1. Create a Recovery Services vault in West US, configure the required schedule and retention, enable VM protection, and verify a completed backup job and recovery point.

   The verification is appropriate, but the Recovery Services vault must be in the same region as the VM; West US does not satisfy that scope requirement.
2. Create a Recovery Services vault in East US, configure the required schedule and retention, enable VM protection, and treat the initial protection configuration as the first recovery point.

   The vault and policy are appropriate, but initial protection configuration is not evidence that a completed recovery point has been created.
3. Create a Backup vault in East US, configure a backup policy, enable VM protection, and verify that the protection configuration was accepted.

   A Backup vault is not the specified vault type for Azure VM backup, and accepted initial configuration does not prove that a recovery point exists.
4. Create a Recovery Services vault in East US, configure a backup policy with the required schedule and retention, enable VM protection, and verify a completed backup job and recovery point. ✓

   A Recovery Services vault in the VM's region supports Azure VM backup. The policy supplies schedule and retention, while the completed job and recovery point verify usable protection.

Use a same-region Recovery Services vault, configure the backup policy, and verify a completed backup job and recovery point.

Other AZ-104 domains

• Manage Azure identities and governance — 186 questions →
• Deploy and manage Azure compute resources — 169 questions →
• Implement and manage storage — 141 questions →
• Implement and manage virtual networking — 130 questions →
• All 722 AZ-104 questions →