Home › Certifications › Microsoft Azure Administrator AZ-104 › Monitoring, Backup and Recovery
38 multiple-choice questions and 19 flashcards on Monitoring, Backup and Recovery, about 14% of the Microsoft Azure Administrator AZ-104 bank. Every one carries a written rationale.
Monitoring, Backup and Recovery is one of 6 chapters in CoStudy's Microsoft Azure Administrator (AZ-104) bank, and it holds 38 of the bank's 280 multiple-choice questions — roughly 14% of the total. That proportion is not arbitrary: chapters follow the certifying body's published exam outline, and the number of questions in each is set by that domain's published weight, so the share of your practice time this chapter takes matches the share of the real exam it accounts for.
Studying by chapter is worth doing once you have a diagnostic score. A single overall percentage tells you whether you are close; it does not tell you which domain is dragging. Working a weak chapter in isolation, and re-testing it in isolation, is the fastest way to move a score that has stalled — and it is why the mock exams in CoStudy report by domain rather than as one number.
10 questions drawn from this chapter, with the full rationale shown — the controlling principle behind the right answer, and why each wrong option tempts and fails.
Auto-instrumentation with Azure Monitor Application Insights in an ASP.NET application collects dependencies. Which is NOT collected by default?
Answer: C — Timing of custom in-process methods that issue no external call.
C is right because dependency collection hooks the outbound call libraries, so purely internal method timings need explicit instrumentation such as a custom operation or a tracked dependency. A, B and D are all auto-collected: the SDK instruments SQL client commands, HTTP client requests and Azure SDK calls, capturing duration, target and success. The half-right reading is that dependency means anything slow, when it specifically means a call leaving the process.
Azure Service Health alerts can be created for which categories of event?
Answer: B — Service issues, planned maintenance, health and security notices.
B is right because Service Health surfaces four event types, and an alert rule can target any combination of them scoped to chosen subscriptions, regions and services. A is the narrow reading that misses maintenance notices, which are the ones most worth alerting on because they are scheduled in advance. C belongs to budget alerts in Microsoft Cost Management. D is an activity log alert on administrative operations, a different signal source in Azure Monitor.
An administrator needs the resource logs from a storage account retained for long-term analysis and queryable with KQL alongside other Azure Monitor data. What must be configured?
Answer: C — A diagnostic setting sending the resource logs to a Log Analytics workspace
C) Correct — resource logs are not collected until a diagnostic setting routes them somewhere, and a Log Analytics workspace is the destination that makes them queryable with KQL. B) The activity log records control-plane operations on the resource, not data-plane requests. A) Metric alerts evaluate numeric series and do not retain log records. D) A workbook visualises data that is already collected; it cannot collect anything itself.
Azure Site Recovery replicates a virtual machine from one Azure region to a secondary region. After the initial replication finishes, what recovery point objective should be expected?
Answer: B — Minutes, with crash-consistent points every few minutes and application-consistent ones hourly
B reflects how Azure-to-Azure replication behaves: data is replicated continuously and crash-consistent recovery points are generated every few minutes, with application-consistent points on a longer interval set in the replication policy, so the achievable RPO sits in the seconds-to-minutes range. A confuses asynchronous replication with a synchronous zero-loss design, which needs application-level technology such as SQL Server Always On. C and D describe backup-style schedules rather than continuous replication.
Which query language do you use to search the data held in a Log Analytics workspace in Azure Monitor?
Answer: C — Kusto Query Language, the read-only language used to query the workspace tables
C is the language of the workspace: KQL pipes a table through operators such as where, summarize and project, and the same syntax drives log alert rules, workbooks and Microsoft Sentinel. A tempts because workspace data is organised into tables, but the engine is not relational and does not accept SQL. B manages resources rather than querying stored logs. D filters output that a command already returned and cannot reach the workspace. E is unrelated to Azure Monitor.
A single configuration file must be recovered from a backed-up Azure virtual machine as quickly as possible, without restoring the whole machine. Which restore option should be used?
Answer: B — Use file recovery, which mounts the recovery point's volumes on a chosen machine
B) Correct — item-level file recovery runs a downloaded script that mounts the recovery point as local volumes so individual files can be copied, with no full restore. A) Restoring disks and attaching them works but is slower and creates resources that must be cleaned up. C) Building a whole VM for one file is the heaviest option available. D) Replacing the OS disk overwrites the running machine's disk, which is disproportionate and disruptive.
Azure Site Recovery replicates Azure virtual machines to a secondary Azure region. What recovery time objective should you plan for a region failover?
Answer: A — Minutes, because the replicated disks already sit in the secondary region ready to attach
A is realistic: replication is continuous, so at failover the recovery plan attaches disks that are already present in the target region and boots the machines, typically within minutes. B and E both assume the replicas are already running, but Site Recovery keeps the target machines switched off until a failover is triggered, which is why it is cheaper than an active-active design. C describes a backup and restore workflow. D describes copying data only after the outage, which is what replication exists to avoid.
A Recovery Services vault is set to geo-redundant storage and an administrator wants to switch it to locally redundant. What is the constraint?
Answer: D — It can only be changed before any item is registered for backup.
D is right because the storage replication setting is locked once the vault protects its first item, so the decision must be made at creation time. A ignores that lock and is the assumption that leaves teams paying for geo-redundancy they never needed. B is the practical consequence once items exist, but it is not the rule the question asks for - an empty vault can still be changed in place. C invents a support path; the restriction is by design rather than a permission the platform can lift.
Before a real regional failover, a team wants to validate that replicated virtual machines boot and that the application works, with no effect on production replication. What should they do?
Answer: C — Perform a test failover into an isolated network, then clean up the test resources
C) Correct — test failover creates a copy of the replicated machines in an isolated network for validation while ongoing replication continues undisturbed, and the cleanup action removes the test resources. A) A planned failover moves the real workload and interrupts production. B) An unplanned failover is for disaster conditions and also moves the workload. D) Disabling replication discards the protection state and defeats the purpose of the rehearsal.
Network Watcher's NSG Flow Logs version 2 stores data where?
Answer: D — Azure Storage account.
NSG Flow Logs (v1 + v2) export to a STORAGE ACCOUNT. Traffic Analytics layers on top using Log Analytics. Right-destination trap: candidates pick Log Analytics directly.
4 cards from the 19 in this chapter.
Activity Log?
Subscription-level events (who did what when). Retention 90 days default.
What does an action group contain, and what does an alert processing rule add on top of alert rules?
An action group is the reusable list of notifications and actions — email, SMS, push, voice, webhook, Azure Function, Logic App, automation runbook — invoked when an alert fires. An alert processing rule acts on alerts after they are raised, to suppress notifications during a maintenance window or to attach an action group to alerts across a scope without editing each alert rule.
Azure Alerts?
Trigger on metric or log conditions. Action groups: email, SMS, webhook, automation.
Site Recovery?
DR service. Replicate VMs to secondary region, fail over on disaster.
These are a sample. The full Monitoring, Backup and Recovery chapter runs 57 items with per-chapter progress tracking, on the web and in the iOS app.
Open Microsoft Azure Administrator AZ-104 in CoStudy →
All Microsoft Azure Administrator AZ-104 practice questions →