Microsoft AZ-104 - Microsoft Azure Administrator - Monitor and Maintain Azure Resources - Monitor Resources in Azure - Review Questions

Monitor Resources in Azure — 10 AZ-104 Review Questions

1. You need to investigate short spikes in a VM’s platform CPU percentage over the past hour. Which tool should you use first?

A. Azure Storage Explorer

B. Azure Monitor Metrics Explorer

C. Azure Policy

D. Azure Resource Graph

2. You need to send a storage account’s supported resource logs to a Log Analytics workspace and Event Hubs. What should you configure?

A. An action group

B. An alert processing rule

C. Diagnostic settings

D. A resource lock

3. You need to collect Windows event logs and guest performance counters from Azure VMs into a Log Analytics workspace. Which configuration should you use?

A. Azure Monitor Agent with an associated Data Collection Rule

B. Network Watcher with a packet-capture filter

C. A metric alert with an action group

D. An Azure Monitor workspace without an agent

4. Which statement correctly distinguishes the two workspace types?

A. Both workspace types store only Activity Log events.

B. An Azure Monitor workspace replaces every Log Analytics workspace.

C. A Log Analytics workspace stores Prometheus metrics exclusively.

D. A Log Analytics workspace stores logs; an Azure Monitor workspace stores managed Prometheus metrics.

5. You want to count failed management operations by resource group. Activity Log data is already being sent to the workspace. Which query is appropriate?

A.

AzureActivity
| where ActivityStatusValue == "Failed"
| summarize FailedOperations = count() by ResourceGroup

B.

AzureActivity
| where ActivityStatusValue == "Succeeded"
| summarize FailedOperations = count() by ResourceGroup

C.

AzureActivity
| where ActivityStatusValue == "Failed"
| project ResourceGroup

D.

AzureActivity
| summarize FailedOperations = count() by ResourceGroup

6. A CPU alert must notify administrators by email and invoke a Logic App. Which Azure Monitor component defines those notifications and actions?

A. Data Collection Rule

B. Metric namespace

C. Action group

D. Log retention policy

7. During scheduled maintenance, you need alerts to continue being detected while suppressing their notifications and automated actions. What should you configure?

A. Disable telemetry collection.

B. An alert processing rule that suppresses action groups.

C. Delete the alert rules.

D. Reduce log retention to one day.

8. You need to identify slow requests and trace calls from an application to its database dependency. Which capability is most appropriate?

A. Storage Insights

B. Azure Activity Log

C. IP flow verify

D. Application Insights with appropriate instrumentation

9. An Azure VM cannot communicate with a destination. You need to determine whether an NSG permits or denies a proposed flow and identify the matching rule. Which tool should you use?

A. IP flow verify

B. Connection Monitor

C. Azure Storage Explorer

D. Metrics Explorer

10. You need ongoing tests of connectivity and latency between a source VM and a destination application endpoint. Which tool should you configure?

A. Next hop

B. A one-time packet capture

C. Connection Monitor

D. Azure Policy

Answer Key and Explanations

1. B — Azure Monitor Metrics Explorer

Metrics Explorer charts numeric measurements over time. Select the VM, metric namespace, CPU metric, time range, and time granularity. A maximum aggregation can help reveal spikes that an average might obscure. Platform CPU metrics generally do not require installing an agent inside the VM.

2. C — Diagnostic settings

Diagnostic settings select supported resource-log categories and route them to destinations such as Log Analytics, Azure Storage, and Event Hubs. Resource logs generally require explicit collection configuration. Action groups respond to alerts; they do not configure ongoing log export.

3. A — Azure Monitor Agent with a Data Collection Rule

AMA collects supported guest operating-system telemetry. The associated DCR specifies the sources, collection configuration, and destinations. Installing the agent alone does not establish all required collection rules. Platform VM metrics and guest metrics are different collection paths.

4. D — Log Analytics for logs; Azure Monitor workspace for Prometheus metrics

A Log Analytics workspace stores log tables queried with KQL through Log Analytics. An Azure Monitor workspace is a separate resource used for Azure Monitor managed Prometheus metrics, typically queried using PromQL. The names are similar, but the resources are not interchangeable.

5. A — Filter failures, then summarize by resource group

The query first selects records whose status is Failed, then counts them for each resource group. Option B counts successes; option C lists resource-group values without counting; option D includes all statuses. In practice, add a time filter such as:

| where TimeGenerated > ago(24h)

This query works only when the relevant Activity Log records have been ingested into the workspace.

6. C — Action group

An action group defines reusable notifications and automated actions, including email, SMS, webhooks, Azure Functions, and Logic Apps. The alert rule defines when an alert fires; the action group defines what happens afterward. Multiple alert rules can reuse the same action group.

7. B — Alert processing rule that suppresses action groups

An alert processing rule can suppress action groups for matching alerts during a configured maintenance window. Alerts can still fire and remain available for investigation. Disabling collection or deleting alert rules would remove detection rather than merely suppressing the response.

8. D — Application Insights with instrumentation

Application Insights provides application performance monitoring, including requests, exceptions, dependencies, and distributed traces. Suitable instrumentation is required to collect and correlate this telemetry. Activity Log records management activity, while IP flow verify evaluates network security rules rather than application execution.

9. A — IP flow verify

IP flow verify evaluates a proposed VM traffic flow against applicable NSG rules and reports whether it is allowed or denied, including the matching rule. It does not prove that the entire application path works: routing, DNS, guest firewalls, and destination availability can still cause failures.

10. C — Connection Monitor

Connection Monitor performs recurring connectivity tests and tracks results such as reachability and latency over time. Configure the test sources, destinations, protocol/port, frequency, and thresholds, along with required source components. Next hop investigates routing decisions; packet capture provides packet-level evidence for a particular investigation.