cert
cert-1
cert-2

Pass Microsoft AZ-104 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AZ-104 Exam - Verified By Experts
AZ-104 Premium Bundle
$29.98

AZ-104 Premium Bundle

$79.99
$109.97
  • Premium File 606 Questions & Answers. Last update: Oct 30, 2026
  • Training Course 132 Video Lectures
  • Study Guide 458 Pages
 
$109.97
$79.99
accept 453 downloads in last 7 days
block-screenshots
Purchase Microsoft AZ-104 Exam Training Products Individually
Microsoft AZ-104 Premium File
Premium File 606 Q&A
$76.99$69.99
Microsoft AZ-104 Video Training Course
Training Course 132 Lectures
$21.99 $19.99
Microsoft AZ-104 PDF Study Guide
Study Guide 458 Pages
$21.99 $19.99
Microsoft AZ-104 Practice Test 40

Question 390

An engineer needs average VM CPU by computer over the past hour in KQL. Which query operator computes the grouping?

  1. Use summarize count() by SeverityLevel after filtering the relevant error records.
  2. Use summarize avg(CounterValue) by Computer or the applicable column after filtering the time range.
  3. Apply an explicit TimeGenerated time-range filter in the KQL query.
  4. Inspect Azure Resource Health for the affected VM.

Explanation

Correct Answer

B:

KQL summarize aggregates numeric columns by grouping keys. A simple project expression only selects fields without calculating per-VM averages. This matters here because an engineer needs average VM CPU by computer over the past hour in KQL. Which query operator computes the grouping.

Incorrect Answers

A:

KQL count aggregation summarizes event rows by severity. Detailed raw events alone do not produce grouped counts.

C:

A table may retain many months of telemetry. Queries should constrain time for accuracy and performance. This matters here because an engineer needs average VM CPU by computer over the past hour in KQL. Which query operator computes the grouping.

D:

Resource Health reports platform availability for supported Azure resources and can help distinguish platform incidents from guest failures.

Question 391

A query returns a single average for the whole workspace instead of one per VM. What's missing?

  1. Review workbook resource scopes and identifiers after resource migration.
  2. Use project or project-away to control which columns appear in results.
  3. Add by Computer or another VM identifier to the summarize aggregation.
  4. Inspect the workspace tables and active data collection rules before rewriting the KQL logic.

Explanation

Correct Answer

C:

A summarize without grouping calculates one aggregate across all matching rows. A by clause separates per-resource results.

Incorrect Answers

A:

Many dashboards store explicit resource IDs. Moving or recreating resources can invalidate previously selected targets.

B:

Column projection reduces result shape, making analysis focused and easier to export. It does not change the underlying stored telemetry. This matters here because a query returns a single average for the whole workspace instead of one per VM. What's missing.

D:

Queries can return only collected records. An empty table may be a collection problem rather than a KQL syntax failure. This matters here because a query returns a single average for the whole workspace instead of one per VM. What's missing.

Question 392

A user wants to count error messages by severity for an incident report. Which KQL operator and aggregate fit?

  1. Use summarize count() by SeverityLevel after filtering the relevant error records.
  2. Recognize that flow logs capture flow metadata, not full decrypted application payloads.
  3. Configure Azure Service Health alerts for relevant services and regions.
  4. Enable Activity Log retention and assume it computes grouped severity counts inside a Log Analytics incident query.

Explanation

Correct Answer

A:

KQL count aggregation summarizes event rows by severity. Detailed raw events alone do not produce grouped counts. This matters here because a user wants to count error messages by severity for an incident report. Which KQL operator and aggregate fit.

Incorrect Answers

B:

Flow telemetry is designed to show traffic patterns and dispositions, not complete application message content.

C:

Service Health reports subscription-affecting incidents, planned maintenance and advisories. This is distinct from one VM's guest application monitoring.

D:

The KQL requirement is query aggregation, such as `summarize count() by Severity`, after filtering the relevant log records. Activity Log forwarding cannot replace query grouping.

Question 393

A KQL result includes only Error but lacks counts because it uses project. What should be changed?

  1. Specify desc rather than asc on the aggregate count column.
  2. Change the Azure Monitor metric aggregation or time granularity to examine maximum values.
  3. Replace field-only projection with summarize count() over the desired grouping.
  4. Apply an explicit TimeGenerated time-range filter in the KQL query.

Explanation

Correct Answer

C:

Project chooses columns; summarize calculates aggregates. Reporting incident frequency needs an aggregation expression.

Incorrect Answers

A:

Sort direction controls ordering; ascending displays small values first. DESC is required for most-frequent-first output.

B:

An average can hide short peaks. Maximum aggregation at a suitable interval helps reveal spikes that affect user latency. This matters here because a KQL result includes only Error but lacks counts because it uses project.

D:

A table may retain many months of telemetry. Queries should constrain time for accuracy and performance. This matters here because a KQL result includes only Error but lacks counts because it uses project.

Question 394

A monitoring engineer wants to sort a table of alert frequencies from highest to lowest. Which KQL operation applies?

  1. Use order by Count desc after computing the aggregate count.
  2. Run recurring connection monitoring and correlate failures with route and service health changes.
  3. Use summarize count() by SeverityLevel after filtering the relevant error records.
  4. Sort the alerts by changing the budget threshold rather than adding an order-by clause to the KQL result.

Explanation

Correct Answer

A:

KQL order by sorts result rows on the specified column, allowing the largest alert frequencies to appear first.

Incorrect Answers

B:

An instantaneous successful test does not prove sustained availability. Repeated probes reveal time-dependent faults.

C:

KQL count aggregation summarizes event rows by severity. Detailed raw events alone do not produce grouped counts. This matters here because a monitoring engineer wants to sort a table of alert frequencies from highest to lowest. Which KQL operation applies.

D:

Budget thresholds do not sort query result rows. After aggregating alert frequency, KQL order by Count desc determines the requested descending output.

Question 395

A vault must reject backup modifications or deletion by unauthorized operators. Which authorization pattern applies?

  1. Turn on soft delete but keep unrestricted backup-modification privileges for every operator.
  2. Use least-privileged Azure Backup RBAC roles and secure the vault against destructive operations.
  3. Retained backup data remains in the vault until its lifecycle and deletion conditions permit removal.
  4. Create a Recovery Services vault and configure Azure VM protection.

Explanation

Correct Answer

B:

Backup management roles should reflect tasks such as read-only monitoring or restore. Owner grants can expose unnecessary protection control.

Incorrect Answers

A:

Soft delete can preserve recoverable data, but it does not enforce least-privilege authority. Scope supported Backup roles and destructive-operation safeguards to authorized personnel.

C:

Stopping future protection and deleting existing recovery data are separate actions. Retention can continue to apply. This matters here because a vault must reject backup modifications or deletion by unauthorized operators. Which authorization pattern applies.

D:

Recovery Services vaults support Azure VM backup with appropriate policies and restore operations. A VM snapshot alone is not a complete scheduled recovery program. This matters here because a vault must reject backup modifications or deletion by unauthorized operators. Which authorization pattern applies.

Question 396

A Backup Reader can see recovery jobs but cannot disable protection. What explains it?

  1. Give a Backup Reader the authority to stop protection merely by assigning a longer backup retention policy.
  2. Treat protection status and recovery-point freshness as separate checks.
  3. Separate Backup Reader monitoring permissions from Backup Contributor or higher management rights.
  4. Use Azure Backup monitoring, alerting and reporting for the protected vaults.

Explanation

Correct Answer

C:

Reading backup data and changing protection settings are different privileged operations. Monitoring roles intentionally exclude destructive writes.

Incorrect Answers

A:

Reader is a monitoring role, not a destructive protection-management role. Restrict stop-protection permissions to authorized backup administrators.

B:

Being enrolled in a policy does not guarantee recent jobs ran successfully. Restore readiness depends on current usable points. This matters here because a Backup Reader can see recovery jobs but cannot disable protection. What explains it.

D:

Backup monitoring captures job failures and protection status. VM CPU metrics do not show recovery-point integrity.

Question 397

A cloud service must meet a defined recovery point objective of at most 15 minutes. Which backup design property matters?

  1. Retained backup data remains in the vault until its lifecycle and deletion conditions permit removal.
  2. Set target VNet, subnet, resource group and other recovery settings in the replication configuration.
  3. Select a protection or replication mechanism that actually meets the required data-loss interval.
  4. Treat protection status and recovery-point freshness as separate checks.

Explanation

Correct Answer

C:

RPO measures acceptable lost data duration. Daily VM backups alone do not guarantee a fifteen-minute RPO.

Incorrect Answers

A:

Stopping future protection and deleting existing recovery data are separate actions. Retention can continue to apply. This matters here because a cloud service must meet a defined recovery point objective of at most 15 minutes. Which backup design property matters.

B:

Replica disks alone do not ensure a bootable, reachable application VM at the destination. Recovery topology must be configured. This matters here because a cloud service must meet a defined recovery point objective of at most 15 minutes. Which backup design property matters.

D:

Being enrolled in a policy does not guarantee recent jobs ran successfully. Restore readiness depends on current usable points. This matters here because a cloud service must meet a defined recovery point objective of at most 15 minutes. Which backup design property matters.

Question 398

A service has one backup every 24 hours but an RPO requirement of one hour. What is the gap?

  1. Automate and rehearse the recovery runbook to reduce actual RTO.
  2. Review recovery plan group ordering, post-start validation and dependencies.
  3. Review backup item protection status and latest successful recovery points for each VM.
  4. Daily recovery points can lose far more than one hour of recent changes.

Explanation

Correct Answer

D:

An RPO requirement must match recovery-point frequency and replication behavior. More frequent protection or replication may be needed. This matters here because a service has one backup every 24 hours but an RPO requirement of one hour. What is the gap.

Incorrect Answers

A:

Replication alone does not ensure timely application availability. Recovery orchestration and validation consume time. This matters here because a service has one backup every 24 hours but an RPO requirement of one hour. What is the gap.

B:

Dependent application tiers must be restored in workable sequence. VM power-on does not guarantee service readiness. This matters here because a service has one backup every 24 hours but an RPO requirement of one hour. What is the gap.

C:

Policy assignments describe intent, while actual recovery points show executed protection. Coverage checks need both.

Question 399

A business requires applications to be restored within two hours after a regional outage. Which recovery objective is being defined?

  1. Daily recovery points can lose far more than one hour of recent changes.
  2. Define a two-hour recovery time objective and test the failover procedure against it.
  3. Run an on-demand backup with the supported retention choice before the change.
  4. Enable replication without documenting an acceptable application outage duration or testing service restoration.

Explanation

Correct Answer

B:

RTO describes acceptable time to restore service. It is different from how much data may be lost (RPO).

Incorrect Answers

A:

An RPO requirement must match recovery-point frequency and replication behavior. More frequent protection or replication may be needed. This matters here because a business requires applications to be restored within two hours after a regional outage. Which recovery objective….

C:

On-demand backup creates a requested recovery point outside normal scheduling when workload and policy support it. The operator must verify success. This matters here because a business requires applications to be restored within two hours after a regional outage. Which recovery objective….

D:

Azure Site Recovery provides replication and failover mechanics, but the question asks for a measurable time target. Define a two-hour RTO, then time application-level restoration during realistic drills rather than equating replication status with recovery time.

Question 400

A team has correct data replicas but a manual failover takes six hours, exceeding its target. What should it improve?

  1. Use least-privileged Azure Backup RBAC roles and secure the vault against destructive operations.
  2. Increase replication frequency without rehearsing the six-hour manual application restart sequence.
  3. Initiate a planned or unplanned Site Recovery failover as appropriate to the incident.
  4. Automate and rehearse the recovery runbook to reduce actual RTO.

Explanation

Correct Answer

D:

Replication alone does not ensure timely application availability. Recovery orchestration and validation consume time. This matters here because a team has correct data replicas but a manual failover takes six hours, exceeding its target.

Incorrect Answers

A:

Backup management roles should reflect tasks such as read-only monitoring or restore. Owner grants can expose unnecessary protection control. This matters here because a team has correct data replicas but a manual failover takes six hours, exceeding its target.

B:

Fresh replicas improve potential recovery-point loss, not the six hours consumed by manual failover. The violated RTO calls for an ordered, rehearsed recovery plan and automation of safe application startup and cutover.

C:

Failover uses replicated state in the recovery region to start supported workloads. A regional outage may require unplanned failover.

Microsoft Azure Administrator (AZ-104) Practice Tests