Microsoft AZ-104 Practice Test 70
Question 690
A cloud team wants to alert when App Service HTTP 5xx error rates jump, not just when its VMs use CPU. Which monitored signal applies?
- Select an App Service HTTP server error metric or suitable application log-based alert.
- Alert on the subscription's total monthly budget and assume it detects an App Service HTTP 5xx spike.
- Run recurring connection monitoring and correlate failures with route and service health changes.
- Use only CPU-utilization alarms when the target failure is elevated HTTP 5xx responses.
Explanation
Correct Answer
A:App Service exposes service-particular request signals. A VM CPU threshold alone cannot detect all web response failures.
Incorrect Answers
B:Spending and HTTP server errors are different signals. Select the App Service response-code metric or a validated application log query to detect the stated failure rate.
C:An instantaneous successful test does not prove sustained availability. Repeated probes reveal time-dependent faults. This matters here because a cloud team wants to alert when App Service HTTP 5xx error rates jump, not just when its VMs use CPU. Which….
D:High application error rates can occur with normal CPU. Use supported App Service HTTP response/5xx metrics or application telemetry and an appropriately scoped threshold.
Question 691
A web app shows many 500 responses but no CPU alarm. What monitoring change would detect the incident?
- Add an HTTP 5xx metric or log alert tied to an action group.
- Raise the VM CPU alert threshold to detect failed web requests that do not increase processor load.
- Use supported alert state management and an action group or external escalation automation as needed.
- Specify desc rather than asc on the aggregate count column.
Explanation
Correct Answer
A:Application response errors are a different signal than infrastructure CPU saturation. Alerts must watch the symptom that matters. This matters here because a web app shows many 500 responses but no CPU alarm. What monitoring change would detect the incident.
Incorrect Answers
B:HTTP 500 responses are application outcomes, not necessarily CPU saturation. Add an App Service HTTP 5xx metric or request-failure signal with a suitable evaluation window.
C:Azure alerts can fire and resolve based on state. Escalation may require integration with ITSM or Logic Apps instead of the metric rule alone.
D:Sort direction controls ordering; ascending displays small values first. DESC is required for most-frequent-first output. This matters here because a web app shows many 500 responses but no CPU alarm. What monitoring change would detect the incident.
Question 692
A security analyst needs to filter a Log Analytics table for events with a specific operation name and include only two columns. Which KQL operators fit?
- Filter by TimeGenerated with ago(1d) and apply where to the failure condition.
- Use where for the operation predicate and project for the chosen output columns.
- Inspect the workspace tables and active data collection rules before rewriting the KQL logic.
- Run Kusto Query Language queries against supported Log Analytics workspace tables.
Explanation
Correct Answer
B:Where selects qualifying rows; project selects displayed fields. Neither operation by itself computes aggregate counts. This matters here because a security analyst needs to filter a Log Analytics table for events with a specific operation name and include only….
Incorrect Answers
A:KQL where reduces rows by predicates, while ago supplies a relative time window. Selecting a dashboard time picker alone may not change a scripted query. This matters here because a security analyst needs to filter a Log Analytics table for events with a specific operation name and include only….
C:Queries can return only collected records. An empty table may be a collection problem rather than a KQL syntax failure. This matters here because a security analyst needs to filter a Log Analytics table for events with a specific operation name and include only….
D:KQL provides filtering, aggregation and joins over telemetry such as Heartbeat or event records. It is separate from Azure Resource Graph queries. This matters here because a security analyst needs to filter a Log Analytics table for events with a specific operation name and include only….
Question 693
A KQL query returns the right events but many unnecessary columns. What should be added?
- Filter by TimeGenerated with ago(1d) and apply where to the failure condition.
- Use project or project-away to control which columns appear in results.
- Check category-specific diagnostic settings on the blob service and the selected Log Analytics workspace.
- Look for historical Activity Log exports in the configured retention destination.
Explanation
Correct Answer
B:Column projection reduces result shape, making analysis focused and easier to export. It does not change the underlying stored telemetry. This matters here because a KQL query returns the right events but many unnecessary columns.
Incorrect Answers
A:KQL where reduces rows by predicates, while ago supplies a relative time window. Selecting a dashboard time picker alone may not change a scripted query. This matters here because a KQL query returns the right events but many unnecessary columns.
C:Logging must be enabled at the correct service resource and category. A storage account metric chart does not imply blob request logging. This matters here because a KQL query returns the right events but many unnecessary columns.
D:Native Activity Log is not an indefinite historical archive. Long-term audit depends on prior exports and destination retention. This matters here because a KQL query returns the right events but many unnecessary columns.
Question 694
A VM shows Protected but its last backup succeeded weeks ago. What is the correct interpretation?
- Inspect the backup job history, policy association, VM agent state and failure details.
- Separate Backup Reader monitoring permissions from Backup Contributor or higher management rights.
- Create a Backup vault and choose supported data-source protection policies.
- Treat protection status and recovery-point freshness as separate checks.
Explanation
Correct Answer
D:Being enrolled in a policy does not guarantee recent jobs ran successfully. Restore readiness depends on current usable points. This matters here because a VM shows Protected but its last backup succeeded weeks ago. What is the correct interpretation.
Incorrect Answers
A:A policy configured on paper does not prove successful execution. Job outcomes and generated recovery points establish actual protection. This matters here because a VM shows Protected but its last backup succeeded weeks ago. What is the correct interpretation.
B:Reading backup data and changing protection settings are different privileged operations. Monitoring roles intentionally exclude destructive writes. This matters here because a VM shows Protected but its last backup succeeded weeks ago. What is the correct interpretation.
C:Backup vaults support selected newer Azure Backup data sources and policy capabilities. They are not interchangeable with Recovery Services vaults for every workload. This matters here because a VM shows Protected but its last backup succeeded weeks ago. What is the correct interpretation.
Question 695
A business requires backup data to survive the loss of the vault's primary region. Which vault storage redundancy choice is relevant?
- Create a Backup vault and choose supported data-source protection policies.
- Select a protection or replication mechanism that actually meets the required data-loss interval.
- Configure supported geo-redundant backup storage with cross-region restore requirements where eligible.
- Choose the database service's native backup and point-in-time restore features where supported.
Explanation
Correct Answer
C:Geo redundancy can replicate supported backup data to a secondary region, subject to service options and replication delay. This matters here because a business requires backup data to survive the loss of the vault's primary region. Which vault storage redundancy….
Incorrect Answers
A:Backup vaults support selected newer Azure Backup data sources and policy capabilities. They are not interchangeable with Recovery Services vaults for every workload. This matters here because a business requires backup data to survive the loss of the vault's primary region. Which vault storage redundancy….
B:RPO measures acceptable lost data duration. Daily VM backups alone do not guarantee a fifteen-minute RPO. This matters here because a business requires backup data to survive the loss of the vault's primary region. Which vault storage redundancy….
D:Managed database platforms offer service-specific automated backups and restore controls. VM backup policies do not cover every PaaS database. This matters here because a business requires backup data to survive the loss of the vault's primary region. Which vault storage redundancy….
Question 696
A vault uses locally redundant backup storage and the team expects immediate secondary-region restore. What is wrong?
- Enable soft delete on locally redundant vault storage and treat it as a secondary-region recovery copy.
- Recognize that vault soft delete can retain backup data beyond ordinary protection stop actions.
- Create a Recovery Services vault and configure Azure VM protection.
- Recognize that locally redundant vault storage does not create a secondary-region copy.
Explanation
Correct Answer
D:Local redundancy protects local copies; regional disaster recovery requires suitable geo protection and supported restore features. This matters here because a vault uses locally redundant backup storage and the team expects immediate secondary-region restore. What is wrong.
Incorrect Answers
A:LRS protects local replicas; soft delete addresses deletion, not geographical redundancy. Cross-region recovery requires an eligible geo-redundant backup design and feature support.
B:Soft delete intentionally delays permanent deletion under supported settings. Retention protects recovery evidence against quick destructive actions. This matters here because a vault uses locally redundant backup storage and the team expects immediate secondary-region restore. What is wrong.
C:Recovery Services vaults support Azure VM backup with appropriate policies and restore operations. A VM snapshot alone is not a complete scheduled recovery program. This matters here because a vault uses locally redundant backup storage and the team expects immediate secondary-region restore. What is wrong.
Question 697
A support team must restore one Azure SQL PaaS database and assumes Azure VM Backup will protect it. What should they use instead?
- Review alert processing suppression, backup job dashboards and escalation policies.
- Choose the database service's native backup and point-in-time restore features where supported.
- Run an on-demand backup with the supported retention choice before the change.
- Configure supported geo-redundant backup storage with cross-region restore requirements where eligible.
Explanation
Correct Answer
B:Managed database platforms offer service-specific automated backups and restore controls. VM backup policies do not cover every PaaS database. This matters here because a support team must restore one Azure SQL PaaS database and assumes Azure VM Backup will protect it.
Incorrect Answers
A:Silencing notifications can conceal material backup failures. Monitoring should keep failure evidence and provide an agreed review process. This matters here because a support team must restore one Azure SQL PaaS database and assumes Azure VM Backup will protect it.
C:On-demand backup creates a requested recovery point outside normal scheduling when workload and policy support it. The operator must verify success. This matters here because a support team must restore one Azure SQL PaaS database and assumes Azure VM Backup will protect it.
D:Geo redundancy can replicate supported backup data to a secondary region, subject to service options and replication delay. This matters here because a support team must restore one Azure SQL PaaS database and assumes Azure VM Backup will protect it.
Question 698
A database restore fails because the requested target time is outside its PITR window. What should be checked?
- Inspect the managed database backup retention and available point-in-time restore range.
- Inspect Azure VM backup extension or agent state and the job's detailed error.
- Use least-privileged Azure Backup RBAC roles and secure the vault against destructive operations.
- Run an on-demand backup with the supported retention choice before the change.
Explanation
Correct Answer
A:PITR operates only over retained database backups. Recovery cannot target a timestamp outside the supported window. This matters here because a database restore fails because the requested target time is outside its PITR window.
Incorrect Answers
B:Azure Backup uses supported guest extension or snapshot coordination for VM protection. VM running state alone does not prove backup readiness. This matters here because a database restore fails because the requested target time is outside its PITR window.
C:Backup management roles should reflect tasks such as read-only monitoring or restore. Owner grants can expose unnecessary protection control. This matters here because a database restore fails because the requested target time is outside its PITR window.
D:On-demand backup creates a requested recovery point outside normal scheduling when workload and policy support it. The operator must verify success. This matters here because a database restore fails because the requested target time is outside its PITR window.
Question 699
A VM's backup job fails repeatedly because the guest extension is unhealthy. What component should be investigated?
- Inspect the managed database backup retention and available point-in-time restore range.
- Inspect the backup job history, policy association, VM agent state and failure details.
- Create a second daily backup policy without inspecting the failed VM backup extension and detailed job errors.
- Inspect Azure VM backup extension or agent state and the job's detailed error.
Explanation
Correct Answer
D:Azure Backup uses supported guest extension or snapshot coordination for VM protection. VM running state alone does not prove backup readiness. This matters here because a VM's backup job fails repeatedly because the guest extension is unhealthy. What component should be investigated.
Incorrect Answers
A:PITR operates only over retained database backups. Recovery cannot target a timestamp outside the supported window. This matters here because a VM's backup job fails repeatedly because the guest extension is unhealthy. What component should be investigated.
B:A policy configured on paper does not prove successful execution. Job outcomes and generated recovery points establish actual protection. This matters here because a VM's backup job fails repeatedly because the guest extension is unhealthy. What component should be investigated.
C:A new schedule does not heal a broken guest or backup extension. Inspect the extension state and failing protection job before rerunning.
Question 700
A backup operation reports a VM snapshot consistency warning. What should be verified?
- Review application-consistent versus crash-consistent recovery point requirements.
- Assume that every Completed Azure Backup job produced an application-consistent recovery point.
- Reprotect the recovered workload and perform a supported failback sequence when the source is ready.
- Use Azure Backup file recovery from an eligible VM recovery point.
Explanation
Correct Answer
A:Application quiescing and crash consistency differ. The recovery strategy should match the protected workload's tolerance. This matters here because a backup operation reports a VM snapshot consistency warning.
Incorrect Answers
B:A completed backup job may have a crash-consistent recovery point or workload warnings. Review the actual consistency type and restore requirements rather than assuming application consistency.
C:Failback requires replication direction and target infrastructure readiness; the initial failover is not automatically reversible. This matters here because a backup operation reports a VM snapshot consistency warning.
D:File recovery can mount or access a recovery point for selective file retrieval. Restoring the entire VM is unnecessary when a file suffices. This matters here because a backup operation reports a VM snapshot consistency warning.