cert
cert-1
cert-2

Pass Microsoft AZ-104 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AZ-104 Exam - Verified By Experts
AZ-104 Premium Bundle
$29.98

AZ-104 Premium Bundle

$79.99
$109.97
  • Premium File 606 Questions & Answers. Last update: Oct 30, 2026
  • Training Course 132 Video Lectures
  • Study Guide 458 Pages
 
$109.97
$79.99
accept 453 downloads in last 7 days
block-screenshots
Purchase Microsoft AZ-104 Exam Training Products Individually
Microsoft AZ-104 Premium File
Premium File 606 Q&A
$76.99$69.99
Microsoft AZ-104 Video Training Course
Training Course 132 Lectures
$21.99 $19.99
Microsoft AZ-104 PDF Study Guide
Study Guide 458 Pages
$21.99 $19.99
Microsoft AZ-104 Practice Test 70

Question 690

A cloud team wants to alert when App Service HTTP 5xx error rates jump, not just when its VMs use CPU. Which monitored signal applies?

  1. Select an App Service HTTP server error metric or suitable application log-based alert.
  2. Alert on the subscription's total monthly budget and assume it detects an App Service HTTP 5xx spike.
  3. Run recurring connection monitoring and correlate failures with route and service health changes.
  4. Use only CPU-utilization alarms when the target failure is elevated HTTP 5xx responses.

Explanation

Correct Answer

A:

App Service exposes service-particular request signals. A VM CPU threshold alone cannot detect all web response failures.

Incorrect Answers

B:

Spending and HTTP server errors are different signals. Select the App Service response-code metric or a validated application log query to detect the stated failure rate.

C:

An instantaneous successful test does not prove sustained availability. Repeated probes reveal time-dependent faults. This matters here because a cloud team wants to alert when App Service HTTP 5xx error rates jump, not just when its VMs use CPU. Which….

D:

High application error rates can occur with normal CPU. Use supported App Service HTTP response/5xx metrics or application telemetry and an appropriately scoped threshold.

Question 691

A web app shows many 500 responses but no CPU alarm. What monitoring change would detect the incident?

  1. Add an HTTP 5xx metric or log alert tied to an action group.
  2. Raise the VM CPU alert threshold to detect failed web requests that do not increase processor load.
  3. Use supported alert state management and an action group or external escalation automation as needed.
  4. Specify desc rather than asc on the aggregate count column.

Explanation

Correct Answer

A:

Application response errors are a different signal than infrastructure CPU saturation. Alerts must watch the symptom that matters. This matters here because a web app shows many 500 responses but no CPU alarm. What monitoring change would detect the incident.

Incorrect Answers

B:

HTTP 500 responses are application outcomes, not necessarily CPU saturation. Add an App Service HTTP 5xx metric or request-failure signal with a suitable evaluation window.

C:

Azure alerts can fire and resolve based on state. Escalation may require integration with ITSM or Logic Apps instead of the metric rule alone.

D:

Sort direction controls ordering; ascending displays small values first. DESC is required for most-frequent-first output. This matters here because a web app shows many 500 responses but no CPU alarm. What monitoring change would detect the incident.

Question 692

A security analyst needs to filter a Log Analytics table for events with a specific operation name and include only two columns. Which KQL operators fit?

  1. Filter by TimeGenerated with ago(1d) and apply where to the failure condition.
  2. Use where for the operation predicate and project for the chosen output columns.
  3. Inspect the workspace tables and active data collection rules before rewriting the KQL logic.
  4. Run Kusto Query Language queries against supported Log Analytics workspace tables.

Explanation

Correct Answer

B:

Where selects qualifying rows; project selects displayed fields. Neither operation by itself computes aggregate counts. This matters here because a security analyst needs to filter a Log Analytics table for events with a specific operation name and include only….

Incorrect Answers

A:

KQL where reduces rows by predicates, while ago supplies a relative time window. Selecting a dashboard time picker alone may not change a scripted query. This matters here because a security analyst needs to filter a Log Analytics table for events with a specific operation name and include only….

C:

Queries can return only collected records. An empty table may be a collection problem rather than a KQL syntax failure. This matters here because a security analyst needs to filter a Log Analytics table for events with a specific operation name and include only….

D:

KQL provides filtering, aggregation and joins over telemetry such as Heartbeat or event records. It is separate from Azure Resource Graph queries. This matters here because a security analyst needs to filter a Log Analytics table for events with a specific operation name and include only….

Question 693

A KQL query returns the right events but many unnecessary columns. What should be added?

  1. Filter by TimeGenerated with ago(1d) and apply where to the failure condition.
  2. Use project or project-away to control which columns appear in results.
  3. Check category-specific diagnostic settings on the blob service and the selected Log Analytics workspace.
  4. Look for historical Activity Log exports in the configured retention destination.

Explanation

Correct Answer

B:

Column projection reduces result shape, making analysis focused and easier to export. It does not change the underlying stored telemetry. This matters here because a KQL query returns the right events but many unnecessary columns.

Incorrect Answers

A:

KQL where reduces rows by predicates, while ago supplies a relative time window. Selecting a dashboard time picker alone may not change a scripted query. This matters here because a KQL query returns the right events but many unnecessary columns.

C:

Logging must be enabled at the correct service resource and category. A storage account metric chart does not imply blob request logging. This matters here because a KQL query returns the right events but many unnecessary columns.

D:

Native Activity Log is not an indefinite historical archive. Long-term audit depends on prior exports and destination retention. This matters here because a KQL query returns the right events but many unnecessary columns.

Question 694

A VM shows Protected but its last backup succeeded weeks ago. What is the correct interpretation?

  1. Inspect the backup job history, policy association, VM agent state and failure details.
  2. Separate Backup Reader monitoring permissions from Backup Contributor or higher management rights.
  3. Create a Backup vault and choose supported data-source protection policies.
  4. Treat protection status and recovery-point freshness as separate checks.

Explanation

Correct Answer

D:

Being enrolled in a policy does not guarantee recent jobs ran successfully. Restore readiness depends on current usable points. This matters here because a VM shows Protected but its last backup succeeded weeks ago. What is the correct interpretation.

Incorrect Answers

A:

A policy configured on paper does not prove successful execution. Job outcomes and generated recovery points establish actual protection. This matters here because a VM shows Protected but its last backup succeeded weeks ago. What is the correct interpretation.

B:

Reading backup data and changing protection settings are different privileged operations. Monitoring roles intentionally exclude destructive writes. This matters here because a VM shows Protected but its last backup succeeded weeks ago. What is the correct interpretation.

C:

Backup vaults support selected newer Azure Backup data sources and policy capabilities. They are not interchangeable with Recovery Services vaults for every workload. This matters here because a VM shows Protected but its last backup succeeded weeks ago. What is the correct interpretation.

Question 695

A business requires backup data to survive the loss of the vault's primary region. Which vault storage redundancy choice is relevant?

  1. Create a Backup vault and choose supported data-source protection policies.
  2. Select a protection or replication mechanism that actually meets the required data-loss interval.
  3. Configure supported geo-redundant backup storage with cross-region restore requirements where eligible.
  4. Choose the database service's native backup and point-in-time restore features where supported.

Explanation

Correct Answer

C:

Geo redundancy can replicate supported backup data to a secondary region, subject to service options and replication delay. This matters here because a business requires backup data to survive the loss of the vault's primary region. Which vault storage redundancy….

Incorrect Answers

A:

Backup vaults support selected newer Azure Backup data sources and policy capabilities. They are not interchangeable with Recovery Services vaults for every workload. This matters here because a business requires backup data to survive the loss of the vault's primary region. Which vault storage redundancy….

B:

RPO measures acceptable lost data duration. Daily VM backups alone do not guarantee a fifteen-minute RPO. This matters here because a business requires backup data to survive the loss of the vault's primary region. Which vault storage redundancy….

D:

Managed database platforms offer service-specific automated backups and restore controls. VM backup policies do not cover every PaaS database. This matters here because a business requires backup data to survive the loss of the vault's primary region. Which vault storage redundancy….

Question 696

A vault uses locally redundant backup storage and the team expects immediate secondary-region restore. What is wrong?

  1. Enable soft delete on locally redundant vault storage and treat it as a secondary-region recovery copy.
  2. Recognize that vault soft delete can retain backup data beyond ordinary protection stop actions.
  3. Create a Recovery Services vault and configure Azure VM protection.
  4. Recognize that locally redundant vault storage does not create a secondary-region copy.

Explanation

Correct Answer

D:

Local redundancy protects local copies; regional disaster recovery requires suitable geo protection and supported restore features. This matters here because a vault uses locally redundant backup storage and the team expects immediate secondary-region restore. What is wrong.

Incorrect Answers

A:

LRS protects local replicas; soft delete addresses deletion, not geographical redundancy. Cross-region recovery requires an eligible geo-redundant backup design and feature support.

B:

Soft delete intentionally delays permanent deletion under supported settings. Retention protects recovery evidence against quick destructive actions. This matters here because a vault uses locally redundant backup storage and the team expects immediate secondary-region restore. What is wrong.

C:

Recovery Services vaults support Azure VM backup with appropriate policies and restore operations. A VM snapshot alone is not a complete scheduled recovery program. This matters here because a vault uses locally redundant backup storage and the team expects immediate secondary-region restore. What is wrong.

Question 697

A support team must restore one Azure SQL PaaS database and assumes Azure VM Backup will protect it. What should they use instead?

  1. Review alert processing suppression, backup job dashboards and escalation policies.
  2. Choose the database service's native backup and point-in-time restore features where supported.
  3. Run an on-demand backup with the supported retention choice before the change.
  4. Configure supported geo-redundant backup storage with cross-region restore requirements where eligible.

Explanation

Correct Answer

B:

Managed database platforms offer service-specific automated backups and restore controls. VM backup policies do not cover every PaaS database. This matters here because a support team must restore one Azure SQL PaaS database and assumes Azure VM Backup will protect it.

Incorrect Answers

A:

Silencing notifications can conceal material backup failures. Monitoring should keep failure evidence and provide an agreed review process. This matters here because a support team must restore one Azure SQL PaaS database and assumes Azure VM Backup will protect it.

C:

On-demand backup creates a requested recovery point outside normal scheduling when workload and policy support it. The operator must verify success. This matters here because a support team must restore one Azure SQL PaaS database and assumes Azure VM Backup will protect it.

D:

Geo redundancy can replicate supported backup data to a secondary region, subject to service options and replication delay. This matters here because a support team must restore one Azure SQL PaaS database and assumes Azure VM Backup will protect it.

Question 698

A database restore fails because the requested target time is outside its PITR window. What should be checked?

  1. Inspect the managed database backup retention and available point-in-time restore range.
  2. Inspect Azure VM backup extension or agent state and the job's detailed error.
  3. Use least-privileged Azure Backup RBAC roles and secure the vault against destructive operations.
  4. Run an on-demand backup with the supported retention choice before the change.

Explanation

Correct Answer

A:

PITR operates only over retained database backups. Recovery cannot target a timestamp outside the supported window. This matters here because a database restore fails because the requested target time is outside its PITR window.

Incorrect Answers

B:

Azure Backup uses supported guest extension or snapshot coordination for VM protection. VM running state alone does not prove backup readiness. This matters here because a database restore fails because the requested target time is outside its PITR window.

C:

Backup management roles should reflect tasks such as read-only monitoring or restore. Owner grants can expose unnecessary protection control. This matters here because a database restore fails because the requested target time is outside its PITR window.

D:

On-demand backup creates a requested recovery point outside normal scheduling when workload and policy support it. The operator must verify success. This matters here because a database restore fails because the requested target time is outside its PITR window.

Question 699

A VM's backup job fails repeatedly because the guest extension is unhealthy. What component should be investigated?

  1. Inspect the managed database backup retention and available point-in-time restore range.
  2. Inspect the backup job history, policy association, VM agent state and failure details.
  3. Create a second daily backup policy without inspecting the failed VM backup extension and detailed job errors.
  4. Inspect Azure VM backup extension or agent state and the job's detailed error.

Explanation

Correct Answer

D:

Azure Backup uses supported guest extension or snapshot coordination for VM protection. VM running state alone does not prove backup readiness. This matters here because a VM's backup job fails repeatedly because the guest extension is unhealthy. What component should be investigated.

Incorrect Answers

A:

PITR operates only over retained database backups. Recovery cannot target a timestamp outside the supported window. This matters here because a VM's backup job fails repeatedly because the guest extension is unhealthy. What component should be investigated.

B:

A policy configured on paper does not prove successful execution. Job outcomes and generated recovery points establish actual protection. This matters here because a VM's backup job fails repeatedly because the guest extension is unhealthy. What component should be investigated.

C:

A new schedule does not heal a broken guest or backup extension. Inspect the extension state and failing protection job before rerunning.

Question 700

A backup operation reports a VM snapshot consistency warning. What should be verified?

  1. Review application-consistent versus crash-consistent recovery point requirements.
  2. Assume that every Completed Azure Backup job produced an application-consistent recovery point.
  3. Reprotect the recovered workload and perform a supported failback sequence when the source is ready.
  4. Use Azure Backup file recovery from an eligible VM recovery point.

Explanation

Correct Answer

A:

Application quiescing and crash consistency differ. The recovery strategy should match the protected workload's tolerance. This matters here because a backup operation reports a VM snapshot consistency warning.

Incorrect Answers

B:

A completed backup job may have a crash-consistent recovery point or workload warnings. Review the actual consistency type and restore requirements rather than assuming application consistency.

C:

Failback requires replication direction and target infrastructure readiness; the initial failover is not automatically reversible. This matters here because a backup operation reports a VM snapshot consistency warning.

D:

File recovery can mount or access a recovery point for selective file retrieval. Restoring the entire VM is unnecessary when a file suffices. This matters here because a backup operation reports a VM snapshot consistency warning.

Microsoft Azure Administrator (AZ-104) Practice Tests