Topic 14 Practice Test 1 covers Azure Monitor for Microsoft Azure Administrator AZ-104 and maps to the objective: Monitor resources in Azure. For broader exam preparation, review the Microsoft AZ-104 Exam Dumps. Every option includes focused technical reasoning explaining both the Azure concept and its fit to the scenario.
Question 1
Fourth Coffee is reviewing an Azure configuration that must chart Percentage CPU for a VM over the last hour and alert when the numeric value stays above a threshold. Which action should be selected? Choose ONE.
- Use Azure Monitor metrics for the numeric time-series signal
- Configure a diagnostic setting that sends the required resource logs to a Log Analytics workspace
- Run a Kusto Query Language query in Log Analytics
- Create an Azure Monitor log search alert rule
Correct Answer: A
Correct Answer
Answer A is correct because Azure Monitor metrics store numeric time-series values such as platform CPU percentage, request count, or latency. Metrics are well suited to fast charting and threshold evaluation without first writing a KQL query over log records. The deciding need is to use the native numeric time-series signal for fast charting and threshold-based monitoring. That is the best fit here.
Incorrect Answers
Answer B is incorrect because Diagnostic settings route supported platform logs and metrics from an Azure resource to destinations such as a Log Analytics workspace. The workspace then stores queryable log records for cross-resource analysis and alerting. Operationally, the team must use the native numeric time-series signal for fast charting and threshold-based monitoring. This misses the scenario’s key constraint.
Answer C is incorrect because Log Analytics queries Azure Monitor Logs by using Kusto Query Language. KQL can filter, summarize, join, and correlate structured log records over time when a question cannot be answered by a single platform metric. The requirement is to use the native numeric time-series signal for fast charting and threshold-based monitoring. That does not meet the deciding constraint.
Answer D is incorrect because A log search alert periodically evaluates a KQL query and fires when the returned data meets the configured condition. It is appropriate when the detection logic depends on log records rather than a native metric signal. The scenario requires the team to use the native numeric time-series signal for fast charting and threshold-based monitoring. This solves a different Azure problem.
Question 2
Contoso is investigating a latency spike and first wants the resource provider metric rather than querying semi-structured event records. What should the Azure administrator configure? Choose ONE.
- Configure a diagnostic setting that sends the required resource logs to a Log Analytics workspace
- Use Azure Monitor metrics for the numeric time-series signal
- Run a Kusto Query Language query in Log Analytics
- Create an Azure Monitor log search alert rule
Correct Answer: B
Correct Answer
Answer B is correct because Azure Monitor metrics store numeric time-series values such as platform CPU percentage, request count, or latency. Metrics are well suited to fast charting and threshold evaluation without first writing a KQL query over log records. Operationally, the team must use the native numeric time-series signal for fast charting and threshold-based monitoring. This is the required platform behavior.
Incorrect Answers
Answer A is incorrect because Diagnostic settings route supported platform logs and metrics from an Azure resource to destinations such as a Log Analytics workspace. The workspace then stores queryable log records for cross-resource analysis and alerting. For this design, the team must use the native numeric time-series signal for fast charting and threshold-based monitoring. That behavior differs from the requirement.
Answer C is incorrect because Log Analytics queries Azure Monitor Logs by using Kusto Query Language. KQL can filter, summarize, join, and correlate structured log records over time when a question cannot be answered by a single platform metric. Here the administrator must use the native numeric time-series signal for fast charting and threshold-based monitoring. This would not produce the requested result.
Answer D is incorrect because A log search alert periodically evaluates a KQL query and fires when the returned data meets the configured condition. It is appropriate when the detection logic depends on log records rather than a native metric signal. The requested outcome is to use the native numeric time-series signal for fast charting and threshold-based monitoring. That feature addresses another administration need.
Question 3
Woodgrove Bank created a Log Analytics workspace but a network resource still sends no diagnostic records because no routing configuration exists. Choose the most appropriate Azure configuration. Choose ONE.
- Use Azure Monitor metrics for the numeric time-series signal
- Run a Kusto Query Language query in Log Analytics
- Configure a diagnostic setting that sends the required resource logs to a Log Analytics workspace
- Create an Activity Log alert rule for the administrative operation
Correct Answer: C
Correct Answer
Answer C is correct because Diagnostic settings route supported platform logs and metrics from an Azure resource to destinations such as a Log Analytics workspace. The workspace then stores queryable log records for cross-resource analysis and alerting. The key requirement is to route supported resource logs into a Log Analytics workspace so they can be retained and queried centrally. That directly meets the stated constraint.
Incorrect Answers
Answer A is incorrect because Azure Monitor metrics store numeric time-series values such as platform CPU percentage, request count, or latency. Metrics are well suited to fast charting and threshold evaluation without first writing a KQL query over log records. Here the administrator must route supported resource logs into a Log Analytics workspace so they can be retained and queried centrally. This solves a different Azure problem.
Answer B is incorrect because Log Analytics queries Azure Monitor Logs by using Kusto Query Language. KQL can filter, summarize, join, and correlate structured log records over time when a question cannot be answered by a single platform metric. The deciding need is to route supported resource logs into a Log Analytics workspace so they can be retained and queried centrally. That leaves the required outcome unmet.
Answer D is incorrect because Azure Activity Log records subscription-level control-plane events such as resource creation, deletion, or configuration changes. An Activity Log alert is appropriate when notification should be driven by a specific administrative or service-health event. The key requirement is to route supported resource logs into a Log Analytics workspace so they can be retained and queried centrally. This is adjacent, but not sufficient.
Question 4
Trey Research has a storage account whose platform logs are not appearing in the security team’s Log Analytics workspace. What should the Azure administrator configure? Choose ONE.
- Use Azure Monitor metrics for the numeric time-series signal
- Run a Kusto Query Language query in Log Analytics
- Create an Activity Log alert rule for the administrative operation
- Configure a diagnostic setting that sends the required resource logs to a Log Analytics workspace
Correct Answer: D
Correct Answer
Answer D is correct because Diagnostic settings route supported platform logs and metrics from an Azure resource to destinations such as a Log Analytics workspace. The workspace then stores queryable log records for cross-resource analysis and alerting. The requirement is to route supported resource logs into a Log Analytics workspace so they can be retained and queried centrally. This directly implements the requested outcome.
Incorrect Answers
Answer A is incorrect because Azure Monitor metrics store numeric time-series values such as platform CPU percentage, request count, or latency. Metrics are well suited to fast charting and threshold evaluation without first writing a KQL query over log records. The deciding need is to route supported resource logs into a Log Analytics workspace so they can be retained and queried centrally. That feature addresses another administration need.
Answer B is incorrect because Log Analytics queries Azure Monitor Logs by using Kusto Query Language. KQL can filter, summarize, join, and correlate structured log records over time when a question cannot be answered by a single platform metric. Operationally, the team must route supported resource logs into a Log Analytics workspace so they can be retained and queried centrally. This misses the scenario’s key constraint.
Answer C is incorrect because Azure Activity Log records subscription-level control-plane events such as resource creation, deletion, or configuration changes. An Activity Log alert is appropriate when notification should be driven by a specific administrative or service-health event. The requirement is to route supported resource logs into a Log Analytics workspace so they can be retained and queried centrally. That does not meet the deciding constraint.
Question 5
Tailspin Toys must count failed operations by resource and summarize them by 15-minute bins from workspace log tables. Choose the most appropriate Azure configuration. Choose ONE.
- Run a Kusto Query Language query in Log Analytics
- Use Azure Monitor metrics for the numeric time-series signal
- Create an Azure Monitor metric alert rule
- Create an Activity Log alert rule for the administrative operation
Correct Answer: A
Correct Answer
Answer A is correct because Log Analytics queries Azure Monitor Logs by using Kusto Query Language. KQL can filter, summarize, join, and correlate structured log records over time when a question cannot be answered by a single platform metric. The scenario requires the team to analyze and correlate records already stored in Azure Monitor Logs. That matches the requested operational result.
Incorrect Answers
Answer B is incorrect because Azure Monitor metrics store numeric time-series values such as platform CPU percentage, request count, or latency. Metrics are well suited to fast charting and threshold evaluation without first writing a KQL query over log records. Operationally, the team must analyze and correlate records already stored in Azure Monitor Logs. This is adjacent, but not sufficient.
Answer C is incorrect because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. For this design, the team must analyze and correlate records already stored in Azure Monitor Logs. That behavior differs from the requirement.
Answer D is incorrect because Azure Activity Log records subscription-level control-plane events such as resource creation, deletion, or configuration changes. An Activity Log alert is appropriate when notification should be driven by a specific administrative or service-health event. Here the administrator must analyze and correlate records already stored in Azure Monitor Logs. This would not produce the requested result.
Question 6
In Fourth Coffee’s Azure environment, the organization has diagnostic records in a workspace and wants a query that returns the top error codes over the previous day. Which choice is the best fit? Choose ONE.
- Use Azure Monitor metrics for the numeric time-series signal
- Run a Kusto Query Language query in Log Analytics
- Create an Azure Monitor metric alert rule
- Create an Activity Log alert rule for the administrative operation
Correct Answer: B
Correct Answer
Answer B is correct because Log Analytics queries Azure Monitor Logs by using Kusto Query Language. KQL can filter, summarize, join, and correlate structured log records over time when a question cannot be answered by a single platform metric. The requested outcome is to analyze and correlate records already stored in Azure Monitor Logs. This meets the deciding technical requirement.
Incorrect Answers
Answer A is incorrect because Azure Monitor metrics store numeric time-series values such as platform CPU percentage, request count, or latency. Metrics are well suited to fast charting and threshold evaluation without first writing a KQL query over log records. The key requirement is to analyze and correlate records already stored in Azure Monitor Logs. That does not meet the deciding constraint.
Answer C is incorrect because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. Here the administrator must analyze and correlate records already stored in Azure Monitor Logs. This solves a different Azure problem.
Answer D is incorrect because Azure Activity Log records subscription-level control-plane events such as resource creation, deletion, or configuration changes. An Activity Log alert is appropriate when notification should be driven by a specific administrative or service-health event. The deciding need is to analyze and correlate records already stored in Azure Monitor Logs. That leaves the required outcome unmet.
Question 7
Trey Research is reviewing an Azure configuration that must notify operations when a supported platform metric crosses a configured numeric condition. Which action should be selected? Choose ONE.
- Create an Azure Monitor log search alert rule
- Create an Activity Log alert rule for the administrative operation
- Create an Azure Monitor metric alert rule
- Create an alert processing rule for the maintenance window
Correct Answer: C
Correct Answer
Answer C is correct because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. The key requirement is to trigger an alert directly from an Azure Monitor metric threshold. That satisfies the scenario without extra changes.
Incorrect Answers
Answer A is incorrect because A log search alert periodically evaluates a KQL query and fires when the returned data meets the configured condition. It is appropriate when the detection logic depends on log records rather than a native metric signal. The requirement is to trigger an alert directly from an Azure Monitor metric threshold. This would not produce the requested result.
Answer B is incorrect because Azure Activity Log records subscription-level control-plane events such as resource creation, deletion, or configuration changes. An Activity Log alert is appropriate when notification should be driven by a specific administrative or service-health event. The deciding need is to trigger an alert directly from an Azure Monitor metric threshold. That feature addresses another administration need.
Answer D is incorrect because Alert processing rules modify actions for alerts as they fire. They can suppress or add action groups, filter which alerts are affected, and apply the behavior on a schedule without disabling or deleting the underlying alert rules. Operationally, the team must trigger an alert directly from an Azure Monitor metric threshold. This misses the scenario’s key constraint.
Question 8
In A. Datum’s Azure environment, the organization needs an alert when a VM Percentage CPU metric remains above 85 percent for the evaluation window. Which choice is the best fit? Choose ONE.
- Create an Azure Monitor log search alert rule
- Create an Activity Log alert rule for the administrative operation
- Create an alert processing rule for the maintenance window
- Create an Azure Monitor metric alert rule
Correct Answer: D
Correct Answer
Answer D is correct because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. The requirement is to trigger an alert directly from an Azure Monitor metric threshold. This produces the required Azure behavior.
Incorrect Answers
Answer A is incorrect because A log search alert periodically evaluates a KQL query and fires when the returned data meets the configured condition. It is appropriate when the detection logic depends on log records rather than a native metric signal. The scenario requires the team to trigger an alert directly from an Azure Monitor metric threshold. That leaves the required outcome unmet.
Answer B is incorrect because Azure Activity Log records subscription-level control-plane events such as resource creation, deletion, or configuration changes. An Activity Log alert is appropriate when notification should be driven by a specific administrative or service-health event. Operationally, the team must trigger an alert directly from an Azure Monitor metric threshold. This is adjacent, but not sufficient.
Answer C is incorrect because Alert processing rules modify actions for alerts as they fire. They can suppress or add action groups, filter which alerts are affected, and apply the behavior on a schedule without disabling or deleting the underlying alert rules. For this design, the team must trigger an alert directly from an Azure Monitor metric threshold. That behavior differs from the requirement.
Question 9
Humongous Insurance is reviewing an Azure configuration that needs an alert when a workspace query finds more than five failed authentication records in ten minutes. Which action should be selected? Choose ONE.
- Create an Azure Monitor log search alert rule
- Create an Azure Monitor metric alert rule
- Create an Activity Log alert rule for the administrative operation
- Create an alert processing rule for the maintenance window
Correct Answer: A
Correct Answer
Answer A is correct because A log search alert periodically evaluates a KQL query and fires when the returned data meets the configured condition. It is appropriate when the detection logic depends on log records rather than a native metric signal. The scenario requires the team to trigger an alert when the result of a KQL log query meets a condition. That is the best fit here.
Incorrect Answers
Answer B is incorrect because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. The requested outcome is to trigger an alert when the result of a KQL log query meets a condition. This misses the scenario’s key constraint.
Answer C is incorrect because Azure Activity Log records subscription-level control-plane events such as resource creation, deletion, or configuration changes. An Activity Log alert is appropriate when notification should be driven by a specific administrative or service-health event. The key requirement is to trigger an alert when the result of a KQL log query meets a condition. That does not meet the deciding constraint.
Answer D is incorrect because Alert processing rules modify actions for alerts as they fire. They can suppress or add action groups, filter which alerts are affected, and apply the behavior on a schedule without disabling or deleting the underlying alert rules. Here the administrator must trigger an alert when the result of a KQL log query meets a condition. This solves a different Azure problem.
Question 10
Tailspin Toys has the required signal only in Azure Monitor Logs and needs scheduled query-based detection. What should the Azure administrator configure? Choose ONE.
- Create an Azure Monitor metric alert rule
- Create an Azure Monitor log search alert rule
- Create an Activity Log alert rule for the administrative operation
- Create an alert processing rule for the maintenance window
Correct Answer: B
Correct Answer
Answer B is correct because A log search alert periodically evaluates a KQL query and fires when the returned data meets the configured condition. It is appropriate when the detection logic depends on log records rather than a native metric signal. The deciding need is to trigger an alert when the result of a KQL log query meets a condition. This is the required platform behavior.
Incorrect Answers
Answer A is incorrect because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. The key requirement is to trigger an alert when the result of a KQL log query meets a condition. That behavior differs from the requirement.
Answer C is incorrect because Azure Activity Log records subscription-level control-plane events such as resource creation, deletion, or configuration changes. An Activity Log alert is appropriate when notification should be driven by a specific administrative or service-health event. The requirement is to trigger an alert when the result of a KQL log query meets a condition. This would not produce the requested result.
Answer D is incorrect because Alert processing rules modify actions for alerts as they fire. They can suppress or add action groups, filter which alerts are affected, and apply the behavior on a schedule without disabling or deleting the underlying alert rules. The deciding need is to trigger an alert when the result of a KQL log query meets a condition. That feature addresses another administration need.
Question 11
- Datum needs a reusable object containing email, webhook, and automation destinations for multiple Azure Monitor alerts. Choose the most appropriate Azure configuration. Choose ONE.
- Create an alert processing rule for the maintenance window
- Create an Azure Monitor metric alert rule
- Attach an Azure Monitor action group to the alert rule
- Configure a diagnostic setting that sends the required resource logs to a Log Analytics workspace
Correct Answer: C
Correct Answer
Answer C is correct because Action groups define reusable notification and automation actions for Azure Monitor alerts, including email, SMS, push, webhooks, Logic Apps, Azure Functions, Automation runbooks, and other supported integrations. Operationally, the team must define reusable notification or automation actions that execute when an Azure Monitor alert fires. That directly meets the stated constraint.
Incorrect Answers
Answer A is incorrect because Alert processing rules modify actions for alerts as they fire. They can suppress or add action groups, filter which alerts are affected, and apply the behavior on a schedule without disabling or deleting the underlying alert rules. The requirement is to define reusable notification or automation actions that execute when an Azure Monitor alert fires. This solves a different Azure problem.
Answer B is incorrect because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. The scenario requires the team to define reusable notification or automation actions that execute when an Azure Monitor alert fires. That leaves the required outcome unmet.
Answer D is incorrect because Diagnostic settings route supported platform logs and metrics from an Azure resource to destinations such as a Log Analytics workspace. The workspace then stores queryable log records for cross-resource analysis and alerting. Operationally, the team must define reusable notification or automation actions that execute when an Azure Monitor alert fires. This is adjacent, but not sufficient.
Question 12
Adventure Works already has a metric alert but no one receives email when it fires and the same notification list will be reused by several rules. What should the Azure administrator configure? Choose ONE.
- Create an alert processing rule for the maintenance window
- Create an Azure Monitor metric alert rule
- Configure a diagnostic setting that sends the required resource logs to a Log Analytics workspace
- Attach an Azure Monitor action group to the alert rule
Correct Answer: D
Correct Answer
Answer D is correct because Action groups define reusable notification and automation actions for Azure Monitor alerts, including email, SMS, push, webhooks, Logic Apps, Azure Functions, Automation runbooks, and other supported integrations. For this design, the team must define reusable notification or automation actions that execute when an Azure Monitor alert fires. This directly implements the requested outcome.
Incorrect Answers
Answer A is incorrect because Alert processing rules modify actions for alerts as they fire. They can suppress or add action groups, filter which alerts are affected, and apply the behavior on a schedule without disabling or deleting the underlying alert rules. The scenario requires the team to define reusable notification or automation actions that execute when an Azure Monitor alert fires. That feature addresses another administration need.
Answer B is incorrect because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. The requested outcome is to define reusable notification or automation actions that execute when an Azure Monitor alert fires. This misses the scenario’s key constraint.
Answer C is incorrect because Diagnostic settings route supported platform logs and metrics from an Azure resource to destinations such as a Log Analytics workspace. The workspace then stores queryable log records for cross-resource analysis and alerting. The key requirement is to define reusable notification or automation actions that execute when an Azure Monitor alert fires. That does not meet the deciding constraint.
Question 13
Wingtip Toys patches production VMs every Sunday and wants alerts to continue evaluating while notifications are suppressed during the maintenance period. Choose the most appropriate Azure configuration. Choose ONE.
- Create an alert processing rule for the maintenance window
- Attach an Azure Monitor action group to the alert rule
- Create an Azure Monitor metric alert rule
- Create an Azure Monitor log search alert rule
Correct Answer: A
Correct Answer
Answer A is correct because Alert processing rules modify actions for alerts as they fire. They can suppress or add action groups, filter which alerts are affected, and apply the behavior on a schedule without disabling or deleting the underlying alert rules. Here the administrator must suppress alert actions during a scheduled maintenance window without deleting or disabling the alert rules. That matches the requested operational result.
Incorrect Answers
Answer B is incorrect because Action groups define reusable notification and automation actions for Azure Monitor alerts, including email, SMS, push, webhooks, Logic Apps, Azure Functions, Automation runbooks, and other supported integrations. The deciding need is to suppress alert actions during a scheduled maintenance window without deleting or disabling the alert rules. This is adjacent, but not sufficient.
Answer C is incorrect because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. The key requirement is to suppress alert actions during a scheduled maintenance window without deleting or disabling the alert rules. That behavior differs from the requirement.
Answer D is incorrect because A log search alert periodically evaluates a KQL query and fires when the returned data meets the configured condition. It is appropriate when the detection logic depends on log records rather than a native metric signal. The requirement is to suppress alert actions during a scheduled maintenance window without deleting or disabling the alert rules. This would not produce the requested result.
Question 14
In Humongous Insurance’s Azure environment, the organization needs to prevent a maintenance window from paging responders but does not want to edit dozens of individual alert rules. Which choice is the best fit? Choose ONE.
- Attach an Azure Monitor action group to the alert rule
- Create an alert processing rule for the maintenance window
- Create an Azure Monitor metric alert rule
- Create an Azure Monitor log search alert rule
Correct Answer: B
Correct Answer
Answer B is correct because Alert processing rules modify actions for alerts as they fire. They can suppress or add action groups, filter which alerts are affected, and apply the behavior on a schedule without disabling or deleting the underlying alert rules. The deciding need is to suppress alert actions during a scheduled maintenance window without deleting or disabling the alert rules. This meets the deciding technical requirement.
Incorrect Answers
Answer A is incorrect because Action groups define reusable notification and automation actions for Azure Monitor alerts, including email, SMS, push, webhooks, Logic Apps, Azure Functions, Automation runbooks, and other supported integrations. Operationally, the team must suppress alert actions during a scheduled maintenance window without deleting or disabling the alert rules. That does not meet the deciding constraint.
Answer C is incorrect because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. The requirement is to suppress alert actions during a scheduled maintenance window without deleting or disabling the alert rules. This solves a different Azure problem.
Answer D is incorrect because A log search alert periodically evaluates a KQL query and fires when the returned data meets the configured condition. It is appropriate when the detection logic depends on log records rather than a native metric signal. The scenario requires the team to suppress alert actions during a scheduled maintenance window without deleting or disabling the alert rules. That leaves the required outcome unmet.
Question 15
Adventure Works is reviewing an Azure configuration that must compare processor and memory trends for an Azure VM using the predefined monitoring views rather than building a custom workbook first. Which action should be selected? Choose ONE.
- Use Azure Monitor metrics for the numeric time-series signal
- Run a Kusto Query Language query in Log Analytics
- Use VM insights Performance to analyze guest CPU, memory, disk, and network behavior
- Use Network Watcher Connection Monitor for continuous end-to-end connectivity monitoring
Correct Answer: C
Correct Answer
Answer C is correct because VM insights provides prebuilt performance views for monitored virtual machines and uses Azure Monitor data to expose guest operating-system indicators such as processor, memory, disk, and network utilization for troubleshooting and capacity analysis. Operationally, the team must use the prebuilt Azure Monitor experience for guest VM performance troubleshooting and capacity analysis. That satisfies the scenario without extra changes.
Incorrect Answers
Answer A is incorrect because Azure Monitor metrics store numeric time-series values such as platform CPU percentage, request count, or latency. Metrics are well suited to fast charting and threshold evaluation without first writing a KQL query over log records. For this design, the team must use the prebuilt Azure Monitor experience for guest VM performance troubleshooting and capacity analysis. This would not produce the requested result.
Answer B is incorrect because Log Analytics queries Azure Monitor Logs by using Kusto Query Language. KQL can filter, summarize, join, and correlate structured log records over time when a question cannot be answered by a single platform metric. The scenario requires the team to use the prebuilt Azure Monitor experience for guest VM performance troubleshooting and capacity analysis. That feature addresses another administration need.
Answer D is incorrect because Connection Monitor continuously tests connectivity between configured sources and destinations and can surface reachability, latency, and path-related information over time. It is intended for ongoing network connectivity monitoring rather than one-time log analysis. The requested outcome is to use the prebuilt Azure Monitor experience for guest VM performance troubleshooting and capacity analysis. This misses the scenario’s key constraint.
Question 16
In City Power & Light’s Azure environment, the organization needs a consolidated view of guest CPU, memory, disk, and network behavior for a monitored Azure VM. Which choice is the best fit? Choose ONE.
- Use Azure Monitor metrics for the numeric time-series signal
- Run a Kusto Query Language query in Log Analytics
- Use Network Watcher Connection Monitor for continuous end-to-end connectivity monitoring
- Use VM insights Performance to analyze guest CPU, memory, disk, and network behavior
Correct Answer: D
Correct Answer
Answer D is correct because VM insights provides prebuilt performance views for monitored virtual machines and uses Azure Monitor data to expose guest operating-system indicators such as processor, memory, disk, and network utilization for troubleshooting and capacity analysis. For this design, the team must use the prebuilt Azure Monitor experience for guest VM performance troubleshooting and capacity analysis. This produces the required Azure behavior.
Incorrect Answers
Answer A is incorrect because Azure Monitor metrics store numeric time-series values such as platform CPU percentage, request count, or latency. Metrics are well suited to fast charting and threshold evaluation without first writing a KQL query over log records. Here the administrator must use the prebuilt Azure Monitor experience for guest VM performance troubleshooting and capacity analysis. That leaves the required outcome unmet.
Answer B is incorrect because Log Analytics queries Azure Monitor Logs by using Kusto Query Language. KQL can filter, summarize, join, and correlate structured log records over time when a question cannot be answered by a single platform metric. The deciding need is to use the prebuilt Azure Monitor experience for guest VM performance troubleshooting and capacity analysis. This is adjacent, but not sufficient.
Answer C is incorrect because Connection Monitor continuously tests connectivity between configured sources and destinations and can surface reachability, latency, and path-related information over time. It is intended for ongoing network connectivity monitoring rather than one-time log analysis. The key requirement is to use the prebuilt Azure Monitor experience for guest VM performance troubleshooting and capacity analysis. That behavior differs from the requirement.
Question 17
Northwind Traders is reviewing an Azure configuration that needs ongoing measurements from an Azure VM to a private application endpoint and wants to know when reachability or latency degrades. Which action should be selected? Choose ONE.
- Use Network Watcher Connection Monitor for continuous end-to-end connectivity monitoring
- Run a Kusto Query Language query in Log Analytics
- Configure a diagnostic setting that sends the required resource logs to a Log Analytics workspace
- Use VM insights Performance to analyze guest CPU, memory, disk, and network behavior
Correct Answer: A
Correct Answer
Answer A is correct because Connection Monitor continuously tests connectivity between configured sources and destinations and can surface reachability, latency, and path-related information over time. It is intended for ongoing network connectivity monitoring rather than one-time log analysis. The requirement is to continuously monitor end-to-end network reachability and latency between specified sources and destinations. That is the best fit here.
Incorrect Answers
Answer B is incorrect because Log Analytics queries Azure Monitor Logs by using Kusto Query Language. KQL can filter, summarize, join, and correlate structured log records over time when a question cannot be answered by a single platform metric. The deciding need is to continuously monitor end-to-end network reachability and latency between specified sources and destinations. This misses the scenario’s key constraint.
Answer C is incorrect because Diagnostic settings route supported platform logs and metrics from an Azure resource to destinations such as a Log Analytics workspace. The workspace then stores queryable log records for cross-resource analysis and alerting. Operationally, the team must continuously monitor end-to-end network reachability and latency between specified sources and destinations. That does not meet the deciding constraint.
Answer D is incorrect because VM insights provides prebuilt performance views for monitored virtual machines and uses Azure Monitor data to expose guest operating-system indicators such as processor, memory, disk, and network utilization for troubleshooting and capacity analysis. The requirement is to continuously monitor end-to-end network reachability and latency between specified sources and destinations. This solves a different Azure problem.
Question 18
Wingtip Toys is troubleshooting intermittent network failures and requires continuous source-to-destination connectivity observations. What should the Azure administrator configure? Choose ONE.
- Run a Kusto Query Language query in Log Analytics
- Use Network Watcher Connection Monitor for continuous end-to-end connectivity monitoring
- Configure a diagnostic setting that sends the required resource logs to a Log Analytics workspace
- Use VM insights Performance to analyze guest CPU, memory, disk, and network behavior
Correct Answer: B
Correct Answer
Answer B is correct because Connection Monitor continuously tests connectivity between configured sources and destinations and can surface reachability, latency, and path-related information over time. It is intended for ongoing network connectivity monitoring rather than one-time log analysis. The scenario requires the team to continuously monitor end-to-end network reachability and latency between specified sources and destinations. This is the required platform behavior.
Incorrect Answers
Answer A is incorrect because Log Analytics queries Azure Monitor Logs by using Kusto Query Language. KQL can filter, summarize, join, and correlate structured log records over time when a question cannot be answered by a single platform metric. Operationally, the team must continuously monitor end-to-end network reachability and latency between specified sources and destinations. That behavior differs from the requirement.
Answer C is incorrect because Diagnostic settings route supported platform logs and metrics from an Azure resource to destinations such as a Log Analytics workspace. The workspace then stores queryable log records for cross-resource analysis and alerting. For this design, the team must continuously monitor end-to-end network reachability and latency between specified sources and destinations. This would not produce the requested result.
Answer D is incorrect because VM insights provides prebuilt performance views for monitored virtual machines and uses Azure Monitor data to expose guest operating-system indicators such as processor, memory, disk, and network utilization for troubleshooting and capacity analysis. The scenario requires the team to continuously monitor end-to-end network reachability and latency between specified sources and destinations. That feature addresses another administration need.
Question 19
City Power & Light is creating metric-based monitoring for a service and wants the fired alert to invoke the standard webhook and SMS workflow. Choose the most appropriate Azure configuration. Choose TWO.
- Create an Azure Monitor metric alert rule
- Create an Azure Monitor log search alert rule
- Create an alert processing rule for the maintenance window
- Attach an Azure Monitor action group to the alert rule
- Configure a diagnostic setting that sends the required resource logs to a Log Analytics workspace
Correct Answers: A, D
Correct Answers
Answer A is correct because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. The requested outcome is to detect a native metric threshold and send the resulting alert to the operations notification workflow. That directly meets the stated constraint.
Answer D is correct because Action groups define reusable notification and automation actions for Azure Monitor alerts, including email, SMS, push, webhooks, Logic Apps, Azure Functions, Automation runbooks, and other supported integrations. For this design, the team must detect a native metric threshold and send the resulting alert to the operations notification workflow. This produces the required Azure behavior.
Incorrect Answers
Answer B is incorrect because A log search alert periodically evaluates a KQL query and fires when the returned data meets the configured condition. It is appropriate when the detection logic depends on log records rather than a native metric signal. Here the administrator must detect a native metric threshold and send the resulting alert to the operations notification workflow. That leaves the required outcome unmet.
Answer C is incorrect because Alert processing rules modify actions for alerts as they fire. They can suppress or add action groups, filter which alerts are affected, and apply the behavior on a schedule without disabling or deleting the underlying alert rules. The deciding need is to detect a native metric threshold and send the resulting alert to the operations notification workflow. This is adjacent, but not sufficient.
Answer E is incorrect because Diagnostic settings route supported platform logs and metrics from an Azure resource to destinations such as a Log Analytics workspace. The workspace then stores queryable log records for cross-resource analysis and alerting. The key requirement is to detect a native metric threshold and send the resulting alert to the operations notification workflow. That behavior differs from the requirement.
Question 20
Litware must alert on a platform CPU metric and email the on-call team when the condition fires. What should the Azure administrator configure? Choose TWO.
- Create an Azure Monitor log search alert rule
- Create an Azure Monitor metric alert rule
- Create an alert processing rule for the maintenance window
- Configure a diagnostic setting that sends the required resource logs to a Log Analytics workspace
- Attach an Azure Monitor action group to the alert rule
Correct Answers: B, E
Correct Answers
Answer B is correct because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. The key requirement is to detect a native metric threshold and send the resulting alert to the operations notification workflow. This directly implements the requested outcome.
Answer E is correct because Action groups define reusable notification and automation actions for Azure Monitor alerts, including email, SMS, push, webhooks, Logic Apps, Azure Functions, Automation runbooks, and other supported integrations. The requirement is to detect a native metric threshold and send the resulting alert to the operations notification workflow. That is the best fit here.
Incorrect Answers
Answer A is incorrect because A log search alert periodically evaluates a KQL query and fires when the returned data meets the configured condition. It is appropriate when the detection logic depends on log records rather than a native metric signal. The deciding need is to detect a native metric threshold and send the resulting alert to the operations notification workflow. This misses the scenario’s key constraint.
Answer C is incorrect because Alert processing rules modify actions for alerts as they fire. They can suppress or add action groups, filter which alerts are affected, and apply the behavior on a schedule without disabling or deleting the underlying alert rules. Operationally, the team must detect a native metric threshold and send the resulting alert to the operations notification workflow. That does not meet the deciding constraint.
Answer D is incorrect because Diagnostic settings route supported platform logs and metrics from an Azure resource to destinations such as a Log Analytics workspace. The workspace then stores queryable log records for cross-resource analysis and alerting. The requirement is to detect a native metric threshold and send the resulting alert to the operations notification workflow. This solves a different Azure problem.
