Microsoft Azure Administrator AZ-104 Azure Monitor Practice Test 2

 

Topic 14 Practice Test 2 covers Azure Monitor for Microsoft Azure Administrator AZ-104 and maps to the objective: Monitor resources in Azure. For broader exam preparation, review the Microsoft AZ-104 Exam Dumps. Every option includes focused technical reasoning explaining both the Azure concept and its fit to the scenario.

Question 1

During an operational review at City Power & Light, the team finds that the environment needs a near-real-time graph of request count where the signal already exists as an Azure platform metric. What should the administrator use? Choose ONE.

1. Use Azure Monitor metrics for the numeric time-series signal
2. Configure a diagnostic setting that sends the required resource logs to a Log Analytics workspace
3. Run a Kusto Query Language query in Log Analytics
4. Create an Azure Monitor log search alert rule

Correct Answer: A

Correct Answer

 

 

Answer A is correct because Azure Monitor metrics store numeric time-series values such as platform CPU percentage, request count, or latency. Metrics are well suited to fast charting and threshold evaluation without first writing a KQL query over log records. The scenario requires the team to use the native numeric time-series signal for fast charting and threshold-based monitoring. That is the best fit here.

Incorrect Answers

 

Answer B is incorrect because Diagnostic settings route supported platform logs and metrics from an Azure resource to destinations such as a Log Analytics workspace. The workspace then stores queryable log records for cross-resource analysis and alerting. The requested outcome is to use the native numeric time-series signal for fast charting and threshold-based monitoring. This misses the scenario’s key constraint.

Answer C is incorrect because Log Analytics queries Azure Monitor Logs by using Kusto Query Language. KQL can filter, summarize, join, and correlate structured log records over time when a question cannot be answered by a single platform metric. The key requirement is to use the native numeric time-series signal for fast charting and threshold-based monitoring. That does not meet the deciding constraint.

Answer D is incorrect because A log search alert periodically evaluates a KQL query and fires when the returned data meets the configured condition. It is appropriate when the detection logic depends on log records rather than a native metric signal. Here the administrator must use the native numeric time-series signal for fast charting and threshold-based monitoring. This solves a different Azure problem.

 

Question 2

At Adventure Works, the team must compare a built-in numeric performance signal across time without writing a KQL query. Which option best meets the requirement? Choose ONE.

1. Configure a diagnostic setting that sends the required resource logs to a Log Analytics workspace
2. Use Azure Monitor metrics for the numeric time-series signal
3. Run a Kusto Query Language query in Log Analytics
4. Create an Azure Monitor log search alert rule

Correct Answer: B

Correct Answer

 

 

Answer B is correct because Azure Monitor metrics store numeric time-series values such as platform CPU percentage, request count, or latency. Metrics are well suited to fast charting and threshold evaluation without first writing a KQL query over log records. The deciding need is to use the native numeric time-series signal for fast charting and threshold-based monitoring. This is the required platform behavior.

Incorrect Answers

 

Answer A is incorrect because Diagnostic settings route supported platform logs and metrics from an Azure resource to destinations such as a Log Analytics workspace. The workspace then stores queryable log records for cross-resource analysis and alerting. The key requirement is to use the native numeric time-series signal for fast charting and threshold-based monitoring. That behavior differs from the requirement.

Answer C is incorrect because Log Analytics queries Azure Monitor Logs by using Kusto Query Language. KQL can filter, summarize, join, and correlate structured log records over time when a question cannot be answered by a single platform metric. The requirement is to use the native numeric time-series signal for fast charting and threshold-based monitoring. This would not produce the requested result.

Answer D is incorrect because A log search alert periodically evaluates a KQL query and fires when the returned data meets the configured condition. It is appropriate when the detection logic depends on log records rather than a native metric signal. The deciding need is to use the native numeric time-series signal for fast charting and threshold-based monitoring. That feature addresses another administration need.

 

Question 3

An Azure administrator for Wingtip Toys learns that the environment needs the supported platform logs from a resource delivered to the workspace used by operations. What should be done? Choose ONE.

1. Use Azure Monitor metrics for the numeric time-series signal
2. Run a Kusto Query Language query in Log Analytics
3. Configure a diagnostic setting that sends the required resource logs to a Log Analytics workspace
4. Create an Activity Log alert rule for the administrative operation

Correct Answer: C

Correct Answer

 

 

Answer C is correct because Diagnostic settings route supported platform logs and metrics from an Azure resource to destinations such as a Log Analytics workspace. The workspace then stores queryable log records for cross-resource analysis and alerting. Operationally, the team must route supported resource logs into a Log Analytics workspace so they can be retained and queried centrally. That directly meets the stated constraint.

Incorrect Answers

 

Answer A is incorrect because Azure Monitor metrics store numeric time-series values such as platform CPU percentage, request count, or latency. Metrics are well suited to fast charting and threshold evaluation without first writing a KQL query over log records. The requirement is to route supported resource logs into a Log Analytics workspace so they can be retained and queried centrally. This solves a different Azure problem.

Answer B is incorrect because Log Analytics queries Azure Monitor Logs by using Kusto Query Language. KQL can filter, summarize, join, and correlate structured log records over time when a question cannot be answered by a single platform metric. The scenario requires the team to route supported resource logs into a Log Analytics workspace so they can be retained and queried centrally. That leaves the required outcome unmet.

Answer D is incorrect because Azure Activity Log records subscription-level control-plane events such as resource creation, deletion, or configuration changes. An Activity Log alert is appropriate when notification should be driven by a specific administrative or service-health event. Operationally, the team must route supported resource logs into a Log Analytics workspace so they can be retained and queried centrally. This is adjacent, but not sufficient.

 

Question 4

At Northwind Traders, the team must centralize resource logs from several Azure services before analysts can run workspace queries. Which option best meets the requirement? Choose ONE.

1. Use Azure Monitor metrics for the numeric time-series signal
2. Run a Kusto Query Language query in Log Analytics
3. Create an Activity Log alert rule for the administrative operation
4. Configure a diagnostic setting that sends the required resource logs to a Log Analytics workspace

Correct Answer: D

Correct Answer

 

 

Answer D is correct because Diagnostic settings route supported platform logs and metrics from an Azure resource to destinations such as a Log Analytics workspace. The workspace then stores queryable log records for cross-resource analysis and alerting. For this design, the team must route supported resource logs into a Log Analytics workspace so they can be retained and queried centrally. This directly implements the requested outcome.

Incorrect Answers

 

Answer A is incorrect because Azure Monitor metrics store numeric time-series values such as platform CPU percentage, request count, or latency. Metrics are well suited to fast charting and threshold evaluation without first writing a KQL query over log records. The scenario requires the team to route supported resource logs into a Log Analytics workspace so they can be retained and queried centrally. That feature addresses another administration need.

Answer B is incorrect because Log Analytics queries Azure Monitor Logs by using Kusto Query Language. KQL can filter, summarize, join, and correlate structured log records over time when a question cannot be answered by a single platform metric. The requested outcome is to route supported resource logs into a Log Analytics workspace so they can be retained and queried centrally. This misses the scenario’s key constraint.

Answer C is incorrect because Azure Activity Log records subscription-level control-plane events such as resource creation, deletion, or configuration changes. An Activity Log alert is appropriate when notification should be driven by a specific administrative or service-health event. The key requirement is to route supported resource logs into a Log Analytics workspace so they can be retained and queried centrally. That does not meet the deciding constraint.

 

Question 5

An Azure administrator for Litware learns that the environment needs to join two Log Analytics tables during an incident investigation and filter the result by resource ID. What should be done? Choose ONE.

1. Run a Kusto Query Language query in Log Analytics
2. Use Azure Monitor metrics for the numeric time-series signal
3. Create an Azure Monitor metric alert rule
4. Create an Activity Log alert rule for the administrative operation

Correct Answer: A

Correct Answer

 

 

Answer A is correct because Log Analytics queries Azure Monitor Logs by using Kusto Query Language. KQL can filter, summarize, join, and correlate structured log records over time when a question cannot be answered by a single platform metric. Here the administrator must analyze and correlate records already stored in Azure Monitor Logs. That matches the requested operational result.

Incorrect Answers

 

Answer B is incorrect because Azure Monitor metrics store numeric time-series values such as platform CPU percentage, request count, or latency. Metrics are well suited to fast charting and threshold evaluation without first writing a KQL query over log records. The deciding need is to analyze and correlate records already stored in Azure Monitor Logs. This is adjacent, but not sufficient.

Answer C is incorrect because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. The key requirement is to analyze and correlate records already stored in Azure Monitor Logs. That behavior differs from the requirement.

Answer D is incorrect because Azure Activity Log records subscription-level control-plane events such as resource creation, deletion, or configuration changes. An Activity Log alert is appropriate when notification should be driven by a specific administrative or service-health event. The requirement is to analyze and correlate records already stored in Azure Monitor Logs. This would not produce the requested result.

 

Question 6

A cloud engineer at City Power & Light is working with a design that must perform ad hoc filtering and aggregation over semi-structured monitoring records rather than only display a platform metric. What is required? Choose ONE.

1. Use Azure Monitor metrics for the numeric time-series signal
2. Run a Kusto Query Language query in Log Analytics
3. Create an Azure Monitor metric alert rule
4. Create an Activity Log alert rule for the administrative operation

Correct Answer: B

Correct Answer

 

 

Answer B is correct because Log Analytics queries Azure Monitor Logs by using Kusto Query Language. KQL can filter, summarize, join, and correlate structured log records over time when a question cannot be answered by a single platform metric. The deciding need is to analyze and correlate records already stored in Azure Monitor Logs. This meets the deciding technical requirement.

Incorrect Answers

 

Answer A is incorrect because Azure Monitor metrics store numeric time-series values such as platform CPU percentage, request count, or latency. Metrics are well suited to fast charting and threshold evaluation without first writing a KQL query over log records. Operationally, the team must analyze and correlate records already stored in Azure Monitor Logs. That does not meet the deciding constraint.

Answer C is incorrect because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. The requirement is to analyze and correlate records already stored in Azure Monitor Logs. This solves a different Azure problem.

Answer D is incorrect because Azure Activity Log records subscription-level control-plane events such as resource creation, deletion, or configuration changes. An Activity Log alert is appropriate when notification should be driven by a specific administrative or service-health event. The scenario requires the team to analyze and correlate records already stored in Azure Monitor Logs. That leaves the required outcome unmet.

 

Question 7

During an operational review at Northwind Traders, the team finds that the environment wants a stateful alert whose condition is evaluated against an Azure Monitor metric signal. What should the administrator use? Choose ONE.

1. Create an Azure Monitor log search alert rule
2. Create an Activity Log alert rule for the administrative operation
3. Create an Azure Monitor metric alert rule
4. Create an alert processing rule for the maintenance window

Correct Answer: C

Correct Answer

 

 

Answer C is correct because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. Operationally, the team must trigger an alert directly from an Azure Monitor metric threshold. That satisfies the scenario without extra changes.

Incorrect Answers

 

Answer A is incorrect because A log search alert periodically evaluates a KQL query and fires when the returned data meets the configured condition. It is appropriate when the detection logic depends on log records rather than a native metric signal. For this design, the team must trigger an alert directly from an Azure Monitor metric threshold. This would not produce the requested result.

Answer B is incorrect because Azure Activity Log records subscription-level control-plane events such as resource creation, deletion, or configuration changes. An Activity Log alert is appropriate when notification should be driven by a specific administrative or service-health event. The scenario requires the team to trigger an alert directly from an Azure Monitor metric threshold. That feature addresses another administration need.

Answer D is incorrect because Alert processing rules modify actions for alerts as they fire. They can suppress or add action groups, filter which alerts are affected, and apply the behavior on a schedule without disabling or deleting the underlying alert rules. The requested outcome is to trigger an alert directly from an Azure Monitor metric threshold. This misses the scenario’s key constraint.

 

Question 8

A cloud engineer at Consolidated Messenger is working with a design that has a native latency metric and wants threshold evaluation without first ingesting logs into a workspace. What is required? Choose ONE.

1. Create an Azure Monitor log search alert rule
2. Create an Activity Log alert rule for the administrative operation
3. Create an alert processing rule for the maintenance window
4. Create an Azure Monitor metric alert rule

Correct Answer: D

Correct Answer

 

 

Answer D is correct because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. For this design, the team must trigger an alert directly from an Azure Monitor metric threshold. This produces the required Azure behavior.

Incorrect Answers

 

Answer A is incorrect because A log search alert periodically evaluates a KQL query and fires when the returned data meets the configured condition. It is appropriate when the detection logic depends on log records rather than a native metric signal. Here the administrator must trigger an alert directly from an Azure Monitor metric threshold. That leaves the required outcome unmet.

Answer B is incorrect because Azure Activity Log records subscription-level control-plane events such as resource creation, deletion, or configuration changes. An Activity Log alert is appropriate when notification should be driven by a specific administrative or service-health event. The deciding need is to trigger an alert directly from an Azure Monitor metric threshold. This is adjacent, but not sufficient.

Answer C is incorrect because Alert processing rules modify actions for alerts as they fire. They can suppress or add action groups, filter which alerts are affected, and apply the behavior on a schedule without disabling or deleting the underlying alert rules. The key requirement is to trigger an alert directly from an Azure Monitor metric threshold. That behavior differs from the requirement.

 

Question 9

During an operational review at Fabrikam, the team finds that the environment must evaluate application error records with KQL and notify only when the query result exceeds a threshold. What should the administrator use? Choose ONE.

1. Create an Azure Monitor log search alert rule
2. Create an Azure Monitor metric alert rule
3. Create an Activity Log alert rule for the administrative operation
4. Create an alert processing rule for the maintenance window

Correct Answer: A

Correct Answer

 

 

Answer A is correct because A log search alert periodically evaluates a KQL query and fires when the returned data meets the configured condition. It is appropriate when the detection logic depends on log records rather than a native metric signal. The requirement is to trigger an alert when the result of a KQL log query meets a condition. That is the best fit here.

Incorrect Answers

 

Answer B is incorrect because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. The deciding need is to trigger an alert when the result of a KQL log query meets a condition. This misses the scenario’s key constraint.

Answer C is incorrect because Azure Activity Log records subscription-level control-plane events such as resource creation, deletion, or configuration changes. An Activity Log alert is appropriate when notification should be driven by a specific administrative or service-health event. Operationally, the team must trigger an alert when the result of a KQL log query meets a condition. That does not meet the deciding constraint.

Answer D is incorrect because Alert processing rules modify actions for alerts as they fire. They can suppress or add action groups, filter which alerts are affected, and apply the behavior on a schedule without disabling or deleting the underlying alert rules. The requirement is to trigger an alert when the result of a KQL log query meets a condition. This solves a different Azure problem.

 

Question 10

At Litware, the team wants alert logic that filters and aggregates log-table rows before deciding whether to fire. Which option best meets the requirement? Choose ONE.

1. Create an Azure Monitor metric alert rule
2. Create an Azure Monitor log search alert rule
3. Create an Activity Log alert rule for the administrative operation
4. Create an alert processing rule for the maintenance window

Correct Answer: B

Correct Answer

 

 

Answer B is correct because A log search alert periodically evaluates a KQL query and fires when the returned data meets the configured condition. It is appropriate when the detection logic depends on log records rather than a native metric signal. The scenario requires the team to trigger an alert when the result of a KQL log query meets a condition. This is the required platform behavior.

Incorrect Answers

 

Answer A is incorrect because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. Operationally, the team must trigger an alert when the result of a KQL log query meets a condition. That behavior differs from the requirement.

Answer C is incorrect because Azure Activity Log records subscription-level control-plane events such as resource creation, deletion, or configuration changes. An Activity Log alert is appropriate when notification should be driven by a specific administrative or service-health event. For this design, the team must trigger an alert when the result of a KQL log query meets a condition. This would not produce the requested result.

Answer D is incorrect because Alert processing rules modify actions for alerts as they fire. They can suppress or add action groups, filter which alerts are affected, and apply the behavior on a schedule without disabling or deleting the underlying alert rules. The scenario requires the team to trigger an alert when the result of a KQL log query meets a condition. That feature addresses another administration need.

 

Question 11

An Azure administrator for Consolidated Messenger learns that the environment is separating alert detection logic from the notification and remediation destinations invoked after firing. What should be done? Choose ONE.

1. Create an alert processing rule for the maintenance window
2. Create an Azure Monitor metric alert rule
3. Attach an Azure Monitor action group to the alert rule
4. Configure a diagnostic setting that sends the required resource logs to a Log Analytics workspace

Correct Answer: C

Correct Answer

 

 

Answer C is correct because Action groups define reusable notification and automation actions for Azure Monitor alerts, including email, SMS, push, webhooks, Logic Apps, Azure Functions, Automation runbooks, and other supported integrations. The requested outcome is to define reusable notification or automation actions that execute when an Azure Monitor alert fires. That directly meets the stated constraint.

Incorrect Answers

 

Answer A is incorrect because Alert processing rules modify actions for alerts as they fire. They can suppress or add action groups, filter which alerts are affected, and apply the behavior on a schedule without disabling or deleting the underlying alert rules. For this design, the team must define reusable notification or automation actions that execute when an Azure Monitor alert fires. This solves a different Azure problem.

Answer B is incorrect because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. Here the administrator must define reusable notification or automation actions that execute when an Azure Monitor alert fires. That leaves the required outcome unmet.

Answer D is incorrect because Diagnostic settings route supported platform logs and metrics from an Azure resource to destinations such as a Log Analytics workspace. The workspace then stores queryable log records for cross-resource analysis and alerting. The deciding need is to define reusable notification or automation actions that execute when an Azure Monitor alert fires. This is adjacent, but not sufficient.

 

Question 12

At Proseware, the team must have an alert call a Logic App and send SMS without embedding those actions separately in every rule. Which option best meets the requirement? Choose ONE.

1. Create an alert processing rule for the maintenance window
2. Create an Azure Monitor metric alert rule
3. Configure a diagnostic setting that sends the required resource logs to a Log Analytics workspace
4. Attach an Azure Monitor action group to the alert rule

Correct Answer: D

Correct Answer

 

 

Answer D is correct because Action groups define reusable notification and automation actions for Azure Monitor alerts, including email, SMS, push, webhooks, Logic Apps, Azure Functions, Automation runbooks, and other supported integrations. The key requirement is to define reusable notification or automation actions that execute when an Azure Monitor alert fires. This directly implements the requested outcome.

Incorrect Answers

 

Answer A is incorrect because Alert processing rules modify actions for alerts as they fire. They can suppress or add action groups, filter which alerts are affected, and apply the behavior on a schedule without disabling or deleting the underlying alert rules. The requirement is to define reusable notification or automation actions that execute when an Azure Monitor alert fires. That feature addresses another administration need.

Answer B is incorrect because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. The deciding need is to define reusable notification or automation actions that execute when an Azure Monitor alert fires. This misses the scenario’s key constraint.

Answer C is incorrect because Diagnostic settings route supported platform logs and metrics from an Azure resource to destinations such as a Log Analytics workspace. The workspace then stores queryable log records for cross-resource analysis and alerting. Operationally, the team must define reusable notification or automation actions that execute when an Azure Monitor alert fires. That does not meet the deciding constraint.

 

Question 13

An Azure administrator for Lucerne Publishing learns that the environment must mute actions for a subset of alerts on a recurring schedule and automatically resume them afterward. What should be done? Choose ONE.

1. Create an alert processing rule for the maintenance window
2. Attach an Azure Monitor action group to the alert rule
3. Create an Azure Monitor metric alert rule
4. Create an Azure Monitor log search alert rule

Correct Answer: A

Correct Answer

 

 

Answer A is correct because Alert processing rules modify actions for alerts as they fire. They can suppress or add action groups, filter which alerts are affected, and apply the behavior on a schedule without disabling or deleting the underlying alert rules. The requirement is to suppress alert actions during a scheduled maintenance window without deleting or disabling the alert rules. That matches the requested operational result.

Incorrect Answers

 

Answer B is incorrect because Action groups define reusable notification and automation actions for Azure Monitor alerts, including email, SMS, push, webhooks, Logic Apps, Azure Functions, Automation runbooks, and other supported integrations. The scenario requires the team to suppress alert actions during a scheduled maintenance window without deleting or disabling the alert rules. This is adjacent, but not sufficient.

Answer C is incorrect because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. Operationally, the team must suppress alert actions during a scheduled maintenance window without deleting or disabling the alert rules. That behavior differs from the requirement.

Answer D is incorrect because A log search alert periodically evaluates a KQL query and fires when the returned data meets the configured condition. It is appropriate when the detection logic depends on log records rather than a native metric signal. For this design, the team must suppress alert actions during a scheduled maintenance window without deleting or disabling the alert rules. This would not produce the requested result.

 

Question 14

A cloud engineer at Fabrikam is working with a design that wants to apply scheduled action suppression to fired alerts based on scope and filters. What is required? Choose ONE.

1. Attach an Azure Monitor action group to the alert rule
2. Create an alert processing rule for the maintenance window
3. Create an Azure Monitor metric alert rule
4. Create an Azure Monitor log search alert rule

Correct Answer: B

Correct Answer

 

 

Answer B is correct because Alert processing rules modify actions for alerts as they fire. They can suppress or add action groups, filter which alerts are affected, and apply the behavior on a schedule without disabling or deleting the underlying alert rules. The scenario requires the team to suppress alert actions during a scheduled maintenance window without deleting or disabling the alert rules. This meets the deciding technical requirement.

Incorrect Answers

 

Answer A is incorrect because Action groups define reusable notification and automation actions for Azure Monitor alerts, including email, SMS, push, webhooks, Logic Apps, Azure Functions, Automation runbooks, and other supported integrations. The requested outcome is to suppress alert actions during a scheduled maintenance window without deleting or disabling the alert rules. That does not meet the deciding constraint.

Answer C is incorrect because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. For this design, the team must suppress alert actions during a scheduled maintenance window without deleting or disabling the alert rules. This solves a different Azure problem.

Answer D is incorrect because A log search alert periodically evaluates a KQL query and fires when the returned data meets the configured condition. It is appropriate when the detection logic depends on log records rather than a native metric signal. Here the administrator must suppress alert actions during a scheduled maintenance window without deleting or disabling the alert rules. That leaves the required outcome unmet.

 

Question 15

During an operational review at Proseware, the team finds that the environment needs capacity-planning charts based on guest performance data collected for monitored VMs. What should the administrator use? Choose ONE.

1. Use Azure Monitor metrics for the numeric time-series signal
2. Run a Kusto Query Language query in Log Analytics
3. Use VM insights Performance to analyze guest CPU, memory, disk, and network behavior
4. Use Network Watcher Connection Monitor for continuous end-to-end connectivity monitoring

Correct Answer: C

Correct Answer

 

 

Answer C is correct because VM insights provides prebuilt performance views for monitored virtual machines and uses Azure Monitor data to expose guest operating-system indicators such as processor, memory, disk, and network utilization for troubleshooting and capacity analysis. The requested outcome is to use the prebuilt Azure Monitor experience for guest VM performance troubleshooting and capacity analysis. That satisfies the scenario without extra changes.

Incorrect Answers

 

Answer A is incorrect because Azure Monitor metrics store numeric time-series values such as platform CPU percentage, request count, or latency. Metrics are well suited to fast charting and threshold evaluation without first writing a KQL query over log records. The key requirement is to use the prebuilt Azure Monitor experience for guest VM performance troubleshooting and capacity analysis. This would not produce the requested result.

Answer B is incorrect because Log Analytics queries Azure Monitor Logs by using Kusto Query Language. KQL can filter, summarize, join, and correlate structured log records over time when a question cannot be answered by a single platform metric. The requirement is to use the prebuilt Azure Monitor experience for guest VM performance troubleshooting and capacity analysis. That feature addresses another administration need.

Answer D is incorrect because Connection Monitor continuously tests connectivity between configured sources and destinations and can surface reachability, latency, and path-related information over time. It is intended for ongoing network connectivity monitoring rather than one-time log analysis. The deciding need is to use the prebuilt Azure Monitor experience for guest VM performance troubleshooting and capacity analysis. This misses the scenario’s key constraint.

 

Question 16

A cloud engineer at Contoso is working with a design that is troubleshooting guest operating-system resource pressure and wants the VM-focused Azure Monitor performance experience. What is required? Choose ONE.

1. Use Azure Monitor metrics for the numeric time-series signal
2. Run a Kusto Query Language query in Log Analytics
3. Use Network Watcher Connection Monitor for continuous end-to-end connectivity monitoring
4. Use VM insights Performance to analyze guest CPU, memory, disk, and network behavior

Correct Answer: D

Correct Answer

 

 

Answer D is correct because VM insights provides prebuilt performance views for monitored virtual machines and uses Azure Monitor data to expose guest operating-system indicators such as processor, memory, disk, and network utilization for troubleshooting and capacity analysis. Operationally, the team must use the prebuilt Azure Monitor experience for guest VM performance troubleshooting and capacity analysis. This produces the required Azure behavior.

Incorrect Answers

 

Answer A is incorrect because Azure Monitor metrics store numeric time-series values such as platform CPU percentage, request count, or latency. Metrics are well suited to fast charting and threshold evaluation without first writing a KQL query over log records. The requirement is to use the prebuilt Azure Monitor experience for guest VM performance troubleshooting and capacity analysis. That leaves the required outcome unmet.

Answer B is incorrect because Log Analytics queries Azure Monitor Logs by using Kusto Query Language. KQL can filter, summarize, join, and correlate structured log records over time when a question cannot be answered by a single platform metric. The scenario requires the team to use the prebuilt Azure Monitor experience for guest VM performance troubleshooting and capacity analysis. This is adjacent, but not sufficient.

Answer C is incorrect because Connection Monitor continuously tests connectivity between configured sources and destinations and can surface reachability, latency, and path-related information over time. It is intended for ongoing network connectivity monitoring rather than one-time log analysis. Operationally, the team must use the prebuilt Azure Monitor experience for guest VM performance troubleshooting and capacity analysis. That behavior differs from the requirement.

 

Question 17

During an operational review at Woodgrove Bank, the team finds that the environment must monitor connectivity between branch-connected workloads and an Azure endpoint over time rather than run a single manual test. What should the administrator use? Choose ONE.

1. Use Network Watcher Connection Monitor for continuous end-to-end connectivity monitoring
2. Run a Kusto Query Language query in Log Analytics
3. Configure a diagnostic setting that sends the required resource logs to a Log Analytics workspace
4. Use VM insights Performance to analyze guest CPU, memory, disk, and network behavior

Correct Answer: A

Correct Answer

 

 

Answer A is correct because Connection Monitor continuously tests connectivity between configured sources and destinations and can surface reachability, latency, and path-related information over time. It is intended for ongoing network connectivity monitoring rather than one-time log analysis. For this design, the team must continuously monitor end-to-end network reachability and latency between specified sources and destinations. That is the best fit here.

Incorrect Answers

 

Answer B is incorrect because Log Analytics queries Azure Monitor Logs by using Kusto Query Language. KQL can filter, summarize, join, and correlate structured log records over time when a question cannot be answered by a single platform metric. The scenario requires the team to continuously monitor end-to-end network reachability and latency between specified sources and destinations. This misses the scenario’s key constraint.

Answer C is incorrect because Diagnostic settings route supported platform logs and metrics from an Azure resource to destinations such as a Log Analytics workspace. The workspace then stores queryable log records for cross-resource analysis and alerting. The requested outcome is to continuously monitor end-to-end network reachability and latency between specified sources and destinations. That does not meet the deciding constraint.

Answer D is incorrect because VM insights provides prebuilt performance views for monitored virtual machines and uses Azure Monitor data to expose guest operating-system indicators such as processor, memory, disk, and network utilization for troubleshooting and capacity analysis. For this design, the team must continuously monitor end-to-end network reachability and latency between specified sources and destinations. This solves a different Azure problem.

 

Question 18

At Lucerne Publishing, the team wants a Network Watcher capability that repeatedly tests configured endpoints and records the connection quality. Which option best meets the requirement? Choose ONE.

1. Run a Kusto Query Language query in Log Analytics
2. Use Network Watcher Connection Monitor for continuous end-to-end connectivity monitoring
3. Configure a diagnostic setting that sends the required resource logs to a Log Analytics workspace
4. Use VM insights Performance to analyze guest CPU, memory, disk, and network behavior

Correct Answer: B

Correct Answer

 

 

Answer B is correct because Connection Monitor continuously tests connectivity between configured sources and destinations and can surface reachability, latency, and path-related information over time. It is intended for ongoing network connectivity monitoring rather than one-time log analysis. Here the administrator must continuously monitor end-to-end network reachability and latency between specified sources and destinations. This is the required platform behavior.

Incorrect Answers

 

Answer A is incorrect because Log Analytics queries Azure Monitor Logs by using Kusto Query Language. KQL can filter, summarize, join, and correlate structured log records over time when a question cannot be answered by a single platform metric. The requested outcome is to continuously monitor end-to-end network reachability and latency between specified sources and destinations. That behavior differs from the requirement.

Answer C is incorrect because Diagnostic settings route supported platform logs and metrics from an Azure resource to destinations such as a Log Analytics workspace. The workspace then stores queryable log records for cross-resource analysis and alerting. The key requirement is to continuously monitor end-to-end network reachability and latency between specified sources and destinations. This would not produce the requested result.

Answer D is incorrect because VM insights provides prebuilt performance views for monitored virtual machines and uses Azure Monitor data to expose guest operating-system indicators such as processor, memory, disk, and network utilization for troubleshooting and capacity analysis. The requirement is to continuously monitor end-to-end network reachability and latency between specified sources and destinations. That feature addresses another administration need.

 

Question 19

An Azure administrator for Contoso learns that the environment needs a native metric condition coupled to the existing operations action destination. What should be done? Choose TWO.

1. Create an Azure Monitor metric alert rule
2. Create an Azure Monitor log search alert rule
3. Create an alert processing rule for the maintenance window
4. Attach an Azure Monitor action group to the alert rule
5. Configure a diagnostic setting that sends the required resource logs to a Log Analytics workspace

Correct Answers: A, D

Correct Answers

 

 

Answer A is correct because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. The deciding need is to detect a native metric threshold and send the resulting alert to the operations notification workflow. That directly meets the stated constraint.

Answer D is correct because Action groups define reusable notification and automation actions for Azure Monitor alerts, including email, SMS, push, webhooks, Logic Apps, Azure Functions, Automation runbooks, and other supported integrations. Operationally, the team must detect a native metric threshold and send the resulting alert to the operations notification workflow. This produces the required Azure behavior.

Incorrect Answers

 

Answer B is incorrect because A log search alert periodically evaluates a KQL query and fires when the returned data meets the configured condition. It is appropriate when the detection logic depends on log records rather than a native metric signal. The requirement is to detect a native metric threshold and send the resulting alert to the operations notification workflow. That leaves the required outcome unmet.

Answer C is incorrect because Alert processing rules modify actions for alerts as they fire. They can suppress or add action groups, filter which alerts are affected, and apply the behavior on a schedule without disabling or deleting the underlying alert rules. The scenario requires the team to detect a native metric threshold and send the resulting alert to the operations notification workflow. This is adjacent, but not sufficient.

Answer E is incorrect because Diagnostic settings route supported platform logs and metrics from an Azure resource to destinations such as a Log Analytics workspace. The workspace then stores queryable log records for cross-resource analysis and alerting. Operationally, the team must detect a native metric threshold and send the resulting alert to the operations notification workflow. That behavior differs from the requirement.

 

Question 20

At Fourth Coffee, the team has a supported request-rate metric and needs both threshold detection and a reusable notification destination. Which option best meets the requirement? Choose TWO.

1. Create an Azure Monitor log search alert rule
2. Create an Azure Monitor metric alert rule
3. Create an alert processing rule for the maintenance window
4. Configure a diagnostic setting that sends the required resource logs to a Log Analytics workspace
5. Attach an Azure Monitor action group to the alert rule

Correct Answers: B, E

Correct Answers

 

 

Answer B is correct because A metric alert evaluates a metric signal against a configured threshold or dynamic condition at a chosen frequency. It is the direct choice when the monitored condition is already available as an Azure Monitor metric. Operationally, the team must detect a native metric threshold and send the resulting alert to the operations notification workflow. This directly implements the requested outcome.

Answer E is correct because Action groups define reusable notification and automation actions for Azure Monitor alerts, including email, SMS, push, webhooks, Logic Apps, Azure Functions, Automation runbooks, and other supported integrations. For this design, the team must detect a native metric threshold and send the resulting alert to the operations notification workflow. That is the best fit here.

Incorrect Answers

 

Answer A is incorrect because A log search alert periodically evaluates a KQL query and fires when the returned data meets the configured condition. It is appropriate when the detection logic depends on log records rather than a native metric signal. The scenario requires the team to detect a native metric threshold and send the resulting alert to the operations notification workflow. This misses the scenario’s key constraint.

Answer C is incorrect because Alert processing rules modify actions for alerts as they fire. They can suppress or add action groups, filter which alerts are affected, and apply the behavior on a schedule without disabling or deleting the underlying alert rules. The requested outcome is to detect a native metric threshold and send the resulting alert to the operations notification workflow. That does not meet the deciding constraint.

Answer D is incorrect because Diagnostic settings route supported platform logs and metrics from an Azure resource to destinations such as a Log Analytics workspace. The workspace then stores queryable log records for cross-resource analysis and alerting. For this design, the team must detect a native metric threshold and send the resulting alert to the operations notification workflow. This solves a different Azure problem.

 

• < Microsoft Azure Administrator AZ-104 Azure Monitor Practice Test 1
• Microsoft Azure Administrator AZ-104 Azure Backup and Site Recovery Practice Test 1 >