Microsoft Azure Administrator (AZ-104) — All Questions

A VM cannot reach a backend server on a specific port, and you need to determine whether an NSG rule is blocking the traffic and identify which rule. Which Network Watcher tool should you use?

• a.Connection monitor over a 30-day period
• b.IP flow verify✓
• c.A metric alert rule on the VM
• d.A Recovery Services vault restore point

IP flow verify checks whether a packet to or from a VM is allowed or denied and names the specific NSG security rule responsible, making it ideal for pinpointing a blocking rule. Connection monitor tracks connectivity and latency over time but does not identify the exact rule instantly. Metric alerts and vault restore points are unrelated to NSG traffic diagnostics.

You want to run custom queries against collected VM performance and log data using Kusto Query Language (KQL). Which resource stores this data for querying?

• a.A Recovery Services vault
• b.A Log Analytics workspace✓
• c.An Azure Policy initiative
• d.A storage account access tier

A Log Analytics workspace is the repository where Azure Monitor stores log and performance data, and you query it using Kusto Query Language (KQL). A Recovery Services vault stores backups and recovery points, not queryable logs. Azure Policy and storage tiers are unrelated to log querying.

You want to be notified automatically when a VM's average CPU usage exceeds 80 percent for five minutes. What should you configure in Azure Monitor?

• a.A resource lock on the VM
• b.A diagnostic setting only
• c.A metric alert rule with an action group✓
• d.A Log Analytics workspace with no rules

A metric alert rule in Azure Monitor evaluates a metric such as CPU percentage against a threshold and triggers when the condition is met, using an action group to send notifications or run actions. A diagnostic setting merely routes data to a destination and does not raise alerts on its own. Resource locks and empty workspaces do not generate notifications.

You need to back up an Azure VM on a daily schedule with retention policies and be able to restore it later. Which Azure service and resource should you use?

• a.Azure Backup with a Recovery Services vault✓
• b.Azure Monitor with a Log Analytics workspace
• c.A blob lifecycle management policy
• d.Network Watcher connection monitor

Azure Backup uses a Recovery Services vault to store backup data and lets you define a backup policy with schedule and retention for VMs, enabling later restore. A Log Analytics workspace stores monitoring logs, not VM backups. Lifecycle policies manage blob tiering, and Network Watcher diagnoses networking, so neither performs VM backup.