Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Monitor and Maintain Azure Resources (AZ-104) Syllabus

Monitor and Maintain Azure Resources (AZ-104) syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Monitor and Maintain Azure Resources (AZ-104) in Microsoft Azure Certifications (e.g. AZ-104, AZ-900), not a summary of it.

1. 1

   Monitoring with Azure Monitor

   4 topics

   • Metrics and diagnostics
     • Metrics Explorer and metric charts
     • Diagnostic settings and resource logs
   • Log Analytics and queries
     • Log Analytics workspaces
     • Kusto Query Language (KQL) basics
   • Alerts and visualisation
     • Metric and log alert rules
     • Action groups and notifications
     • Azure Monitor workbooks and dashboards
   • Network monitoring
     • Network Watcher connection troubleshoot
     • NSG flow logs and IP flow verify
2. 2

   Backup and Recovery

   3 topics

   • Azure Backup
     • Recovery Services vaults and Backup vaults
     • Backup policies for VMs and files
     • Restore operations
   • Azure Site Recovery
     • Replication of Azure VMs
     • Failover and failback planning
   • Vault security and management
     • Soft delete for backups
     • Backup reports and monitoring
3. 3

   Maintaining Resources and Continuity

   3 topics

   • VM updates and configuration
     • Azure Update Manager
     • Maintenance configurations
   • Business continuity planning
     • Recovery Point Objective (RPO) and Recovery Time Objective (RTO)
     • Soft delete and recovery for storage and backups
   • Operational automation
     • Azure Automation runbooks
     • Scheduled tasks and start/stop of VMs

Monitor and Maintain Azure Resources (AZ-104) flashcards for Microsoft Azure Certifications (e.g. AZ-104, AZ-900)

23 of 50 cards from the Monitor and Maintain Azure Resources (AZ-104) deck — real questions with worked answers.

1. In Azure Monitor, what are the two fundamental types of data collected?

   Metrics (numerical values collected at regular intervals, near real-time, time-series) and Logs (structured/text records of events, queried with KQL in Log Analytics).

2. What is the default collection granularity (sample interval) for most Azure platform metrics?

   1 minute. Platform metrics are collected automatically by default at a 1-minute frequency, though some support other granularities.

3. How long are Azure platform metrics retained by default in Azure Monitor Metrics?

   93 days. To retain metric data longer, you must route it to a Log Analytics workspace or storage account via a diagnostic setting.

4. What is a diagnostic setting in Azure Monitor used for?

   It defines where a resource's platform logs and metrics are sent — to a Log Analytics workspace, an Azure Storage account, an Event Hub, or a partner solution.

5. How many destinations can a single diagnostic setting route data to, and how many diagnostic settings can a resource have?

   A single diagnostic setting can send to multiple destination types at once, and each resource can have up to 5 diagnostic settings.

6. What is the Azure Monitor Agent (AMA), and what does it replace?

   The Azure Monitor Agent collects monitoring data from the guest OS of VMs and other compute. It replaces the legacy Log Analytics agent (MMA/OMS) and the Diagnostics extension.

7. What is a Data Collection Rule (DCR) used for with the Azure Monitor Agent?

   A DCR defines what data the Azure Monitor Agent collects (performance counters, event logs, syslog) and where it sends that data, decoupling collection config from the agent.

8. What query language is used to interrogate data in a Log Analytics workspace?

   KQL — Kusto Query Language. It is read-only and used to analyze logs, metrics, and other records stored in the workspace.

9. In KQL, which operator filters rows by a condition, and which selects/limits the number of returned rows?

   where filters rows by a predicate; take (or limit) returns a specified number of arbitrary rows, while top returns the highest/lowest N by a sorted column.

10. In KQL, what does the | (pipe) character do?

    It pipes the output of one operator into the next, chaining operations left to right so each tabular result feeds the following statement.

11. Which KQL operator is used to aggregate data, e.g. counting events grouped by a column?

    summarize. For example: summarize count() by Computer aggregates rows into groups and computes the count per group.

12. In KQL, how do you restrict a query to records from the last hour?

    Use a time filter such as where TimeGenerated > ago(1h). The ago() function returns a time relative to now.

13. What is the difference between the project and extend operators in KQL?

    project selects (and can rename) a specific set of columns, dropping the rest; extend adds a new calculated column while keeping all existing columns.

14. Which KQL operator joins two tables, and what is the default join kind?

    join combines tables on a matching key. The default join kind is innerunique (a deduplicated inner join on the left key).

15. What is the difference between Azure Monitor's render operator and a workbook for visualisation?

    render produces a quick inline chart (timechart, barchart, piechart) from a single KQL query; a workbook is a rich, reusable, interactive report combining multiple queries, parameters, text, and visual tiles.

16. What are the main signal types that an Azure Monitor alert rule can be based on?

    Metric alerts, Log (log search query) alerts, Activity log alerts, and Service Health/Resource Health alerts.

17. What three components make up an Azure Monitor alert rule?

    The target resource/scope and signal, the condition/logic (threshold or query), and the action group plus alert details (severity, name) that fire when the condition is met.

18. What is an action group in Azure Monitor?

    A reusable collection of notification preferences (email, SMS, push, voice) and actions (webhook, Azure Function, Logic App, Automation Runbook, ITSM) triggered when an alert fires.

19. What are the alert severity levels in Azure Monitor and their meanings?

    Sev 0 = Critical, Sev 1 = Error, Sev 2 = Warning, Sev 3 = Informational, Sev 4 = Verbose. Lower number = higher severity.

20. In a static metric alert, what do the 'aggregation type' and 'threshold' define?

    Aggregation type (e.g. Average, Min, Max, Total, Count) defines how raw samples are summarised over the evaluation window, and the threshold is the static value that aggregated result is compared against to fire the alert.

21. What is a dynamic threshold metric alert, and when is it preferred over a static one?

    It uses machine learning to learn a metric's historical pattern and automatically sets thresholds, alerting on anomalies. Preferred when normal values vary over time and a fixed static threshold is hard to choose.

22. What is the purpose of Azure Network Watcher?

    A regional service providing tools to monitor, diagnose, view metrics, and enable/disable logs for Azure IaaS networking resources (VMs, VNets, gateways, load balancers).

23. Which Network Watcher tool diagnoses why traffic is allowed or denied between a VM and a destination?

    IP flow verify. It checks the effective NSG rules to tell you whether a packet is allowed or denied and which rule made the decision.

See more Monitor and Maintain Azure Resources (AZ-104) flashcards →

Planning Monitor and Maintain Azure Resources (AZ-104) for Microsoft Azure Certifications (e.g. AZ-104, AZ-900)

Monitor and Maintain Azure Resources (AZ-104) (Microsoft Azure Certifications (e.g. AZ-104, AZ-900)) FAQ