Examius

🇬🇧 Microsoft Azure Certifications (e.g. AZ-104, AZ-900) · subject

Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Monitor and Maintain Azure Resources (AZ-104) Syllabus

The Monitor and Maintain Azure Resources (AZ-104) syllabus for Microsoft Azure Certifications (e.g. AZ-104, AZ-900) in full: 3 chapters, 10 topics and 22 sub-topics, every one listed below, plus 50 Monitor and Maintain Azure Resources (AZ-104) flashcards with answers.

3Chapters
10Topics
22Sub-topics
50Flashcards

Monitor and Maintain Azure Resources (AZ-104) syllabus: all 3 chapters

Expand any chapter to see its topics and sub-topics.

  1. Monitoring with Azure Monitor

     4 topics
    • Metrics and diagnostics
      • Metrics Explorer and metric charts
      • Diagnostic settings and resource logs
    • Log Analytics and queries
      • Log Analytics workspaces
      • Kusto Query Language (KQL) basics
    • Alerts and visualisation
      • Metric and log alert rules
      • Action groups and notifications
      • Azure Monitor workbooks and dashboards
    • Network monitoring
      • Network Watcher connection troubleshoot
      • NSG flow logs and IP flow verify

  2. Backup and Recovery

     3 topics
    • Azure Backup
      • Recovery Services vaults and Backup vaults
      • Backup policies for VMs and files
      • Restore operations
    • Azure Site Recovery
      • Replication of Azure VMs
      • Failover and failback planning
    • Vault security and management
      • Soft delete for backups
      • Backup reports and monitoring

  3. Maintaining Resources and Continuity

     3 topics
    • VM updates and configuration
      • Azure Update Manager
      • Maintenance configurations
    • Business continuity planning
      • Recovery Point Objective (RPO) and Recovery Time Objective (RTO)
      • Soft delete and recovery for storage and backups
    • Operational automation
      • Azure Automation runbooks
      • Scheduled tasks and start/stop of VMs

Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Monitor and Maintain Azure Resources (AZ-104) flashcards — 50 questions with answers

  1. In Azure Monitor, what are the two fundamental types of data collected?

    Metrics (numerical values collected at regular intervals, near real-time, time-series) and Logs (structured/text records of events, queried with KQL in Log Analytics).

  2. What is the default collection granularity (sample interval) for most Azure platform metrics?

    1 minute. Platform metrics are collected automatically by default at a 1-minute frequency, though some support other granularities.

  3. How long are Azure platform metrics retained by default in Azure Monitor Metrics?

    93 days. To retain metric data longer, you must route it to a Log Analytics workspace or storage account via a diagnostic setting.

  4. What is a diagnostic setting in Azure Monitor used for?

    It defines where a resource's platform logs and metrics are sent — to a Log Analytics workspace, an Azure Storage account, an Event Hub, or a partner solution.

  5. How many destinations can a single diagnostic setting route data to, and how many diagnostic settings can a resource have?

    A single diagnostic setting can send to multiple destination types at once, and each resource can have up to 5 diagnostic settings.

  6. What is the Azure Monitor Agent (AMA), and what does it replace?

    The Azure Monitor Agent collects monitoring data from the guest OS of VMs and other compute. It replaces the legacy Log Analytics agent (MMA/OMS) and the Diagnostics extension.

  7. What is a Data Collection Rule (DCR) used for with the Azure Monitor Agent?

    A DCR defines what data the Azure Monitor Agent collects (performance counters, event logs, syslog) and where it sends that data, decoupling collection config from the agent.

  8. What query language is used to interrogate data in a Log Analytics workspace?

    KQL — Kusto Query Language. It is read-only and used to analyze logs, metrics, and other records stored in the workspace.

  9. In KQL, which operator filters rows by a condition, and which selects/limits the number of returned rows?

    where filters rows by a predicate; take (or limit) returns a specified number of arbitrary rows, while top returns the highest/lowest N by a sorted column.

  10. In KQL, what does the | (pipe) character do?

    It pipes the output of one operator into the next, chaining operations left to right so each tabular result feeds the following statement.

  11. Which KQL operator is used to aggregate data, e.g. counting events grouped by a column?

    summarize. For example: summarize count() by Computer aggregates rows into groups and computes the count per group.

  12. In KQL, how do you restrict a query to records from the last hour?

    Use a time filter such as where TimeGenerated > ago(1h). The ago() function returns a time relative to now.

  13. What is the difference between the project and extend operators in KQL?

    project selects (and can rename) a specific set of columns, dropping the rest; extend adds a new calculated column while keeping all existing columns.

  14. Which KQL operator joins two tables, and what is the default join kind?

    join combines tables on a matching key. The default join kind is innerunique (a deduplicated inner join on the left key).

  15. What is the difference between Azure Monitor's render operator and a workbook for visualisation?

    render produces a quick inline chart (timechart, barchart, piechart) from a single KQL query; a workbook is a rich, reusable, interactive report combining multiple queries, parameters, text, and visual tiles.

  16. What are the main signal types that an Azure Monitor alert rule can be based on?

    Metric alerts, Log (log search query) alerts, Activity log alerts, and Service Health/Resource Health alerts.

  17. What three components make up an Azure Monitor alert rule?

    The target resource/scope and signal, the condition/logic (threshold or query), and the action group plus alert details (severity, name) that fire when the condition is met.

  18. What is an action group in Azure Monitor?

    A reusable collection of notification preferences (email, SMS, push, voice) and actions (webhook, Azure Function, Logic App, Automation Runbook, ITSM) triggered when an alert fires.

  19. What are the alert severity levels in Azure Monitor and their meanings?

    Sev 0 = Critical, Sev 1 = Error, Sev 2 = Warning, Sev 3 = Informational, Sev 4 = Verbose. Lower number = higher severity.

  20. In a static metric alert, what do the 'aggregation type' and 'threshold' define?

    Aggregation type (e.g. Average, Min, Max, Total, Count) defines how raw samples are summarised over the evaluation window, and the threshold is the static value that aggregated result is compared against to fire the alert.

Show the other 30 Monitor and Maintain Azure Resources (AZ-104) flashcards

  1. What is a dynamic threshold metric alert, and when is it preferred over a static one?

    It uses machine learning to learn a metric's historical pattern and automatically sets thresholds, alerting on anomalies. Preferred when normal values vary over time and a fixed static threshold is hard to choose.

  2. What is the purpose of Azure Network Watcher?

    A regional service providing tools to monitor, diagnose, view metrics, and enable/disable logs for Azure IaaS networking resources (VMs, VNets, gateways, load balancers).

  3. Which Network Watcher tool diagnoses why traffic is allowed or denied between a VM and a destination?

    IP flow verify. It checks the effective NSG rules to tell you whether a packet is allowed or denied and which rule made the decision.

  4. Which Network Watcher feature shows the full routing and security hops between a source and destination VM?

    Connection troubleshoot / Next hop (next hop returns the route type and next hop IP; connection troubleshoot tests connectivity end to end and identifies the blocking hop).

  5. What does NSG flow logging in Network Watcher capture, and where is it stored?

    It logs IP traffic flowing through a Network Security Group (allowed/denied 5-tuple flows) and stores the data in an Azure Storage account, often analysed with Traffic Analytics.

  6. What is Connection Monitor in Network Watcher used for?

    Continuous, end-to-end connectivity and latency/loss monitoring between sources (Azure or on-prem) and endpoints over time, with alerting on degradation.

  7. What is the core purpose of Azure Backup?

    A cloud-based, agentless-or-agent service that backs up (and restores) Azure VMs, files/folders, SQL/SAP HANA in VMs, Azure Files, and on-prem data to a Recovery Services or Backup vault, without managing backup infrastructure.

  8. What two vault types does Azure Backup use, and what does each support?

    Recovery Services vault (Azure VMs, on-prem via MARS/MABS/DPM, Azure Files, SQL/SAP in VM) and the newer Backup vault (Azure Disks, Blobs, PostgreSQL, AKS, and other managed-data workloads).

  9. What is a backup policy in Azure Backup composed of?

    A schedule (when backups run — daily/weekly/hourly) plus a retention range (how long daily, weekly, monthly, and yearly recovery points are kept).

  10. What does the Azure Backup MARS agent back up?

    The Microsoft Azure Recovery Services (MARS) agent backs up files, folders, and system state from on-premises or Azure Windows machines directly to a Recovery Services vault.

  11. What is the difference between MABS/DPM and the MARS agent in Azure Backup?

    MARS backs up file/folder/system-state directly to the vault; MABS (Azure Backup Server) and System Center DPM back up app-aware workloads (SQL, Exchange, SharePoint, VMs) to a local disk first, then offload to the vault.

  12. What are the storage redundancy options for a Recovery Services vault?

    LRS (Locally Redundant), GRS (Geo-Redundant), and ZRS (Zone-Redundant). GRS is the default and supports cross-region restore; redundancy can only be changed before backups are configured.

  13. What is Cross Region Restore (CRR) in Azure Backup, and what does it require?

    It lets you restore Azure VM/SQL backups in the paired secondary region on demand. It requires the vault to use GRS redundancy with the Cross Region Restore property enabled.

  14. What is the purpose of Azure Site Recovery (ASR)?

    A disaster recovery service that replicates workloads (Azure VMs, on-prem VMware/Hyper-V/physical servers) to a secondary location and orchestrates failover and failback to keep apps running during an outage.

  15. What is the key conceptual difference between Azure Backup and Azure Site Recovery?

    Backup protects data against loss/corruption with point-in-time recovery (higher RPO, used for retention/restore); Site Recovery provides business continuity via near-real-time replication and orchestrated failover (low RPO/RTO) for whole workloads.

  16. Define RPO and RTO in the context of business continuity.

    RPO (Recovery Point Objective) is the maximum acceptable amount of data loss measured in time (how old the recovered data can be). RTO (Recovery Time Objective) is the maximum acceptable time to restore service after an outage.

  17. In Azure Site Recovery, what is a recovery plan?

    An orchestrated, ordered grouping of replicated machines into tiers with optional scripts/manual actions, defining the sequence in which they fail over and start, so multi-tier apps recover in the correct order.

  18. What is a failover versus a failback in Azure Site Recovery?

    Failover switches the workload from the primary to the secondary (target) region/site when the primary is down; failback later returns the workload to the original primary location after it recovers, re-protecting it.

  19. What is a test failover in ASR, and why is it important?

    A non-disruptive failover into an isolated network that validates your DR strategy and recovery plan without affecting the production workload or ongoing replication. It is the recommended way to drill DR.

  20. In ASR, what do crash-consistent and app-consistent recovery points mean?

    A crash-consistent point captures on-disk data as if the machine crashed (no in-memory/app state); an app-consistent point additionally quiesces applications (via VSS on Windows) so in-memory data and pending transactions are flushed to disk, giving cleaner recovery.

  21. What is a soft delete feature in a Recovery Services vault, and how long are deleted backups retained?

    Soft delete retains deleted backup data for an additional 14 days at no cost, so accidentally or maliciously deleted backups can be recovered. It is enabled by default.

  22. What is Multi-User Authorization (MUA) for a Recovery Services vault?

    A security control that uses a Resource Guard so that critical/destructive operations (disabling soft delete, stopping backup with delete data) require approval from a second security admin, protecting against rogue actions.

  23. How does Azure Backup help protect against ransomware at the vault level?

    Through soft delete (14-day recovery of deleted data), immutable vaults (locking recovery points against early deletion), Multi-User Authorization, and security PINs for critical operations.

  24. What is an immutable vault in Azure Backup?

    A vault setting that prevents backup data (recovery points) from being deleted or having retention shortened before expiry, protecting backups from tampering; once locked the immutability cannot be reversed.

  25. What Azure service applies and manages OS patches/updates across Azure and Arc-enabled machines at scale?

    Azure Update Manager (the successor to Update Management in Azure Automation). It assesses missing updates, schedules patch deployments, and reports compliance without needing a Log Analytics workspace or Automation account.

  26. In Azure Update Manager, what is the difference between an assessment and a deployment (maintenance) schedule?

    An assessment scans a machine to report which updates are missing/compliance status; a deployment (maintenance configuration/schedule) actually installs selected updates within a defined maintenance window.

  27. What is the Custom Script Extension for Azure VMs used for?

    It downloads and runs scripts (e.g. PowerShell or Bash) on an Azure VM for post-deployment configuration, software installation, or any automated management task on the guest OS.

  28. What is Azure VM Applications versus the Custom Script Extension for installing software?

    VM Applications package and deploy/manage application binaries through the Azure Compute Gallery with versioning and lifecycle control; the Custom Script Extension runs arbitrary one-off scripts. VM Applications are the more managed, repeatable approach.

  29. What is Azure Automation State Configuration (DSC) used for?

    It applies and continuously enforces a desired configuration on machines via PowerShell Desired State Configuration, automatically remediating drift so nodes stay in their declared compliant state.

  30. What is an Azure Automation runbook, and which type is most common for orchestration tasks?

    A runbook is a packaged automation script run by Azure Automation to perform routine operational tasks. PowerShell and PowerShell Workflow runbooks are common; graphical runbooks offer a visual designer. They are often triggered on a schedule or by a webhook/alert action group.

Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Monitor and Maintain Azure Resources (AZ-104) FAQ

What is in the Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Monitor and Maintain Azure Resources (AZ-104) syllabus?

Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Monitor and Maintain Azure Resources (AZ-104) is split into 3 chapters: Monitoring with Azure Monitor, Backup and Recovery and Maintaining Resources and Continuity. Together they contain 10 topics and 22 sub-topics.

How many chapters are in Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Monitor and Maintain Azure Resources (AZ-104)?

3 chapters, containing 10 topics and 22 sub-topics. The largest chapter is Monitoring with Azure Monitor, with 4 topics.

Are there flashcards for Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Monitor and Maintain Azure Resources (AZ-104)?

Yes — a 50-card Monitor and Maintain Azure Resources (AZ-104) deck, printed in full in the flashcards section of this page and available in the Examius app with spaced repetition. The free plan covers one exam of your choice, including its flashcards; Examius Pro, a one-time purchase, unlocks every other exam and deck.