Skip to content

5 Free AZ-104 Monitoring and backup Practice Questions

Practise AZ-104 monitoring and backup with scenario questions from the Pass104 question bank, where every option looks plausible until you weigh the constraints, with an explanation for each choice. Every answer includes a worked explanation and Microsoft Learn sources. No account required.

Start with question 1
Work through the set

Four choices per question. Think through your answer, then open the explanation to check it.

5 questions · monitoring and backup · no timer

What these questions cover

These samples cover selected monitoring and backup skills in the Microsoft AZ-104 study guide. They are not a complete domain assessment.

Read each scenario, choose an answer, then open the explanation. All questions and answers are free on this page. In the app, the free plan gives you one 6-question exam a day across all domains; domain-targeted practice is a Pro feature.

Question 1 of 5Restoring encrypted VMs

VM7 is a Windows Server VM with managed disks, encrypted with Azure Disk Encryption (ADE) using a standalone key in key vault KV1. It is backed up by a Recovery Services vault in the same subscription and has vault-tier recovery points. Two days ago a user deleted several folders from a data disk on VM7. You must return those folders to VM7, and VM7 must keep serving its other workloads throughout. What should you do?

  1. Run the File Recovery script for the two-day-old recovery point on VM7, mount the volumes, and copy the folders back
  2. Use the Replace existing restore option to replace VM7’s data disk from the two-day-old recovery point
  3. Use the Restore disks option, deploy a separate VM from the generated template, and copy the folders from it to VM7
  4. Use the Create virtual machine restore option to create a temporary VM from the recovery point, and copy the folders from it to VM7
Show answer and explanation

Correct answer: C · Use the Restore disks option, deploy a separate VM from the generated template, and copy the folders from it to VM7

For ADE-encrypted VMs, Azure Backup supports only restoring the disks and then creating a VM from them, for example with the template the restore job generates. The restored disks keep their encryption from the recovery point. Running the restored copy as a separate VM lets you copy the folders back while VM7 stays online and untouched.

Why the other choices do not fit

  • A. File and folder recovery is not supported for ADE-encrypted VMs. You have to recover the entire VM or its disks to get individual files back.
  • B. Replace existing is supported only for unencrypted managed VMs, so it is blocked here. Even on an unencrypted VM it would overwrite the live disk and roll back every other change made in two days.
  • D. Creating a VM directly from a restore point is not supported for ADE-encrypted VMs. The documented path is Restore disks followed by a template or PowerShell deployment.
Microsoft LearnRestore encrypted Azure VMs Azure VM backup support matrix: file-level restore
Question 2 of 5Vault redundancy and cross-zonal restore

You plan to protect VM2, an unencrypted VM with managed disks pinned to availability zone 1 in Central US, with a new Recovery Services vault named Vault2. A zone-outage runbook requires that you can restore VM2 from vault-tier recovery points as a new VM in availability zone 3 of Central US. Backup storage cost must be minimized. Which storage redundancy should you configure for Vault2 before protecting any items?

  1. Locally redundant storage (LRS)
  2. Geo-redundant storage (GRS) without Cross Region Restore
  3. Geo-redundant storage (GRS) with Cross Region Restore enabled
  4. Zone-redundant storage (ZRS)
Show answer and explanation

Correct answer: D · Zone-redundant storage (ZRS)

Cross Zonal Restore to another zone in the same region is available only when the vault uses ZRS, because only then are the vault-tier copies spread across zones. It works for restores that create a new VM or restore disks, from vault-tier recovery points, for VMs that are not encrypted. ZRS also costs less than either GRS option.

Why the other choices do not fit

  • A. LRS keeps every copy in a single datacenter, and the Availability Zone choice does not appear for a same-region restore. It is cheapest, but it cannot meet the runbook.
  • B. With GRS, a same-region restore still cannot target another zone. Learn states that the zone option does not work in the primary region when the vault is GRS.
  • C. With Cross Region Restore, you can choose a zone only when you restore in the paired secondary region, if that region supports zones. It does not add same-region zone choice, and it is the most expensive option.
Microsoft LearnRestore options: Cross Zonal Restore Set storage redundancy for a Recovery Services vault
Question 3 of 5Backup policy retention

VM7 is protected in Recovery Services vault RSV7 by a policy that creates one daily recovery point and keeps it for 30 days. Before an in-place application upgrade, an auditor requires one recovery point taken immediately before the upgrade to be kept for seven years. The retention of the scheduled recovery points must not change, and administrative effort must be minimized. What should you do?

  1. Run Backup Now on VM7 and set Retain Backup Till to a date seven years away
  2. Add a yearly retention rule of seven years to VM7’s current policy, then run Backup Now
  3. Create a second policy in RSV7 with seven-year yearly retention and assign it to VM7 alongside the current policy
  4. Run Backup Now on VM7, then move the new recovery point to the vault-archive tier
Show answer and explanation

Correct answer: A · Run Backup Now on VM7 and set Retain Backup Till to a date seven years away

An on-demand backup is retained for the period you specify when you trigger it, independent of the rules in the assigned policy. One Backup Now job with a seven-year Retain Backup Till date creates the audit point and leaves the scheduled 30-day recovery points unchanged.

Why the other choices do not fit

  • B. Changing the policy changes retention for the scheduled recovery points, which the requirement forbids. The on-demand point still takes the date you enter in Backup Now, so the policy change is unnecessary.
  • C. A backup item is protected by one policy at a time. Assigning another policy replaces the current one and changes the scheduled retention, rather than adding to it.
  • D. The tier does not set how long a point is kept. VM recovery points are also eligible for archive only if they are monthly or yearly points at least three months old, so a new on-demand point cannot be moved now.
Microsoft LearnRun an on-demand backup Archive tier eligibility
Question 4 of 5Data collection rules and Azure Monitor Agent

Subscription Sub2 contains 40 Azure VMs that run Windows Server with Azure Monitor Agent installed. All 40 must send the same processor and memory performance counters to Log Analytics workspace LAW2. Fifteen of them host a payment application and must also send the Windows Security event log to LAW2. No other VM may collect the Security log. You need to configure collection with the fewest data collection rules (DCRs). What should you do?

  1. Create one DCR containing the performance counters and the Security event log, and associate it with all 40 VMs
  2. Create one DCR for the performance counters associated with all 40 VMs, and a second DCR for the Security event log associated with the 15 payment VMs
  3. Create one DCR for the performance counters associated with all 40 VMs, and configure a diagnostic setting on each of the 15 payment VMs that sends the Security event log to LAW2
  4. Create one DCR per VM, adding the Security event log only to the 15 payment VMs’ rules
Show answer and explanation

Correct answer: B · Create one DCR for the performance counters associated with all 40 VMs, and a second DCR for the Security event log associated with the 15 payment VMs

DCR associations are many-to-many: one rule can be associated with many machines, and a machine can be associated with several rules whose collection is combined. Two rules therefore cover both sets. Only the 15 associated machines collect the Security log.

Why the other choices do not fit

  • A. Every data source in a DCR is collected from every associated machine. This would collect the Security log from all 40 VMs, which the scenario forbids.
  • C. A VM diagnostic setting routes host-level platform metrics, not guest event logs. Windows event logs from inside the guest require Azure Monitor Agent and a DCR.
  • D. This meets the collection requirement but creates 40 rules instead of two, failing the fewest-rules constraint and multiplying the configuration you must maintain.
Microsoft LearnCollect guest data with Azure Monitor Agent and DCRs Collect Windows events with Azure Monitor Agent
Question 5 of 5Guest metrics in Metrics Explorer

VM12 runs Windows Server. Last month VM insights was enabled with the logs-based experience, which installed Azure Monitor Agent and sends its default counters to Log Analytics workspace LAW4. Engineers now need to chart the guest counter \Process(payapp)\% Processor Time on the same Metrics Explorer chart as VM12’s host Percentage CPU metric. You must minimize the number of monitoring agents on VM12. What should you do?

  1. Create a DCR that collects the counter from VM12 and sends it to LAW4, then chart it in Metrics Explorer
  2. In Metrics Explorer, switch VM12’s metric namespace to Virtual Machine Guest and select the counter
  3. Add the counter to the VM insights DCR, then chart it on the VM insights Performance tab
  4. Create a DCR that collects the counter from VM12 with Azure Monitor Metrics as its destination, and associate it with VM12
Show answer and explanation

Correct answer: D · Create a DCR that collects the counter from VM12 with Azure Monitor Metrics as its destination, and associate it with VM12

Azure Monitor Agent is already on VM12, so an additional DCR can reuse it. A performance counter DCR with the Azure Monitor Metrics destination makes the counter appear in Metrics Explorer under the Virtual Machine Guest namespace. There, it can be plotted with the host Percentage CPU metric. Learn currently labels this destination as preview.

Why the other choices do not fit

  • A. A Log Analytics destination stores the counter in the Perf table, which you query with KQL. It is not added to the metrics database that Metrics Explorer charts next to host metrics.
  • B. The Virtual Machine Guest namespace contains only counters that a DCR sends to Azure Monitor Metrics. VM insights sends its data to the workspace, so the counter is not there to select.
  • C. The default counter set of the logs-based VM insights experience cannot be modified. The Performance tab is also not the Metrics Explorer chart the engineers require.
Microsoft LearnCollect performance counters with Azure Monitor Agent

Continue your AZ-104 preparation

Review the concepts

Choose your next practice set

Read AZ-104 passing score explained to understand what practice results can tell you and plan your next study session.

Browse all AZ-104 guides and study resources.

Want to focus on monitoring and backup? Pro lets you choose domains for targeted practice. The free daily exam includes questions across all domains.

These original practice questions are adapted from the Pass104 question bank. They are not actual Microsoft exam questions and do not reproduce or predict exam difficulty or results. The selected answers and explanations include linked Microsoft Learn documentation. The public samples were last reviewed on 26 September 2026. Azure services and exam objectives can change, so use the references for the latest details. Pass104 is independent of Microsoft.