Q01 - Question
VM insights is enabled on a Linux VM. You now need Syslog events available for KQL queries in Log Analytics. What should you do?
Domain: Monitor and maintain Azure resources (10–15%) Type: Single choice
- A. Enable boot diagnostics on the VM
- B. Plot Syslog data in Metrics Explorer
- C. Enable recommended alert rules on the VM
- D. Create a separate DCR with the Linux Syslog data source
D is correct.
Explanation: The VM insights DCR collects predefined counters. Create a separate DCR for Syslog.
A is incorrect: Boot diagnostics are host logs for boot issues.
B is incorrect: Metrics Explorer shows metrics, not Syslog events.
C is incorrect: Alert rules notify; they don't collect logs.
Q02 - Question
Your Azure Backup vaults span several subscriptions and regions. You need one aggregated view of backup operational activities. Which tool should you use?
Domain: Monitor and maintain Azure resources (10–15%) Type: Single choice
- A. The built-in job monitoring in each vault
- B. Azure Service Health
- C. Backup Explorer
- D. Azure Advisor
C is correct.
Explanation: Backup Explorer is an Azure Monitor workbook that aggregates backup activity across tenants, subscriptions, and vaults.
A is incorrect: Vault job monitoring is scoped to one vault.
B is incorrect: Service Health reports Azure service events.
D is incorrect: Advisor provides recommendations.
Q03 - Question
You configured Azure Site Recovery for on-premises VMs. You must validate recovery without disrupting live services. What should you do?
Domain: Monitor and maintain Azure resources (10–15%) Type: Single choice
- A. Run a test failover for one VM on an isolated Azure network.
- B. Run a test failover on the production network.
- C. Fail over all protected VMs to Azure.
- D. Run a failback for the protected VMs.
A is correct.
Explanation: A recovery drill on an isolated network tests the configuration without disrupting live services.
B is incorrect: The production network can disrupt live services.
C is incorrect: A full failover moves the live environment.
D is incorrect: Failback happens after a failover.
Q04 - Question
You replicate physical servers to Azure by using Site Recovery. After a failover, you plan the failback. Which approach is supported?
Domain: Monitor and maintain Azure resources (10–15%) Type: Single choice
- A. Fail back directly to the physical servers.
- B. Change the failback RPO to 5 minutes.
- C. Fail back without VMware vCenter or a configuration server.
- D. Fail back to on-premises VMs by using vCenter with a configuration server.
D is correct.
Explanation: Failback needs VMware vCenter with a configuration server and targets virtual machines.
A is incorrect: You can't fail back to physical servers.
B is incorrect: The failback RPO is fixed at 15 minutes.
C is incorrect: vCenter with a configuration server must be available.
Q05 - Question
You need to determine if a widespread outage is currently affecting Azure services across multiple regions. Which tool should you check first?
Domain: Monitor and maintain Azure resources (10–15%) Type: Single choice
- A. Azure Status
- B. Resource Health
- C. Azure Advisor
- D. Log Analytics
A is correct.
Explanation: Azure Status gives you a global picture of Azure health across all services and regions.
B is incorrect: Resource Health zooms in on individual resources, such as a specific virtual machine.
C is incorrect: Azure Advisor evaluates your Azure resources and makes recommendations to help you improve reliability, security, performance, and cost efficiency.
D is incorrect: Log Analytics is used to write and run queries against data collected by Azure Monitor.
Q06 - Question
You need to monitor the processes running on an Azure virtual machine and map its dependencies with other services. Which Azure Monitor feature should you use?
Domain: Monitor and maintain Azure resources (10–15%) Type: Single choice
- A. VM insights
- B. Metrics Explorer
- C. Boot diagnostics
- D. Azure Service Health
A is correct.
Explanation: VM insights provides a dependency map that displays interconnected components with other VMs and external sources by discovering running process groups and processes.
B is incorrect: Metrics Explorer is used to plot and analyze host metrics, not map dependencies.
C is incorrect: Boot diagnostics are used to troubleshoot VM startup issues.
D is incorrect: Azure Service Health provides information about the health of Azure services and regions.
Q07 - Question
An Azure VM was deleted. You need a basic VM running quickly from a restore point in the same region. Which restore option should you use?
Domain: Monitor and maintain Azure resources (10–15%) Type: Single choice
- A. Replace existing
- B. Cross region restore with Replace existing
- C. Create a new VM
- D. Recover files by mounting a snapshot with iSCSI
C is correct.
Explanation: Create a new VM builds a basic VM from a restore point in the source VM's region.
A is incorrect: Replace existing requires the VM to exist.
B is incorrect: Cross region restore doesn't support Replace existing.
D is incorrect: File recovery restores files, not a VM.
Q08 - Question
You need to configure an alert to trigger a runbook in Azure Automation when a specific metric threshold is met. Which component should you configure to execute the runbook?
Domain: Monitor and maintain Azure resources (10–15%) Type: Single choice
- A. Alert processing rule
- B. Action group
- C. Alert condition
- D. Data collection rule
B is correct.
Explanation: Action groups allow actions to be triggered, such as an Automation Runbook.
A is incorrect: Alert processing rules modify triggered alerts as they are being fired, such as suppressing notifications.
C is incorrect: The alert condition defines when the alert is triggered, not the action taken.
D is incorrect: A data collection rule defines what data to collect and where to send it.
Q09 - Question
One alert rule covers 20 VMs. Three VMs enter planned maintenance every week. You must stop notifications for only those three VMs. What should you do?
Domain: Monitor and maintain Azure resources (10–15%) Type: Single choice
- A. Disable the shared alert rule during the maintenance window.
- B. Create an alert processing rule that suppresses notifications on a schedule.
- C. Add another action group to the alert rule.
- D. Delete the alert rule and recreate it afterward.
B is correct.
Explanation: A scheduled suppression rule stops notifications for the selected scope only.
A is incorrect: Disabling the rule stops alerts for VMs that aren't in maintenance.
C is incorrect: Another action group adds notifications.
D is incorrect: Deleting the rule removes coverage.
Q10 - Question
A VM encrypted with Azure Disk Encryption has a corrupted file. You need to recover only that file from Azure Backup. Which approach is supported?
Domain: Monitor and maintain Azure resources (10–15%) Type: Single choice
- A. Restore the entire VM, then copy the file manually
- B. Run a file-level restore from the recovery point
- C. Use the Replace existing restore option
- D. Use Cross Zonal Restore to restore only the file
A is correct.
Explanation: Encrypted VMs require a full VM restore. Then you copy the file or folder manually.
B is incorrect: File-level restores aren't supported for encrypted VMs.
C is incorrect: Replace existing isn't available for encrypted VMs.
D is incorrect: Cross Zonal Restore is unsupported for encrypted VMs.