Microsoft AZ-104 Exam Dumps, Practice Test Questions

Choosing additional categories changes data volume, not how long previously ingested rows remain available inside Log Analytics.

Renaming the route does not extend the lifetime of log data held by the workspace.

Ingesting more events cannot extend the retention period for prior log records. The destination table lifecycle must be adjusted.

Severity filtering changes which events may be selected for display or export; it does not extend native retention of historical entries.

Guest VM telemetry and subscription management-plane Activity Log are distinct sources with separate retention configuration.

Packet filtering rules do not change data retention for Azure management event records.

Event Hubs is a streaming destination type, not a second Log Analytics workspace for queries. The requested second workspace needs a separate diagnostic setting.

The destination field does not support two workspace identifiers in one setting. It represents one configured Log Analytics destination.

Replacing the original destination would stop forwarding by that setting to the original workspace; it does not clone logs into both.

Internet accessibility is not the issue: for a regional monitored resource, a regional Event Hubs destination must satisfy the documented same-region condition. A public IP cannot waive that rule.

Resource-group membership does not satisfy the same-region destination requirement for regional service diagnostics. The destination must be hosted in the required region, independent of group name.

RBAC permission to send to Event Hubs doesn't relax Azure Monitor diagnostic-setting destination requirements. For a regional monitored resource, the Event Hubs destination must be in the same region even when the namespaces are in accessible subscriptions.

Project selects columns but preserves one output row for each matching event. It does not calculate grouped totals and can return many duplicate subscription IDs.

Sorting rearranges events by subscription identifier but still leaves individual records unaggregated. No per-subscription event counts are calculated.

Take limits the number of returned records and may omit events. It cannot produce accurate counts across the last 24 hours.

Project selects or renames output fields, not the time window. Historical events would still contribute to aggregate counts.

Sorting changes order without excluding older rows. It cannot enforce a 48-hour compliance-report boundary.

Take is a sample/limit operation with no guaranteed complete coverage of the required interval. It is unsuitable for accurate time-scoped aggregation.

Take returns a subset of rows and is not a reliable count or time bucket calculation.

Sorting preserves one row per event. It does not count errors per hour and therefore cannot produce the requested aggregate.

Project selects columns but does not aggregate rows or assign events to one-hour bins. Individual events remain uncounted as groups.

A by-Computer aggregation can produce per-VM counts, but an arbitrary first row is not guaranteed to belong to app-17. The scenario demands an explicitly named VM, so filter to that Computer value and the time window before counting.

Filtering by resource group may still include several VMs, so its count can exceed the target VM heartbeat count. Use the Computer identifier and a recent TimeGenerated condition for the specific endpoint.

A time filter bounds the reporting interval but leaves heartbeat records from every monitored VM in the results. Without a Computer predicate or an exact post-group selection, the total is not specific to app-17.

This produces the number of event rows, so repeated failures from one VM are counted multiple times instead of as one affected computer.

It produces per-computer event counts rather than the requested single distinct-computer total unless further processed.

A set can contain unique names, but reporting source row count still measures events rather than the cardinality of unique hosts.

An inner join returns computers that DO have heartbeat matches, the opposite of the absent-computer set needed for incident follow-up.

A leftouter result includes healthy systems too; an explicit null filter would still be necessary to isolate missing matches.

This finds reporting machines not listed in inventory, not inventoried computers that stopped producing heartbeat.

The project operator selects only the named columns, so naming TenantId and SourceSystem would display exactly the fields the report must exclude. It would also omit needed event details such as EventID and TimeGenerated.

Summarize aggregates events into groups and changes row cardinality, violating the requirement to preserve one event row per original record. Aggregation is unnecessary for a column-level projection.

Extend adds or overwrites column expressions but keeps those fields present in the result, even if their values are blank. It does not remove their schema fields and may mislead consumers into thinking the original columns were never collected.