Microsoft AZ-104 Exam Dumps, Practice Test Questions

The stem states that automatic resolution is enabled. Azure Monitor supports stateful alerts that transition from Fired to Resolved when the metric condition has recovered for the required checks. Saying no automatic resolution exists contradicts the enabled feature and would lead the team to misdiagnose normal alert-state hysteresis.

Changing the evaluation frequency controls how often Azure Monitor evaluates the metric; it does not remove the stateful alert requirement for three consecutive evaluations in which the condition is not met. Because CPU rose again after one normal sample, the required recovery sequence was interrupted. Adjusting frequency alone is not an immediate resolution signal.

An action group controls delivery destinations and actions, not the fired versus resolved state of the metric alert condition. A receiver change might alter incident notifications but cannot substitute for the three consecutive healthy condition evaluations required for stateful auto-resolution. Investigate the actual CPU samples and alert evaluation state.

Host metrics cannot supply all guest-level operating-system counters and logs the team wants in Log Analytics. The guest collection path remains missing.

An installed agent needs appropriate data collection rules to define the data streams and destination. Installation alone does not deliver the required guest records.

A destination workspace stores incoming records; it cannot spontaneously gather counters from unconfigured virtual machines without agents and DCR associations.

An agent can use supported outbound connectivity without a public inbound VM address. Public IP assignment is not the event stream selection mechanism.

Platform CPU metrics do not imply that Azure Monitor Agent ingests guest Windows events. Those event streams require a data collection rule associated with the VM and configured for the appropriate Windows channels and Log Analytics destination. The visible metrics therefore do not prove guest-log collection.

VM placement resilience does not configure guest log categories. The missing events need DCR and destination review.

Azure Activity Log records management/control-plane events such as deployment and configuration changes, not a time series of guest memory usage. Its event history can explain when a VM was restarted but does not replace performance counter collection within the operating system. The requested guest trends need a monitoring data source beyond Resource Manager activity.

NSG or VNet flow logs describe network traffic decisions and flow statistics, not how much memory a guest process consumes or guest disks perform. A network flow may correlate with application activity, but it does not expose the requested Windows or Linux guest counters. Treating it as a VM insights performance feed would yield missing or irrelevant values.

Storage resource diagnostic logs concern operations against the storage service, not private RAM counters and guest disk statistics within a virtual machine. Those resource logs can be valuable for storage troubleshooting but are not the VM insights guest telemetry collection path. A destination for storage logs does not instrument the guest OS.

For a server outside Azure, the documented AMA management and resource association path needs the Azure Arc-enabled server foundation first.

A DCR defines collection only for supported associated resources; it cannot bind to a physical server Azure does not manage through Arc.

Monitoring another machine does not make the on-premises server a recognized AMA target or collect its own Windows events.

Workbook queries analyze data after it is already ingested; they cannot repair a failing pre-storage transformation or change the incoming record schema.

Disabling the collection rule stops its data flow rather than reconciling a mismatched transformation result with the configured custom table structure.

Alert cadence governs rule evaluation after data arrives. It has no effect on the type mismatch that prevents transformed records from reaching the table.

A dashboard filter changes what users see after data has already been ingested. It does not prevent storage or cost for excluded events.

DCR transformations are bound to the specific incoming data flow. Filtering a Syslog stream does not remove records from the separate Windows Event Logs stream emitted by Azure Monitor Agent. To reduce the selected Windows event IDs, the filter must target that stream (and agent-side XPath selection can be even more efficient for supported event filtering).

Workspace retention controls how long ingested records remain queryable, not which Windows event IDs reach the ingestion pipeline. Even with short retention, unwanted verbose events can be collected and billed. Filtering selected IDs within an appropriate DCR transformation addresses the stated pre-ingestion data-exposure and cost requirement.

Post-ingestion KQL limits query results but does not prevent unrelated events from being collected and billed. Filter the Windows Event Log data source at the DCR using supported XPath syntax.

Selecting all Application events ingests data beyond the budget. Retention configuration affects stored history, not the event ID selection at collection. Filter the data source for EventID=1035.

A workbook does not configure Azure Monitor Agent collection on the VM. The supported XPath must belong to the appropriate Windows event source in a DCR associated with the machine.

DCR ingestion transformations evaluate records individually; summarize produces aggregate rows across input records and is unsupported. A Workbook cannot change the transformation execution model or make the invalid expression ingest correctly.

A saved workspace query filters data when someone queries previously ingested records. The scenario requires excluding unwanted incoming events before they are stored. Query-time filtering does not reduce ingestion or comply with that data-collection boundary.

Joining with historical workspace tables operates across multiple rows and sources, which the ingestion transformation does not support. A join would repeat the same invalid-query class and cannot be used to filter individual events in this data flow.

A role escalation cannot change the DCR transformation's input-table contract. The KQL expression still references data outside the allowed incoming source stream.

An ingestion-time transformation operates on incoming records and supports a constrained subset of KQL operators. An aggregate over all historical workspace rows is not an appropriate DCR input transform.

Declaring a source alias for an existing Log Analytics table does not make historical workspace records available to an ingestion-time DCR transform. The transformation’s built-in virtual `source` stream represents incoming events, not a queryable stored workspace table.

Availability zones are a compute placement/resiliency choice and do not change the Azure Monitor DCR regional location rule. The important distinction is region of the data collection rule versus region of its workspace destination, not where the VM sits within an availability zone.

For the supported Azure Monitor Agent collection scenario, a DCR must be in the region of its destination workspace. When workspaces are in different regions, use a separate DCR associated with the same VM for the West Europe workspace.

An Azure VM can have multiple DCR associations; Azure Monitor Agent processes the rules associated with the machine. Creating another VM would add cost and complexity without satisfying the intended two-workspace monitoring pattern for the existing workload.