Domain 5: Monitor and Maintain Azure Resources (10-15%)
What this domain actually covers
Azure Monitor. The overall monitoring service. Two pillars: Metrics (time-series numeric data) and Logs (Log Analytics workspace, KQL-queryable).
Metrics. Platform metrics (auto-collected, 93-day retention), custom metrics (from app or agent), routing via Diagnostic Settings to Storage/Event Hub/Log Analytics.
Log Analytics. Workspace design (region + retention), retention (default 30 days; extendable to 730; Archive up to 12 years), KQL queries at a working level (project, where, summarize, extend, join, bin), Data Collection Rules (DCRs) with the Azure Monitor Agent (AMA).
Alerts + action groups. Metric alerts (near real-time), log alerts (KQL on a schedule), activity log alerts (control-plane events), Service Health alerts, Resource Health alerts. Dynamic thresholds. Action groups (email/SMS/webhook/Function/Logic App/Runbook/Event Hub/ITSM).
Application Insights. Basic instrumentation, codeless attach on App Service, connection string vs legacy instrumentation key.
Backup + recovery. Recovery Services Vault (VM, Files, in-VM SQL/SAP HANA, on-prem MABS/DPM), Backup Vault (Blob, Disks, PostgreSQL Flexible Server, AKS), backup policies (frequency + retention), soft delete on vault, immutable vault, cross-region restore.
Site Recovery. Replication (Azure to Azure, on-prem to Azure), recovery plans, test failover, planned/unplanned failover, RPO/RTO characteristics.
Update management. Azure Update Manager (current generation, replaces retired Update Management), maintenance configurations, periodic assessments, deployment schedules.
Support signals. Service Health, Resource Health, Azure Advisor.
Questions
Q1
Where do metric data from Azure resources land by default?- A. Azure Monitor time-series metrics store
- B. Log Analytics workspace by default
- C. Recovery Services Vault
- D. Storage account
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real default destination: platform metrics are stored in Azure Monitor's time-series metrics store.
Why this is not the answer
Real log store, not the automatic metrics destination: export/configuration is needed to send supported metrics into workspace tables.
Why this is not the answer
Real backup resource: a Recovery Services vault holds backup/recovery information, not ordinary resource metric time series.
Why this is not the answer
Real archive destination: diagnostic settings can export supported metrics to storage, but that is not their default collection destination.
The reasoning
Platform metrics stream to Azure Monitor Metrics (time-series database) with 93-day retention. You can ALSO route metrics to Log Analytics (via Diagnostic Settings, they land in the AzureMetrics table), Event Hub, or Storage, but the primary store is Monitor Metrics. Logs (activity + resource logs) do NOT go to the metrics store; they need an explicit target.
Q2
Default retention of a Log Analytics workspace?- A. 30 days
- B. 90 days
- C. 180 days
- D. 730 days
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Documented workspace default: 30 days; individual tables and solutions can have different defaults or overrides.
Why this is not the answer
Real configurable period: 90 days can apply to specific tables/configurations, but is not the general workspace default.
Why this is not the answer
Real possible retention value: 180 days requires the relevant configuration rather than being the workspace default.
Why this is not the answer
Real analytics-retention ceiling in common configurations: 730 days is not the default, and long-term retention is a separate setting.
The reasoning
The workspace default is 30 days; some tables have a 90-day default. Analytics retention can extend to two years, and table total retention can extend to 12 years using long-term retention. Search jobs retrieve long-term Analytics/Basic data.
Q3 (multi-answer)
Valid alert types in Azure Monitor?- A. Metric alerts (near real-time)
- B. Log alerts (KQL, checked every 5-15+ minutes)
- C. Activity log alerts (control-plane events)
- D. Smart detection (App Insights)
- E. Health alerts (Resource Health, Service Health)
Show answer & explain every option
Correct: A, B, C, D, E
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real alert type: metric alerts evaluate numeric time-series conditions.
✓ Correct choice
Real alert type: log alerts evaluate KQL; supported schedules include finer intervals than the old 5–15-minute shorthand suggests.
✓ Correct choice
Real alert type: Activity Log alerts react to supported control-plane events.
✓ Correct choice
Real application feature: smart detection identifies supported anomalous application behaviors.
✓ Correct choice
Real health alerts: Resource Health and Service Health can notify on relevant resource/service events.
The reasoning
(all)
Azure Monitor supports each of these. Metric alerts fire fastest. Log alerts run KQL on a schedule. Activity log alerts trigger on ARM control-plane events (for example, "VM deleted"). Smart detection is anomaly-based in App Insights. Health alerts subscribe to Resource/Service Health signals.
Q4
Which KQL operator projects a subset of columns?- A.
select - B.
project - C.
keep - D.
extract
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
SQL keyword, wrong query language: KQL uses project to select output columns.
✓ Correct choice
Real KQL operator: project chooses and can compute the columns returned by a query.
Why this is not the answer
Invented standalone operator in this context: project-keep exists, but bare keep is not the requested KQL projection operator.
Why this is not the answer
Real KQL function: extract pulls text using a regular expression; it does not select the output column set.
The reasoning
project is the SELECT equivalent in KQL. Related variants: project-away (exclude), project-rename, project-reorder, project-keep (only keep matching). extend adds a computed column without dropping existing columns.
Q5
Trigger an Automation Runbook when a critical VM's CPU stays above 90% for 5 minutes. Steps?- A. Create a metric alert -> action group -> Automation Runbook action
- B. Modify autoscale rules on the VM to trigger the Runbook
- C. Add a Diagnostic Setting to the VM
- D. Not supported
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real alert chain: a metric rule evaluates CPU and an action group invokes the configured runbook.
Why this is not the answer
Real scaling feature, wrong action: autoscale changes supported resource capacity rather than being a generic runbook trigger on a standalone VM.
Why this is not the answer
Real telemetry routing: diagnostic settings send logs/metrics to destinations; they do not themselves implement this threshold-triggered action.
Why this is not the answer
False limitation: Azure Monitor action groups support Automation runbook actions.
The reasoning
Action groups can invoke Automation Runbooks (webhook or automation account), Azure Functions, Logic Apps, Event Hubs, ITSM connectors. Autoscale rules only trigger scale actions, not arbitrary code. Diagnostic Settings route logs/metrics but do not evaluate conditions.
Field anchor: you have used Azure Monitor. Exam wording: "action group" is the shared reusable object; "alert rule" is the condition + severity that references it.
Q6
Recovery Services Vault vs Backup Vault: which is TRUE?- A. RSV covers VMs, Files, in-VM SQL, MABS/DPM. Backup Vault covers Blob, Disks, PostgreSQL Flexible, AKS.
- B. Backup Vault fully replaces RSV
- C. They are aliases
- D. RSV is Windows only; Backup Vault is Linux only
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real workload distinction: the two vault resource types protect different supported workloads; choose based on the current workload support matrix.
Why this is not the answer
False replacement claim: Backup vault and Recovery Services vault coexist for different workloads.
Why this is not the answer
False equivalence: they are distinct Azure resource types with different protection features.
Why this is not the answer
False operating-system split: vault selection is based on supported workload/protection type, not simply Windows versus Linux.
The reasoning
Two vault types exist for different workload sets. RSV came first (VM/File/in-VM workloads/ASR). Backup Vault ships newer PaaS backups. As of 2026 both are supported and required for different workloads. Exam trap: Azure Files backup uses RSV, not Backup Vault (Files predates Backup Vault).
Q7
"GRS-Backed Recovery Services Vault" means what?- A. Backup data replicates across regions for DR
- B. Only runs in geo-redundant regions
- C. Every backup is stored twice
- D. Only valid for VMs
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real redundancy choice: GRS replicates backup data asynchronously to a paired region for regional recovery protection.
Why this is not the answer
Misleading location claim: GRS describes the storage replication configuration, not a category named geo-redundant regions.
Why this is not the answer
Incorrect copy model: geo-redundancy uses multiple replicas; it is not simply one duplicate of each backup.
Why this is not the answer
False workload limitation: Recovery Services vault redundancy is relevant to supported vault workloads beyond Azure VMs alone.
The reasoning
GRS replicates backup data to the paired region for disaster recovery. Configure vault redundancy before protecting workloads. Once backups exist, do not assume GRS-to-LRS is a reversible toggle or that unregistering a workload is sufficient; follow the documented migration/retained-data guidance.
Q8 (multi-answer)
Which are TRUE about Backup soft delete on a Recovery Services Vault?- A. Deleted backup items are retained 14 days by default
- B. Soft delete is on by default; it can be disabled but Microsoft is tightening rules per workload
- C. Extended soft delete (up to 180 days) is available
- D. Immutable vault option locks retention against admin shortening
Show answer & explain every option
Listed key (under review): A, B, C, D
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Listed key · under review
Real recovery window: soft-deleted backup items have a documented default retention period; verify workload/current enhanced settings.
Listed key · under review
Historical behavior, configuration-dependent: always-on soft delete cannot be disabled after activation; do not assume every vault permits disabling.
Listed key · under review
Real extended protection: enhanced soft delete supports configurable retention up to the documented maximum.
Listed key · under review
Real separate protection: vault immutability prevents operations that reduce protected recovery-point retention; it is distinct from soft delete.
Original explanation · under review
(all true as of 2026)
Soft delete: default 14 days, extendable to 180 days. Immutable vault (opt-in) uses locked retention for compliance and prevents even admins from shortening. Microsoft has been progressively adding "always-on soft delete" behavior for certain workloads.
Q9
Azure Site Recovery (ASR) primary use case?- A. Backup of individual files
- B. VM replication to a secondary region for DR, with orchestrated failover
- C. Archive of old data
- D. Cross-region backup of storage accounts
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real backup use case, wrong service focus: individual file backup/recovery is primarily Azure Backup's role.
✓ Correct choice
Real disaster recovery: Site Recovery replicates supported workloads and orchestrates test/planned/unplanned failover.
Why this is not the answer
Real storage lifecycle need, wrong service: archiving old data uses storage tiers/retention rather than ASR workload replication.
Why this is not the answer
Real redundancy concept, wrong workload: storage-account geo-replication is not ASR's general VM-recovery function.
The reasoning
ASR replicates VMs (Azure to Azure, on-prem VMware/Hyper-V/physical to Azure) at the block level to a secondary region. Recovery Plans automate ordered failover with scripts/manual steps. RPO minutes; RTO depends on VM count and size. Distinct from Azure Backup (scheduled point-in-time snapshots).
Q10
Correct commands to create a Log Analytics workspace?- A. CLI:
az monitor workspace create ... - B. CLI:
az monitor log-analytics workspace create -g RG1 -n W1 -l eastus - C. PowerShell:
New-AzOperationalInsightsWorkspace -Name W1 -ResourceGroupName RG1 -Location eastus - D. B and C
Show answer & explain every option
Correct: D
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real CLI command group, wrong resource: az monitor workspace creates an Azure Monitor workspace, not a Log Analytics workspace.
Why this is not the answer
Valid CLI: monitor log-analytics workspace create targets the required Log Analytics resource. This is part of the answer; the combined choice includes the other applicable statements too.
Why this is not the answer
Valid PowerShell: New-AzOperationalInsightsWorkspace creates the required Log Analytics workspace. This is part of the answer; the combined choice includes the other applicable statements too.
✓ Correct choice
Valid combination: both the Log Analytics CLI command and OperationalInsights PowerShell cmdlet create this resource.
The reasoning
CLI namespace is az monitor log-analytics workspace. PowerShell cmdlet is New-AzOperationalInsightsWorkspace (the underlying resource type is Microsoft.OperationalInsights/workspaces, hence the cmdlet name). Do not confuse with az monitor workspace which relates to Managed Prometheus.
Q11
Instrumenting a .NET App Service with Application Insights: what is the simplest codeless path for a supported .NET runtime?- A. Install AI SDK NuGet + set the AI connection string
- B. Enable "Application Insights" on the App Service blade (codeless attach)
- C. Set
APPINSIGHTS_INSTRUMENTATIONKEYapp setting (legacy) - D. Any of the above works depending on scenario
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real code-based instrumentation: the SDK can collect telemetry but requires app/package changes, so it is not codeless.
✓ Correct choice
Real autoinstrumentation: enabling supported App Service integration supplies the requested codeless path.
Why this is not the answer
Real legacy setting, insufficient by itself: an instrumentation key does not inject telemetry collection into arbitrary uninstrumented code.
Why this is not the answer
Overbroad answer: several instrumentation methods exist, but only the supported portal integration specifically meets the codeless requirement.
The reasoning
Enable Application Insights autoinstrumentation for the supported App Service runtime. SDK/OpenTelemetry instrumentation is an alternative when code changes are appropriate. An instrumentation-key setting alone does not create instrumentation; use a connection string. Support for instrumentation-key-only ingestion ended March 31, 2025.
Q12
Dynamic thresholds on metric alerts solve what problem?- A. Static thresholds miss anomalies that vary by time of day / day of week
- B. They lower cost by reducing alert count
- C. They automatically escalate severity
- D. They combine multiple metrics into one signal
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real adaptive detection: dynamic thresholds learn metric patterns so unusual behavior can be detected without one fixed threshold.
Why this is not the answer
Unsupported price promise: fewer notifications do not automatically reduce the metric alert's billing model.
Why this is not the answer
False severity automation: severity remains a rule configuration, not something dynamic thresholds automatically escalate.
Why this is not the answer
Different concept: dynamic thresholds model a metric's behavior; they are not inherently a multi-metric composite signal.
The reasoning
Dynamic thresholds train on 10+ days of history to learn seasonal patterns, then flag deviations. Great for metrics with daily/weekly cycles (request rate, CPU). Not appropriate for metrics with abrupt legitimate step-changes (like right after a deployment or a scale-out).
Q13
How do you extend Azure Monitor logs retention past 730 days?- A. Long-term retention (total retention up to 12 years) on the workspace tables
- B. Diagnostic Setting sends copies to a Storage account for cheap archive
- C. Not supported
- D. A and B
Show answer & explain every option
Correct: D
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real long-term retention: eligible table plans support total retention beyond the interactive analytics period, up to the documented maximum. This is part of the answer; the combined choice includes the other applicable statements too.
Why this is not the answer
Real prospective archive: diagnostic settings can send future records to storage with a suitable retention/lifecycle policy; they do not backfill old logs. This is part of the answer; the combined choice includes the other applicable statements too.
Why this is not the answer
False blanket restriction: long-term table retention and separate storage archives support longer preservation.
✓ Correct choice
Valid combination: extended table retention and prospective storage copies are different supported ways to retain data longer.
The reasoning
Long-term retention keeps table data available through search jobs; availability depends on the table plan. Alternatively, Diagnostic Settings can dual-send to Storage for immutable cheap archival (query the exported files with an appropriate storage/external-data tool; workspace search jobs do not directly query those files). Event Hub export also works but is streaming, not archival.
Q14
Which cmdlet returns effective NSG rules for a VM's NIC?- A.
Get-AzEffectiveNetworkSecurityGroup -NetworkInterfaceName NIC1 -ResourceGroupName RG1 - B.
Get-AzVM -Name VM1 | Get-AzNsg - C.
Get-AzNetworkWatcher -ResourceGroupName RG1 - D.
Test-AzNsg -Name VM1
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Valid PowerShell cmdlet: it requests effective NSG rules for the named NIC, including applicable subnet/NIC associations.
Why this is not the answer
Invalid pipeline/cmdlet: Get-AzNsg is not the documented effective-rule cmdlet; Get-AzVM returns the VM resource.
Why this is not the answer
Real cmdlet: Get-AzNetworkWatcher retrieves Network Watcher resources rather than the NIC's effective NSG rule set.
Why this is not the answer
Invented cmdlet form: Test-AzNsg is not the documented operation for obtaining effective NIC rules.
The reasoning
Get-AzEffectiveNetworkSecurityGroup returns the merged rule set from NIC + subnet NSGs, with priorities and directions. Portal path: NIC blade > Effective security rules. VM must be running.
Field anchor: you use PowerShell Az; expect at least one cmdlet-recognition question.
Q15
To send Azure activity logs to a Log Analytics workspace, you configure:- A. A subscription-level Diagnostic Setting with workspace destination
- B. A resource-level Diagnostic Setting on each resource
- C. Enable the legacy "Activity Log" solution
- D. Nothing, activity logs go there automatically
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real subscription export: the subscription's diagnostic setting routes Activity Log categories to the selected workspace.
Why this is not the answer
Real resource setting, wrong scope: per-resource logs are separate from configuring the subscription Activity Log export.
Why this is not the answer
Real legacy approach: the older Activity Log solution is not the current diagnostic-settings configuration path.
Why this is not the answer
False automatic-export claim: Activity Log collection is automatic, but copying it into your workspace requires configuration.
The reasoning
Activity logs are subscription-scope; a subscription-level Diagnostic Setting routes them to a workspace, Storage, or Event Hub. Resource-level Diagnostic Settings route resource-specific logs (categories vary by resource type). The "Activity Log" solution is a legacy path being replaced by Diagnostic Settings.
Q16
VM backup policy retention rules can specify:- A. Daily retention
- B. Weekly, monthly, yearly retention (via long-term retention)
- C. Instant restore snapshots separate from vault retention
- D. All of the above
Show answer & explain every option
Correct: D
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real retention cadence: daily vault recovery points can be retained according to policy. This is part of the answer; the combined choice includes the other applicable statements too.
Why this is not the answer
Real long-term pattern: weekly, monthly and yearly rules preserve selected recovery points longer. This is part of the answer; the combined choice includes the other applicable statements too.
Why this is not the answer
Real separate layer: instant-restore snapshot retention differs from vault recovery-point retention. This is part of the answer; the combined choice includes the other applicable statements too.
✓ Correct choice
Valid combination: snapshot and daily/long-term vault retention rules address different recovery needs.
The reasoning
VM backup supports daily and long-term weekly/monthly/yearly retention. Enhanced policy permits multiple daily backups at intervals of 4, 6, 8, 12 or 24 hours, not every hour. Instant Restore retention is 1–5 days for Standard and 1–30 days for Enhanced, separately from vault retention.
Q17
Azure Update Manager (formerly Update Management): which is TRUE?- A. Native (no Automation Account or Log Analytics required as of the 2023 modernization)
- B. Supports Azure VMs + Arc-connected servers
- C. Assessment periodic; deployment via maintenance configurations
- D. All of the above
Show answer & explain every option
Correct: D
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real modern architecture: Azure Update Manager does not depend on the retired Automation/Log Analytics Update Management design. This is part of the answer; the combined choice includes the other applicable statements too.
Why this is not the answer
Real supported scope: Azure VMs and eligible Arc-connected machines can be managed. This is part of the answer; the combined choice includes the other applicable statements too.
Why this is not the answer
Real operations: periodic assessment identifies missing updates and maintenance configurations schedule supported deployments. This is part of the answer; the combined choice includes the other applicable statements too.
✓ Correct choice
Valid combination: modern architecture, hybrid machine support and maintenance scheduling all describe Azure Update Manager.
The reasoning
Update Manager replaced the older Automation-based Update Management (retired 2024). Native scheduling via maintenance configurations. Works across Azure and Arc. Assessments and deployments can be dynamic (query-based inclusion, for example all VMs with env=prod tag).
Q18
Which option lets one metric alert rule monitor multiple eligible resources and create per-resource alert instances?- A. Per resource with a shared threshold
- B. Multi-resource: one rule can target many resources of the same type
- C. Only single-resource
- D. Only per subscription
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Ambiguous phrasing: a shared threshold alone does not identify the one-rule/multiple-resource targeting feature.
✓ Correct choice
Real multi-resource rule: a supported metric rule can target eligible resources and generate alert instances for each resource.
Why this is not the answer
False limitation: supported metric alerts can cover multiple resources.
Why this is not the answer
False scope restriction: a subscription can help select eligible resources, but alerting is not limited to one subscription-wide instance.
The reasoning
A single metric alert rule can target multiple resources (for example, all VMs in a resource group) and fire per resource. Reduces alert-rule sprawl. Supported resource types include VMs, VMSS, App Services (partial coverage). Check docs for eligibility per resource type.
Q19 (multi-answer)
Valid action group actions?- A. Email to a list of addresses
- B. SMS to a list of numbers
- C. Automation Runbook
- D. "Restart VM" built-in action
- E. Send to Event Hub
Show answer & explain every option
Listed key (under review): A, B, C, E
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Listed key · under review
Real notification action: action groups can send email to configured recipients.
Listed key · under review
Real notification action: action groups support SMS subject to geographic/rate restrictions.
Listed key · under review
Real automation action: a runbook can perform an authorized response using its configured identity.
Alternative · under review
Invented direct built-in: restart a VM through a runbook/Function/Logic App rather than a universal Restart VM action-group action.
Listed key · under review
Real integration question: check the current action-group action catalog; Event Hub is a diagnostic export destination, not automatically a direct alert action.
Original explanation · under review
(D does not exist as a built-in; wire it via Runbook or Logic App)
Action groups can email, SMS, push notification (Azure app), voice call, webhook, Function, Logic App, Runbook, Event Hub, ITSM connector. There is no "restart VM" built-in.
Q20
What does this KQL return?requests | where success == false | summarize count() by bin(timestamp, 1h)
- A. Hourly count of failed requests
- B. Total failed requests (single number)
- C. Count per user
- D. All requests
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Correct query interpretation: where keeps failed requests, then summarize counts them separately for each one-hour timestamp bin.
Why this is not the answer
Incorrect aggregation: grouping by an hourly bin produces multiple rows rather than one overall count.
Why this is not the answer
Incorrect grouping: the query contains no user field in its summarize grouping.
Why this is not the answer
Incorrect filter reading: where success == false removes successful requests before counting.
The reasoning
bin() rounds timestamps into buckets (1 hour here). summarize count() by <bucket> returns rows of (timestamp bucket, count). Standard time-series aggregation pattern in App Insights and Log Analytics.
Q21
Resource Health vs Service Health: distinction?- A. Resource Health = status of one specific resource; Service Health = ongoing Microsoft-side incidents affecting subscribed services
- B. They are aliases
- C. Service Health is on-prem only
- D. Resource Health only covers VMs
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
True distinction: Resource Health addresses a specific resource; Service Health describes relevant Azure service incidents and maintenance/advisories.
Why this is not the answer
False equivalence: resource-specific health and service-wide incident information answer different operational questions.
Why this is not the answer
False scope claim: Service Health concerns Azure services, not only on-premises systems.
Why this is not the answer
False resource limitation: Resource Health supports multiple Azure resource types, not just VMs.
The reasoning
Resource Health tells you whether a specific resource is degraded (based on platform signals). Service Health tells you about Microsoft-side incidents, planned maintenance, and health advisories that affect your subscription. Both can be piped into alert rules.
Q22 (multi-answer)
Azure Advisor recommendations cover which pillars?- A. Cost
- B. Security
- C. Reliability
- D. Operational Excellence
- E. Performance
Show answer & explain every option
Correct: A, B, C, D, E
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real Advisor category: Cost highlights potential spending optimizations that require workload validation.
✓ Correct choice
Real Advisor category: Security highlights relevant security posture recommendations.
✓ Correct choice
Real Advisor category: Reliability addresses availability and resilience.
✓ Correct choice
Real Advisor category: Operational Excellence addresses operational processes and management.
✓ Correct choice
Real Advisor category: Performance highlights resource/workload efficiency and throughput considerations.
The reasoning
(all)
Advisor's five categories map to the Well-Architected Framework pillars. Recommendations generated from telemetry + configuration. Exam trap: Cost recommendations include right-sizing VMs and buying Reservations; some require action, some are informational; and Cost recommendations are the ones most frequently tested.
Q23
Backup for Azure Files: what type of vault?- A. Recovery Services Vault
- B. Backup Vault
- C. Storage Vault
- D. Files Vault
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real supported vault type: Azure Files backup uses a Recovery Services vault under the supported protection model.
Why this is not the answer
Real other vault type: Backup vault supports other workload families and is not the vault for this Azure Files scenario.
Why this is not the answer
Invented vault type: Storage Vault is not the Azure Backup resource type used here.
Why this is not the answer
Invented vault type: Files Vault is not the Azure Backup resource type used here.
The reasoning
Azure Files backup uses Recovery Services Vault. Newer PaaS workloads (Blob, Disks, PostgreSQL Flexible, AKS) use Backup Vault. Exam trap: Files lives on a Storage Account, but its BACKUP vault is RSV.
Q24
Cross-Region Restore (CRR) for VM backups: which is TRUE?- A. Enabled at the vault level; requires GRS-backed vault; restores from the paired secondary without waiting for a failover
- B. Available on any vault by default
- C. Requires manual copy via AzCopy
- D. Not supported for Azure VMs
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real feature prerequisites: supported GRS vaults with CRR enabled allow secondary-region VM restore without waiting for a regional failover.
Why this is not the answer
False default: CRR is not automatically available for every vault and redundancy configuration.
Why this is not the answer
Real copy tool, wrong mechanism: CRR is a managed vault restore feature rather than a manual AzCopy transfer.
Why this is not the answer
False support claim: Azure VM backups are a supported CRR workload when prerequisites are met.
The reasoning
CRR is a vault-level toggle available on GRS vaults. It lets you restore into the paired secondary region without waiting for a full failover, useful for routine DR testing. LRS vaults do not support CRR.
Q25
A subscription has a budget with actual-cost alerts at 80% and 100%. After budget evaluation of actual cost at 95%, with forecast alerts disabled, which threshold qualifies?- A. 80% alert only
- B. 100% alert only
- C. Both
- D. None until 100%
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Correct threshold comparison: 95% has crossed 80% but not 100%; notification timing/repetition follows budget evaluation rules.
Why this is not the answer
Incorrect threshold comparison: actual spend has not yet reached 100%, and forecast alerts are disabled.
Why this is not the answer
Incorrect combination: only the lower actual-cost threshold is satisfied at 95%.
Why this is not the answer
False all-or-nothing rule: configured actual-cost thresholds can alert before the budget reaches 100%.
The reasoning
Budget alerts fire when actual (or forecast, if configured) crosses a threshold. At 95% only 80% has been crossed. 100% will fire when reached. Budget evaluation occurs periodically, so notification is not instantaneous. Budget periods reset; do not interpret this question as a guaranteed delivery timeline.
Scenario-Style Questions
Real-exam-style stems. Multi-sentence context, judgment or troubleshooting. Each has doc links so you can drill into the source.
S1
"CPU > 90%" metric alert on 200 VMs generates 200 alerts every incident. Reduce noise while keeping signal?- A. Multi-resource metric alert (one rule, per-resource alert instances); alert processing rules to suppress selected notifications; consider a workload-level alert on the shared upstream root cause
- B. Delete the alert
- C. Increase threshold to 100%
- D. Alert on one VM only
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real noise controls: one multi-resource rule still creates per-resource instances; processing rules/root-cause alerts can reduce redundant notifications.
Why this is not the answer
Real removal, loses coverage: deleting the alert discards the useful incident signal rather than organizing it.
Why this is not the answer
Real threshold change, risky: waiting for 100% can miss serious sustained pressure below that value.
Why this is not the answer
Real scope reduction, inadequate coverage: monitoring only one VM can hide failures elsewhere in the workload.
The reasoning
Multi-resource rule = one authored rule, per-resource alerts. Alert processing rules (formerly action rules) can suppress action groups within a schedule/scope; they do not merge or deduplicate alert instances. If shared root cause exists, alert on that upstream metric instead.
S2
Log Analytics workspace bill 4x expected. Diagnostic queries?- A.
Usage | where TimeGenerated > ago(30d) | summarize sum(Quantity) by DataType | order by sum_Quantity desc(find top ingesting tables); investigate new resource type sending verbose logs; check Diagnostic Settings scope; verify App Insights sampling - B. Contact billing
- C. Wait a month
- D. Delete workspace
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real usage investigation: group ingestion by table, then inspect verbose sources and sampling; include billing flags and units when reconciling costs.
Why this is not the answer
Real escalation route: billing support can help, but table-level ingestion evidence is the first actionable diagnosis.
Why this is not the answer
Passive delay: waiting does not identify the new source or stop continued unexpected ingestion.
Why this is not the answer
Real destructive action: deleting the workspace risks monitoring/history loss instead of isolating the costly source.
The reasoning
Usage table shows ingestion by DataType. Sudden 4x growth almost always = new Diagnostic Setting or verbose trace logging change. A daily cap can limit ingestion but is not a precise spending cap and can overshoot. Investigate collection volume, retention and sampling; cap-induced data loss can affect monitoring.
Docs: Manage LA workspace cost | Daily cap
S3
Estimate cost drivers for 50 VMs backed up to a GRS Recovery Services Vault.- A. Per-instance backup fee (tiered by VM data size); backup storage (LRS/GRS separately priced); cross-region restore egress; instant restore snapshots priced as managed disk snapshots per retention day
- B. Only compute
- C. Per-day fee
- D. Only network
Show answer & explain every option
Listed key (under review): A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Listed key · under review
Real main cost drivers: protected-instance fees, backup storage and snapshot storage matter; the old blanket CRR egress/pricing claims need meter-specific validation.
Alternative · under review
Real Azure charge category, incomplete: VM compute alone is not the Azure Backup price model.
Alternative · under review
Incorrect universal billing model: there is no single flat daily fee covering all protected instances and retained storage.
Alternative · under review
Real charge category, incomplete: network charges alone do not represent backup instance and storage costs.
Original explanation · under review
Azure Backup for VMs bills: per-protected-instance (tiered), backup storage (GRS ~2x LRS), instant restore snapshots (managed disk snapshot pricing for retention days). Restore egress free within region.
S4
ASR test failover: VMs come up in DR region but can't reach the internet or peer VNets. Config check?- A. Recovery Plan / VM target network settings (NSG, subnet, PIP); DR VNet peering pre-configured; NSGs allow required flows; Private DNS zone links present in DR VNet
- B. Retry the failover
- C. Wait for replication
- D. Update Manager
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real DR dependencies: validate recovery network mapping, routes, security rules, egress and DNS in the test network.
Why this is not the answer
Real repeat operation, not a configuration repair: retrying with the same network mapping can reproduce the failure.
Why this is not the answer
Real replication process, wrong layer: finishing disk replication does not create missing peering, routes or DNS links.
Why this is not the answer
Real patch service, unrelated: Update Manager does not configure disaster-recovery network connectivity.
The reasoning
ASR replicates disks + metadata but DR network is separately configured. Set target VNet/subnet/NSG/PIP per VM before test failover. Pre-provision DR VNet peering + Private DNS zone links.
Docs: ASR test failover | ASR network mapping
S5
App Insights showing telemetry gaps after 2 AM daily. Diagnostic path?- A. Check adaptive sampling; daily cap; the workspace-specific daily cap and reset time; code-level rate limiting; app may simply be quiet at that hour
- B. AI broken
- C. Model retraining
- D. Firewall
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real telemetry controls: sampling, caps, ingestion and actual request volume can all explain predictable gaps.
Why this is not the answer
Unsupported failure label: first distinguish missing collection, throttling/capping and genuinely absent application traffic.
Why this is not the answer
Wrong meaning of AI: Application Insights is telemetry monitoring here, not a machine-learning model needing retraining.
Why this is not the answer
Real possible network cause, unproven: verify collector connectivity and logs before attributing a daily pattern to a firewall.
The reasoning
Adaptive sampling drops proportional data during heavy load. Daily cap auto-drops ingestion. Check "Data volume management" and Sampling settings. Rule out that the app is genuinely quiet.
S6
Update Manager deployment succeeded, 3 VMs still show pending patches. Reason?- A. Post-deployment assessment hasn't run (periodic, not immediate); or the 3 VMs failed a subset (check per-VM install results); or reboot pending
- B. Update Manager buggy
- C. Wrong Windows version
- D. NSG blocking
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real status explanations: inspect per-machine results, reboot requirements and assessment freshness; a completed deployment does not imply every update installed.
Why this is not the answer
Unsupported product blame: specific machine-level results are needed to distinguish a product fault from pending reboot or failed updates.
Why this is not the answer
Real compatibility concern, unproven: verify the machine/result details before assuming the Windows version caused this outcome.
Why this is not the answer
Real network control, unproven: blocked update endpoints can matter, but the NSG must be evidenced in the machine's failure logs.
The reasoning
Assessment runs on periodic schedule (usually daily). Per-VM install results show which patches succeeded/failed. Trigger on-demand assessment via portal or az vm assess-patches for an Azure VM (use the appropriate Arc command for Arc servers).
Docs: Update Manager overview | Trigger on-demand assessment
S7
In a historical vault configuration that allowed soft delete to be disabled, a backup was permanently purged with no remaining recovery point. Recover?- A. Not recoverable once soft delete is off and delete completes; enable Immutable Vault + always-on soft delete to prevent recurrence
- B. Microsoft support can recover
- C. Restore from Azure Backup
- D. Automatic recovery
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real recovery limitation: without remaining recovery points, the permanently purged backup is unavailable; immutable/always-on safeguards help prevent recurrence.
Why this is not the answer
Unsupported recovery promise: support cannot guarantee restoration of permanently purged backup data.
Why this is not the answer
Circular recovery proposal: Azure Backup cannot restore a recovery point that no longer exists; independent surviving backups would be different.
Why this is not the answer
False automatic behavior: permanent deletion is not followed by an automatic recovery process.
The reasoning
A permanently purged backup without another copy cannot be restored. Use locked immutability, least privilege, and current secure-by-default/always-on soft-delete protections to prevent recurrence. Do not assume disabling soft delete remains available in current vault configurations.
Docs: Backup soft delete | Immutable vault
S8
Custom KQL log alert fires every 5 minutes but data arrives every 15. Design fix?- A. Align evaluation frequency and lookback to data arrival, use stateful alerting where appropriate, and consider a metric alert when the signal is a metric
- B. Delete the alert
- C. Increase threshold
- D. Reduce ingestion
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real alert design: use an adequate lookback and evaluation/state behavior for measured data arrival; metric alerts suit suitable time-sensitive numeric signals.
Why this is not the answer
Real removal, loses signal: deleting the alert stops detection instead of aligning it with ingestion cadence.
Why this is not the answer
Real threshold change, different problem: changing severity criteria does not repair a timing mismatch between evaluation and arriving data.
Why this is not the answer
Real ingestion reduction, not the direct fix: fewer records do not establish the intended arrival/evaluation semantics.
The reasoning
A stateless log alert may notify repeatedly while its query still matches. Choose the lookback, evaluation frequency and stateful/auto-resolution behavior deliberately. Matching the ingestion cadence or binning timestamps alone does not deduplicate alerts.
Docs: Log alert rules | Alert rule frequency
S9
Azure Files backup: 3 TB share, hourly snapshots retained 90 days. Cost + config?- A. RSV; File Share Backup Enhanced policy (hourly) + 90d retention; snapshots stored on source storage account as differentials (billed against storage); vault stores metadata; enable share-level soft delete
- B. Storage account soft delete only
- C. Custom PowerShell
- D. Not supported as stated: hourly snapshots for 90 days exceed the per-share snapshot limit
Show answer & explain every option
Correct: D
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real Azure Files backup features, invalid schedule claim: hourly points retained for 90 days exceed the per-share snapshot capacity.
Why this is not the answer
Real deletion recovery: share soft delete is not a 90-day hourly point-in-time backup schedule.
Why this is not the answer
Real scripting tool, same limit: custom scripts cannot bypass the storage service's per-share snapshot maximum.
✓ Correct choice
True capacity conflict: 24 snapshots per day for 90 days is 2,160, exceeding the per-share snapshot limit.
The reasoning
Azure Files has a limit of 200 snapshots per share. An hourly schedule retained for 90 days would require far more. Choose a supported schedule and retention policy, considering vaulted backup for longer retention; do not promise hourly snapshots retained for 90 days.
S10
Cross-region restore for a 500 GB VM took 6 hours. Normal?- A. Yes; CRR reconstructs vault data from the secondary region and rebuilds disks; 500 GB in ~6 hours is within typical range
- B. Should be minutes
- C. CRR broken
- D. Should be days
Show answer & explain every option
Listed key (under review): A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Listed key · under review
Unsupported universal timing claim: size alone does not establish whether six hours is normal; inspect restore mode, phases, disk layout and job evidence.
Alternative · under review
Unsupported fixed expectation: every 500-GB cross-region restore is not guaranteed to complete in minutes.
Alternative · under review
Unsupported fault diagnosis: elapsed time alone does not establish a broken CRR service.
Alternative · under review
Unsupported fixed expectation: the operation is not universally expected to take days either; use job-specific diagnostics.
Original explanation · under review
CRR is not instant. Vault data reconstructed from the secondary region into the target subscription. Times vary with size, concurrent restore load, region link. For faster failover use ASR.
Docs: Cross-region restore | CRR concepts
S11
Metric alert wired to a Function App action. Alert fires but Function never runs. Debug?- A. Check action group's Function URL + function key; Function App running; HTTP binding accepts POST + anonymous or correct key; Function App logs (App Insights) for incoming request or errors; check for private endpoint blocking action group IP
- B. Recreate alert
- C. Move to Logic App
- D. Firewall on Function
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real delivery diagnosis: validate the action target/key, HTTP trigger, app health, network reachability and request logs.
Why this is not the answer
Real recreation, premature: rebuilding a firing alert does not necessarily repair its broken action target.
Why this is not the answer
Real alternative workflow: Logic Apps can receive actions, but migrating does not diagnose the current Function invocation failure.
Why this is not the answer
Real possible blocker, incomplete diagnosis: firewall/private-network access is one candidate, alongside URL, authorization and trigger configuration.
The reasoning
Action groups POST JSON payload to the Function URL with function key. Common causes: stale key after explicit regeneration or a change/loss of its backing secret store, Function stopped, wrong auth mode, PE blocks the action group's source IP.
Docs: Function App as action group action | Function App keys
S12
LA workspace at 730-day retention limit. Keep 5 more years cheaply. Path?- A. Extend table total retention with long-term retention (up to 12 years) before data expires; configure prospective Storage export separately if needed
- B. Duplicate workspace
- C. Increase retention (not supported past 730)
- D. Delete old data
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real preservation path: configure eligible table long-term retention before expiry; separate exports are prospective and need their own storage policy.
Why this is not the answer
Real resource duplication, not preservation: a new workspace does not automatically copy or retain the old workspace's records.
Why this is not the answer
False blanket ceiling: interactive analytics retention differs from supported long-term total retention.
Why this is not the answer
Real deletion, opposite goal: removing old records prevents the requested additional years of preservation.
The reasoning
Use table long-term retention to preserve already retained workspace data before expiry, then query it with search jobs. Diagnostic settings export new incoming resource data, not historical workspace rows. Storage-exported files need an appropriate external query tool; workspace search jobs do not search those files.
Docs: Log data plans + Archive | Search jobs
S13
Workspace per region for compliance, one central query across all. KQL syntax?- A.
workspace("workspace-eastus").Perf | union workspace("workspace-westeurope").Perf(needs Reader on each); Workbooks with per-region data sources; ARG for cross-sub summaries - B. Not supported
- C. Central workspace only
- D. Copy data
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real cross-workspace query: workspace references and union combine accessible tables; verify access to every target workspace.
Why this is not the answer
False limitation: KQL supports authorized cross-workspace querying.
Why this is not the answer
Real architecture option, unnecessary requirement: all data need not reside in one central workspace to be queried together.
Why this is not the answer
Real ETL approach, unnecessary here: copying data adds cost/residency concerns when cross-workspace querying meets the need.
The reasoning
workspace() function references other workspaces. union combines them. Requires Reader on each workspace's data. Query permissions and limits apply across workspaces; costs depend on data plan and query method, not a universal charge per workspace hit.
S14
VM backup status "Warning: consistency = file-system" instead of application. Cause?- A. VSS writer failed on Windows; pre/post scripts missing or failing on Linux; check Event Viewer > Application log for VSS errors; check Linux VM snapshot-extension logs under
/var/log/azure/Microsoft.Azure.RecoveryServices.VMSnapshotLinux/ - B. Broken
- C. Wrong OS type
- D. RSV region
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real consistency dependencies: application-consistent backup requires successful workload quiescing; inspect Windows VSS or supported Linux scripts/extension logs.
Why this is not the answer
Unsupported generic failure: filesystem-consistent recovery can still exist even if application quiescing failed.
Why this is not the answer
Real support factor, incomplete diagnosis: OS support matters, but specific writer/script failures explain the reported consistency downgrade.
Why this is not the answer
Real placement factor, wrong mechanism: the vault region does not itself cause a guest application's VSS writer to fail.
The reasoning
App-consistent (Windows: VSS) requires the app's VSS writer to complete a snapshot. Failures fall back to crash-consistent or file-system-consistent. Check vssadmin list writers on Windows. Linux app-consistent uses pre/post scripts in /etc/azure/.
S15
Alerts must escalate to on-call after 30 minutes with no acknowledgment. Setup?- A. Send the alert through a supported action-group webhook/ITSM integration to an incident-management system configured for acknowledgment and 30-minute escalation
- B. Retry the alert
- C. Multiple alert rules for same condition
- D. Not supported
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real escalation architecture: an incident-management system supplies acknowledgment tracking and timed escalation behind a supported action-group integration.
Why this is not the answer
Real retry, wrong semantics: retrying delivery does not implement acknowledgment-aware 30-minute escalation.
Why this is not the answer
Real duplicate rules, poor coordination: repeated conditions can create more incidents without knowing whether the original was acknowledged.
Why this is not the answer
False end-to-end limitation: supported external incident-management workflows can implement the requested escalation.
The reasoning
Azure Monitor has alert user-response states, but alert processing rules apply or suppress action groups by scope, filters and schedule; they do not wait 30 minutes for acknowledgment. Implement the escalation state/timer in a supported incident-management integration or workflow.
S16
Change Analysis blade empty for a resource where you know changes occurred. Cause?- A. Check read permissions, supported control-plane resource changes, the 14-day query window, and the current Resource Graph Change Analysis experience
- B. Resource too new
- C. Wrong region
- D. Feature deprecated
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real visibility checks: permissions, supported change types, query age and the current Resource Graph experience determine what appears.
Why this is not the answer
Possible timing factor, incomplete: newness alone does not explain all missing change history.
Why this is not the answer
Real regional context, unproven cause: inspect resource/change support and time range before assuming region mismatch.
Why this is not the answer
Overbroad retirement claim: older experiences can change, but current Resource Graph Change Analysis remains the relevant investigation path.
The reasoning
Resource Graph Change Analysis automatically records supported control-plane changes. Check access, query scope and the 14-day retention window. Registering the legacy Microsoft.ChangeAnalysis provider is not a prerequisite for the current experience.
S17
Log Analytics ingestion delayed 20 minutes; alerts fire late. Mitigation?- A. Log alerts have inherent delay; use metric alerts for latency-sensitive scenarios (near real-time); stream to Event Hub for real-time paths; size the query lookback for measured ingestion delay
- B. Retry ingestion
- C. Reduce log volume
- D. Change region
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real latency-aware design: use supported metric/streaming paths for urgent signals and widen log lookback to accommodate measured ingestion delay.
Why this is not the answer
Incorrect client remedy: blindly resending logs may duplicate data without resolving the ingestion bottleneck.
Why this is not the answer
Real volume control, conditional benefit: reducing noise may help cost/limits but is not a guaranteed cure for all ingestion delays.
Why this is not the answer
Real architectural change, premature: moving regions has cost/residency implications and requires evidence that the region is the cause.
The reasoning
Measure end-to-end ingestion latency for the actual data source and processing path, then allow for alert evaluation time. Metric alerts can suit latency-sensitive signals, but do not promise universal sub-minute delivery. Investigate a 20-minute delay instead of assuming it is normal.
S18
Cost Management shows $10K unbudgeted spend last week. Which telemetry to trace?- A. Cost analysis broken down by resource -> pinpoint driver; Activity Log for that resource around spend start (who created it, when); Change Analysis for config changes
- B. Only aggregate views
- C. Contact Microsoft
- D. Assume it's a bug
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real evidence chain: attribute billed cost to resources, then correlate provisioning and configuration history around the spending change.
Why this is not the answer
Real summary view, insufficient detail: aggregates hide which resource and operation drove the increase.
Why this is not the answer
Real escalation option: support may help after collecting evidence, but does not replace available resource-level cost analysis.
Why this is not the answer
Unsupported assumption: investigate the usage and billing records before treating an unexpected charge as an error.
The reasoning
Cost Analysis pivots by service/resource/RG/tag. Activity Log surfaces Create/Update events with caller identity. Standard "who ran up the bill" workflow. Set Cost Anomaly alerts to catch earlier next time.
S19
Diagnostic Setting sends to workspace X AND storage Y. You delete workspace X. What happens to storage Y export?- A. Storage Y export continues (destinations are independent); the DS shows an error for the missing workspace until edited
- B. Both stop
- C. Storage export auto-migrates
- D. Data loss on Y
Show answer & explain every option
Listed key (under review): A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Listed key · under review
Real multiple destinations, unverified failure guarantee: documentation does not establish the exact continued-delivery/error behavior asserted after deleting one destination.
Alternative · under review
Unverified blanket outage claim: a missing workspace does not by itself prove that every other destination stops.
Alternative · under review
Invented automatic migration: deleting a workspace does not automatically select a replacement storage destination.
Alternative · under review
Unverified loss claim: actual storage delivery and retained objects must be checked; deletion of another destination alone proves neither loss nor continuity.
Original explanation · under review
Multiple destinations in one Diagnostic Setting are independent legs. Removing one target doesn't affect others.
Docs: Diagnostic settings destinations | Multi-destination settings
S20
Azure Advisor shows 47 "Cost" recommendations. Which to prioritize?- A. Sort by "Potential yearly savings" descending; act on high-impact low-risk first (idle resources, unattached billed public IPs/disks); then RIs/Savings Plans for stable workloads; leave right-sizing for after perf review
- B. All at once
- C. Random
- D. Skip Cost
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real prioritization: validate savings, workload impact and ownership before acting; commitments/right-sizing require stable-demand and performance review.
Why this is not the answer
Risky bulk action: recommendations can interact or affect availability; applying all without review is not sound prioritization.
Why this is not the answer
Arbitrary selection: random order ignores savings impact, operational risk and workload requirements.
Why this is not the answer
Missed opportunity: dismissing the category skips actionable savings that can be validated safely.
The reasoning
Advisor ranks by savings. Quick wins: unattached managed disks (still billed), unused billed public IPs, idle VMs (0 CPU 30+ days). Reservations need commitment analysis. Right-sizing needs perf review.