Monitor and maintain Azure resources

Your company runs a monthly maintenance window on the first Saturday of each month from 02:00 to 06:00. During this time, several Azure Monitor metric alerts fire because VMs are rebooted and services are temporarily unavailable, generating unwanted notifications to the on-call team. You need to prevent these alerts from sending notifications only during the maintenance window, without deleting or disabling the underlying alert rules. What should you configure?

Your company protects 40 Azure VMs in a Recovery Services vault using a single backup policy that keeps daily recovery points for 30 days. To meet a new compliance requirement, you must retain the daily recovery points for 90 days. You need the change to apply to all protected VMs, including recovery points already created, with the least administrative effort. What should you do?

Your company uses a Recovery Services vault to protect several Azure VMs with Azure Backup. A disgruntled administrator deleted the backup for a critical VM and also stopped its backup, choosing the option to delete backup data. Three days later you discover the deletion. The vault has soft delete enabled with the default configuration. What must you do to restore the VM's recovery points before they are permanently purged?

Your company runs a critical Azure SQL Database. The operations team wants to be notified within a few minutes whenever the database's DTU consumption stays above 90% for a sustained period. They want to create a single alert rule in Azure Monitor that fires based on this platform-emitted performance data with the lowest latency and no custom query authoring. Which type of alert signal should you configure?

Your company runs a critical line-of-business application on an Azure VM named VM-App1. Users report intermittent slowness when the application connects to an external SQL endpoint over TCP port 1433. You need an ongoing, automated way to measure network latency and packet loss between VM-App1 and the SQL endpoint, and be alerted when performance degrades. Which Azure Network Watcher feature should you use?

You manage 20 Azure virtual machines running a multi-tier application. Support engineers report intermittent connectivity failures between the web tier and the database tier, but cannot identify which processes and TCP connections are involved. You need to visualize the running processes on each VM and the network dependencies between them without deploying additional third-party tooling. Which Azure Monitor feature should you enable?

You configure a scheduled query rule (log search alert) in Azure Monitor that runs a KQL query against a Log Analytics workspace. The rule uses a 15-minute evaluation frequency with a 15-minute lookback window. Users report they receive multiple duplicate alert notifications for the same underlying issue that persists for over an hour. You must reduce the number of repeated notifications for a continuously firing condition without changing how often the query runs. What should you configure?

Your company retains application logs in a Log Analytics workspace for compliance. Data older than 90 days is queried only rarely for occasional audits, but must be kept for 2 years. Interactive retention is currently set to 90 days. You need to keep the older data for the full 2 years at the lowest cost while still allowing it to be searched when required. What should you configure?

Your company collects performance and event data from 40 Azure VMs into a single Log Analytics workspace. The security team asks you to produce a report that shows the total number of failed sign-in events (EventID 4625) generated by each computer over the last 24 hours, sorted from highest to lowest. Which Kusto Query Language (KQL) query should you run in Azure Monitor Logs?

You manage 30 Azure VMs that send performance data to a Log Analytics workspace via the Azure Monitor Agent. The security team wants to be notified whenever the Windows Event log records more than five failed logon events (Event ID 4625) within a 10-minute window on any monitored VM. You need to create an alert rule that meets this requirement with the least administrative effort. What should you configure?

Your company runs 40 Azure VMs that send performance and event data to a single Log Analytics workspace. The operations team wants to be notified whenever any VM reports a critical Windows event with Event ID 41 in the past 5 minutes. You need to create an alert that evaluates a KQL log query against the workspace and triggers on matching results. Which type of Azure Monitor alert rule should you create?

You manage a fleet of Azure VMs that run a workload with highly variable CPU usage that changes by time of day and day of week. You created a static metric alert rule on Percentage CPU set to fire above 80%, but it generates frequent false alerts during predictable busy periods and misses anomalies during quiet periods. You want to reduce noise while still detecting genuine anomalies, with minimal ongoing tuning. What should you configure?

You manage 30 Azure virtual machines in the same subscription and region. You need to receive an alert whenever the average CPU on any of these VMs exceeds 85% over a 5-minute window. You want to minimize the number of alert rules you have to create and maintain. What should you do?

A virtual machine named VM1 in Azure cannot receive inbound HTTPS (TCP 443) traffic from a specific client IP address on the internet. You need to quickly determine whether an NSG rule is allowing or denying this specific traffic to VM1's network interface, and which rule is responsible, without inspecting every rule manually. Which Network Watcher feature should you use?

A VM in Azure is experiencing intermittent connectivity problems that occur only a few times per day. Application teams need to inspect the actual network traffic (packet-level data) reaching and leaving the VM during these incidents so they can analyze it later in Wireshark. You want to capture this data without installing third-party tools and store the results in an Azure storage account. Which Azure Network Watcher feature should you use?

Your company backs up several production Azure VMs to a Recovery Services vault in the East US region. During a regional outage in East US, you need to restore a protected VM from its backup data into the West US region. When you attempt this, the West US region is not available as a restore target. What must you verify or configure to enable restoring the VM's backup data to a secondary region?

You create a new Recovery Services vault named RSV1 to protect several Azure VMs. Before configuring any backups, you want to change the vault's backup storage redundancy from the default GRS to LRS to reduce costs. When you open the Backup Infrastructure settings, the storage redundancy option is greyed out and cannot be changed. What is the most likely reason?

Your company uses Azure Site Recovery to protect a multi-tier application (a database VM, two application VMs, and a web front-end VM) replicating to a secondary region. During a regional failover, the application VMs must not start until the database VM is fully online, and the web VM must start last. You need to control the sequence in which the VMs boot during failover. What should you configure?

Your company protects several Azure VMs in the East US region using Azure Site Recovery, replicating to West US. The business requires that in a regional outage, no more than a few minutes of data can be lost, and you must minimize the recovery point objective (RPO). Which Azure Site Recovery configuration setting most directly controls how much data could be lost during a failover?

Your company uses Azure Site Recovery to replicate production VMs from the East US region to the West US region for disaster recovery. The compliance team requires that you validate the DR configuration quarterly. This validation must confirm that the replicated VMs can boot and applications function correctly in West US, without impacting the running production workloads in East US or affecting ongoing replication. Which action should you perform?