AZ-104 - Monitor and Maintain Azure Resources (14% of the exam) - Section 5.1

Monitor Azure resources using Azure Monitor metrics, alerts, and Log Analytics.

Use Azure Monitor to collect platform metrics and resource logs, then query and analyse log data in a Log Analytics workspace using KQL. Configure alert rules with appropriate signal types and severity levels, and attach action groups to route notifications or trigger automated responses when alert conditions are met.

Azure Monitormetrics and logsLog Analytics workspacesalert rulesaction groups

Practice question for this objective

Free sampleMonitor and Maintain Azure Resourcesmedium

A developer who knows Kusto Query Language wants to write read-only queries against collected log and trace data, then reuse those queries in alerts and workbooks. Which Azure Monitor tool do they use?

AMetrics Explorer in chart mode, which plots numeric time-series values over time
BLog Analytics in KQL mode, which runs read-only queries over workspace tables Correct
CActivity Log search, which lists control-plane operations on subscription resources
DAutoscale rules editor, which scales resources based on metric or schedule rules

Log Analytics runs KQL queries over workspace log data; those saved queries feed alerts, workbooks, and dashboards. Log Analytics is the Azure portal tool for running KQL log queries against workspace tables; KQL mode lets a familiar user author queries and reuse them in alerts and workbooks.

Why A is wrong: Metrics Explorer charts numeric metrics; it does not run KQL over log tables.

Why B is correct: Correct. Log Analytics is the Azure portal tool for running KQL log queries against workspace tables; KQL mode lets a familiar user author queries and reuse them in alerts and workbooks.

Why C is wrong: Activity log search browses control-plane events, not arbitrary KQL queries over log tables.

Why D is wrong: Autoscale adds and removes resources on rules; it is not a log query tool.

See more AZ-104 practice questions, answers explained.

Exam traps in Monitor and Maintain Azure Resources

Answers that look right on this material and are not. Each one is a distractor from a different question in the AZ-104 bank for this domain.

You can add up to two action groups per rule
Why it is wrong: Two is below the documented ceiling; the supported maximum for a single alert rule is five action groups.
Prometheus metrics scraped from a managed Kubernetes cluster
Why it is wrong: Prometheus metrics flow to an Azure Monitor workspace through managed Prometheus, not through a diagnostic setting source.
Azure Monitor Logs, which keeps event records that you query with KQL
Why it is wrong: Logs holds log and trace records queried with KQL, not the time-series numeric store described.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.