Question 960 An Azure VM runs above 90% CPU for a sustained window, and administrators need a notification. Which monitoring feature is appropriate? Only a storage account access-tier change Use a static resource tag as though it evaluated the CPU threshold A resource lock named HighCPU Azure Monitor metric alert rule with a suitable threshold and evaluation period Explanation Correct Answer D:Metric alerts evaluate time-series conditions and can notify through actions. Incorrect Answers A:Tiering doesn't evaluate VM CPU. B:Tags are metadata, not active metric-evaluation and notification rules. C:Locks don't read utilization.
Question 961 An Azure Monitor alert triggers but no team gets an email or webhook. What configuration should be checked? Only the VM image publisher Only the Azure Pricing Calculator result Only VNet subnet address size The attached action group and notification receivers Explanation Correct Answer D:Action groups define supported notification and automation actions for alerts. Incorrect Answers A:Guest image metadata doesn't route monitor notifications. B:Cost estimates don't configure receivers. C:CIDR capacity isn't alert delivery.
Question 962 A web app repeatedly triggers brief CPU alerts that resolve within seconds, overwhelming on-call staff. What rule design change should be considered? Disable all alerts so no duplicates can be delivered Delete all monitoring from production indefinitely Tune threshold, aggregation and evaluation window to meaningful sustained behavior Increase all VMs to maximum size without measuring workload Explanation Correct Answer C:Alert logic should reflect operational impact rather than momentary spikes. Incorrect Answers A:Suppressing every notification hides genuine incidents rather than addressing duplicate or noisy alerts. B:Removing signals hides genuine incidents. D:Overprovisioning isn't the only or necessarily safe response.
Question 963 An application has predictable daily swings, and static threshold alerts generate many false positives. Which Monitor feature may help? A Blob access tier Use one fixed threshold without examining normal workload variation Dynamic thresholds where supported by the signal An Azure resource lock Explanation Correct Answer C:Adaptive thresholding can account for normal metric patterns. Incorrect Answers A:Storage temperature isn't threshold adaptation. B:A fixed limit can produce excess noise or miss anomalies where dynamic baselines would be more appropriate. D:Locks don't learn utilization patterns.
Question 964 An internal policy requires operational log investigations to cover a defined historical period. What Azure Monitor design choice is necessary? Change the query dashboard period without configuring stored-log retention Choose suitable log workspace retention and archive settings for the requirements Use only default metrics with no retention review Configure VM availability sets as the log archive Explanation Correct Answer B:Telemetry retention affects available history and related cost. Incorrect Answers A:Dashboard visualization windows are not the settings controlling retention of collected telemetry. C:Default limits may not match audit expectations. D:Fault-domain placement isn't a log store.
Question 965 An operator sees a regional Azure platform notice and a separate application exception alert. Which monitoring distinction matters? Service Health is a VM guest log query language Every app exception must be a platform-wide Azure outage Azure Service Health tracks provider incidents while Azure Monitor tracks supported resource/application telemetry Cost Management predicts every application exception Explanation Correct Answer C:Both signals can be relevant but answer different questions. Incorrect Answers A:It is not Log Analytics. B:Customer code failures can be independent. D:Spending tools don't provide full runtime telemetry.
Question 966 A VM was stopped by an administrator, and security wants to know which Azure principal initiated the management operation. Where should it look? Azure Activity Log Only VM guest application logs Only a Blob access tier report Use performance metrics alone as proof of who modified Azure resource settings Explanation Correct Answer A:Activity Log records relevant subscription/resource management operations and callers. Incorrect Answers B:Guest logs may not show the ARM principal who issued Stop. C:Storage tiering doesn't record VM power actions. D:CPU and memory measurements do not identify subscription-level control-plane operations and actors.
Question 967 An organization wants supported Azure resource logs routed to a central Log Analytics workspace. Which Azure configuration concept is relevant? Diagnostic settings on the relevant resources A VM availability set Only a billing budget Assign a monitoring role but leave diagnostic collection unconfigured Explanation Correct Answer A:Diagnostic settings route supported platform logs and metrics to designated destinations. Incorrect Answers B:Placement isn't telemetry routing. C:A budget doesn't transport resource logs. D:Access to a destination does not by itself route the selected resource logs to that destination.
Question 968 A developer wants to know why a VM was resized yesterday, including the management operation's actor. Which data source is more suitable than CPU utilization metrics? Only average CPU percentage Activity Log management event details Assume a successful deployment activity proves the app's runtime latency is healthy Only the Azure Pricing Calculator scenario Explanation Correct Answer B:The log records relevant resource changes and associated callers. Incorrect Answers A:A metric doesn't identify who issued an ARM size change. C:Control-plane events and runtime performance telemetry answer different operational questions. D:A hypothetical quote isn't historical activity.
Question 969 A company needs a central place to store and query log records collected from multiple supported Azure resources. Which Azure Monitor component fits? A Log Analytics workspace An Azure Data Box device An Azure VM availability set Use Azure Monitor metric charts alone as the durable queryable log-record repository Explanation Correct Answer A:The workspace stores supported collected log tables and supports analytic queries. Incorrect Answers B:Offline transfer isn't an operational log query service. C:Fault domains aren't a telemetry warehouse. D:Metric charts show measurements; a Log Analytics workspace holds supported collected log tables for querying.
Question 970 An operations analyst must filter log records by timestamp and failure text across many services. Which query language is commonly used for Log Analytics? Filter exported log CSV manually instead of using the available KQL query A virtual machine BIOS configuration format Kusto Query Language (KQL) An ARM template parameter file alone Explanation Correct Answer C:KQL supports filtering and aggregating Azure Monitor log data. Incorrect Answers A:Offline filtering is not the native workspace query language for supported Log Analytics log tables. B:Guest firmware doesn't query workspace logs. D:A deployment definition isn't a log query language.
