AZ-104 · Domain 5 of 5

AZ-104 Domain 5: Monitor and maintain Azure resources

This domain covers keeping Azure healthy: monitoring with Azure Monitor metrics, logs, alerts and Insights and Network Watcher, and protecting data with Azure Backup and Azure Site Recovery for backup, restore and regional failover.

Exam weight
10–15%
Official functional groups
2
Estimated questions estimate
5–8
Suggested study time estimate
10–15 hrs

About 9 min read Reviewed October 2026

Overview

Monitor and maintain Azure resources covers observability and data protection. It has two objective groups. Monitoring covers Azure Monitor metrics, log settings, querying and analyzing logs, alert rules, action groups and alert processing rules, monitoring VMs, storage and networks with Insights, and using Network Watcher and Connection Monitor. Backup and recovery covers Recovery Services and Backup vaults, backup policies, backup and restore with Azure Backup, and Azure Site Recovery for replicating and failing over to a secondary region.

At 10–15%, this is the smallest group but covers essential operations: knowing when a problem occurs and being able to recover from one. The exam rewards knowing which monitoring tool reveals which signal, how alerts and action groups fire notifications, and how Azure Backup and Site Recovery differ, backup protects data while Site Recovery provides regional failover.

How it's tested

AZ-104 questions in this group describe a monitoring, alerting or recovery need and ask how to configure it. Decide first whether the scenario is about detecting a problem or recovering from one, because that splits Azure Monitor from Azure Backup and Site Recovery. Then match restore of data to Backup and regional failover to Site Recovery.

  • Right monitoring tool

    A visibility need is described, and you choose metrics, logs, Insights or Network Watcher.

  • Configure alerting

    A notification need is described, and you choose alert rules and action groups.

  • Backup or failover

    A recovery need is described, and you choose Azure Backup or Azure Site Recovery.

Reasoning it through

A business must be able to fail an entire set of virtual machines over to a secondary Azure region if the primary region becomes unavailable. Azure Backup protects and restores data but does not replicate running VMs for regional failover. Azure Site Recovery continuously replicates VMs to a secondary region and orchestrates failover, which matches the regional-failover requirement, so Site Recovery is the service.

Functional groups 2

Official functional groups from the Microsoft outline, in outline order.

5.1 Monitor resources in AzureAzure Monitor metrics, logs, alerts, Insights and Network Watcher.
What it means
This covers interpreting metrics in Azure Monitor, configuring log settings, querying and analyzing logs, setting up alert rules, action groups and alert processing rules, monitoring VMs, storage accounts and networks with Azure Monitor Insights, and using Azure Network Watcher and Connection Monitor.
What to understand
Metrics are numerical time-series data, while logs are detailed records queried with Log Analytics. Alert rules fire when a condition is met and trigger action groups, which notify or act. Insights provide curated monitoring for specific resource types. Network Watcher diagnoses network issues. Choosing the right tool matches the signal needed.
How it shows up
A monitoring or alerting need is described, and you must choose metrics, logs, alerts, Insights or Network Watcher.
Common confusion
Confusing metrics with logs; metrics are numerical time-series, while logs are detailed records queried with Log Analytics.
5.2 Implement backup and recoveryRecovery Services and Backup vaults, backup policies, Azure Backup and Site Recovery.
What it means
This covers creating Recovery Services vaults and Azure Backup vaults, creating and configuring backup policies, performing backup and restore with Azure Backup, configuring Azure Site Recovery for Azure resources, performing a failover to a secondary region, and interpreting backup reports and alerts.
What to understand
Azure Backup protects data by backing it up to a vault on a policy schedule, enabling restore. Azure Site Recovery replicates VMs to a secondary region and orchestrates failover for disaster recovery. They serve different needs: backup for data loss and accidental deletion, Site Recovery for regional outages.
How it shows up
A recovery requirement is described, and you must choose Azure Backup or Azure Site Recovery and the right vault and policy.
Common confusion
Confusing Azure Backup with Azure Site Recovery; Backup protects and restores data, while Site Recovery replicates and fails over to another region.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Metrics vs. logs

    Numerical time-series versus detailed records.

    Remember
    Logs are queried with Log Analytics.
    Tested as
    Monitoring questions.
    Trap
    Confusing the two.

  • Alert rules and action groups

    Conditions that fire notifications or actions.

    Remember
    Rules trigger action groups.
    Tested as
    Alerting questions.
    Trap
    Separating rules from the action they trigger.

  • Alert processing rules

    Modify or suppress alert actions at scale.

    Remember
    They manage alerts across resources.
    Tested as
    Alerting questions.
    Trap
    Overlooking them for bulk handling.

  • Azure Monitor Insights

    Curated monitoring for VMs, storage and networks.

    Remember
    Ready-made dashboards per resource type.
    Tested as
    Monitoring questions.
    Trap
    Building everything manually.

  • Log Analytics

    Workspace and query tool for logs.

    Remember
    It queries log data with KQL.
    Tested as
    Monitoring questions.
    Trap
    Confusing it with metrics.

  • Network Watcher

    Diagnoses network connectivity and flow.

    Remember
    It troubleshoots network issues.
    Tested as
    Monitoring questions.
    Trap
    Overlooking it for network diagnosis.

  • Recovery Services vault

    Stores backups and Site Recovery data.

    Remember
    The container for backup and DR.
    Tested as
    Backup questions.
    Trap
    Confusing vault types.

  • Backup policy

    Schedule and retention for backups.

    Remember
    It defines when and how long to keep backups.
    Tested as
    Backup questions.
    Trap
    Backing up without a policy.

  • Azure Backup

    Backs up and restores data.

    Remember
    For data loss and accidental deletion.
    Tested as
    Recovery questions.
    Trap
    Confusing it with Site Recovery.

  • Azure Site Recovery

    Replicates and fails over to a secondary region.

    Remember
    For regional disaster recovery.
    Tested as
    Recovery questions.
    Trap
    Confusing it with Backup.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Metrics vs. logs vs. Insights

ConceptMeaningKey differenceCommon trap
Metrics Numerical time-series Fast, for trends and alerts Expecting detailed records
Logs Detailed records in Log Analytics Queried with KQL Confusing with metrics
Insights Curated per-resource monitoring Ready-made dashboards Building manually instead

Azure Backup vs. Azure Site Recovery

ConceptMeaningKey differenceCommon trap
Azure Backup Backs up and restores data Data loss and deletion Using it for regional failover
Azure Site Recovery Replicates and fails over Regional disaster recovery Using it for routine data restore

Alert rule vs. action group

ConceptMeaningKey differenceCommon trap
Alert rule The condition that fires Detects the issue Treating it as the notification
Action group What happens when it fires Notifies or acts Expecting it to detect

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Backup for regional failover

    What candidates pick
    Use Azure Backup to fail VMs over to a secondary region.
    Why it looks right
    Backup protects data.
    Why it's wrong
    Azure Backup restores data but does not replicate running VMs for regional failover; Azure Site Recovery does.

    Clue to watch for The requirement is regional failover of running workloads.

  2. Site Recovery for data restore

    What candidates pick
    Use Azure Site Recovery to restore an accidentally deleted file.
    Why it looks right
    It is a recovery service.
    Why it's wrong
    Site Recovery replicates and fails over; Azure Backup restores data such as deleted files.

    Clue to watch for The need is to restore specific data or recover a deletion.

  3. Metrics for detailed records

    What candidates pick
    Query metrics to find detailed log entries about an event.
    Why it looks right
    Both are monitoring data.
    Why it's wrong
    Metrics are numerical time-series; detailed records are logs queried in Log Analytics.

    Clue to watch for The need is detailed event records, not numeric trends.

  4. Rule without action group

    What candidates pick
    Create an alert rule and expect it to send notifications on its own.
    Why it looks right
    The rule detects the issue.
    Why it's wrong
    An alert rule fires, but an action group defines the notification or action it triggers.

    Clue to watch for The alert must notify someone or take an action.

  5. Backup without policy

    What candidates pick
    Enable backup without configuring a backup policy.
    Why it looks right
    Backup is turned on.
    Why it's wrong
    A backup policy defines the schedule and retention; without it, backups are not managed correctly.

    Clue to watch for The requirement specifies a schedule or retention.

Answer framework

For any Domain 5 scenario, use these steps to find the answer AZ-104 expects.

  1. Identify whether the need is monitoring and alerting or backup and recovery.
  2. For monitoring, choose metrics for numeric trends, logs and Log Analytics for detailed records, Insights for curated dashboards, and Network Watcher for network diagnosis.
  3. For alerting, create an alert rule for the condition and an action group for the notification or action, using alert processing rules to manage at scale.
  4. For data protection, use Azure Backup with a Recovery Services vault and a backup policy to back up and restore data.
  5. For regional disaster recovery, use Azure Site Recovery to replicate and fail over workloads to a secondary region.

Practice question

An organization must be able to fail its Azure virtual machines over to a secondary Azure region and resume operations there if the primary region experiences an outage. Which Azure service should the administrator configure?

Want more like this? The AZ-104 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Although this is the smallest group, do not skip it, since both monitoring and recovery are essential and testable. Start with Azure Monitor: learn the difference between metrics (numeric trends) and logs (detailed records queried with Log Analytics), and how alert rules connect to action groups that notify or act. Add Insights for curated monitoring and Network Watcher for network diagnosis.

Next, learn backup and recovery, and fix firmly the Azure Backup versus Azure Site Recovery distinction: Backup protects and restores data, while Site Recovery replicates and fails over to another region. Practice creating a vault, a backup policy, and a Site Recovery replication.

Because the exam tests configuration, set up an alert and a backup in a free subscription. Write a few simple KQL queries in Log Analytics and run a test restore from your vault so you know each step of the recovery flow. This is the final group, so finish with full practice tests spanning all five.

FAQ

How much of AZ-104 is Domain 5?

Monitor and maintain Azure resources is 10–15% of the exam, the smallest group, but covers essential monitoring and recovery.

What is the difference between metrics and logs in Azure Monitor?

Metrics are numerical time-series data, good for trends and fast alerts. Logs are detailed records queried with Log Analytics using KQL.

How do alert rules and action groups work together?

An alert rule defines the condition that fires. An action group defines what happens when it fires, such as sending a notification or triggering an action.

What is the difference between Azure Backup and Azure Site Recovery?

Azure Backup backs up and restores data, protecting against data loss and accidental deletion. Azure Site Recovery replicates workloads to a secondary region and orchestrates failover for regional disaster recovery.

What is a backup policy?

A configuration that defines the backup schedule and retention period, so Azure Backup knows when to back up and how long to keep each backup.

What is Network Watcher for?

Diagnosing network connectivity and traffic flow issues, such as checking why traffic is blocked or monitoring connections between resources.

How does Domain 5 connect to the rest of the exam?

It monitors and protects the identity, storage, compute and networking resources from the other domains, closing the administration lifecycle.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 5 knowledge

You have covered Azure Monitor, alerting, backup and regional recovery. Test whether you can choose the right monitoring or recovery tool under exam conditions.

Take the AZ-104 practice test Check your AZ-104 readiness

Keep going