Monitor and maintain Azure resources
This domain tests whether you can observe, alert on, protect, and recover Azure workloads.
Monitoring
Azure Monitor collects metrics and logs. Platform metrics are near real time and retained 93 days; resource logs require a diagnostic setting to a Log Analytics workspace, storage account, or event hub. Log Analytics uses KQL and has interactive retention plus long-term archive. Azure Monitor Agent with data collection rules replaces the legacy Log Analytics agent. Alert rules can be metric, log, or activity-log based and trigger action groups. Application Insights provides distributed tracing and availability tests for applications.
Continuity
Azure Backup uses Recovery Services vaults for VMs, SQL, and files, or Backup vaults for newer workloads; policies define schedule and retention, and soft delete guards against ransomware. Azure Site Recovery replicates VMs to a secondary region with recovery plans; test failover runs in an isolated network. Service Health reports platform incidents, Resource Health reports the specific resource, and Advisor gives recommendations.
Worked example
Alert when a VM's CPU exceeds 80% for 10 minutes and keep 90 days of security logs. Create a metric alert on Percentage CPU with a 10-minute aggregation and an action group; create a diagnostic setting sending SecurityEvent and Syslog to Log Analytics with 90-day retention. Reasoning: metrics suit fast thresholds, while logs suit retention and queries.
Traps
Metric alerts cannot query Log Analytics tables. The activity log records control-plane operations, not guest OS events. Backup snapshots are not a substitute for offsite retention. Test failover does not affect production replication. Deleting a workspace deletes its data. Recovery Services vault and Backup vault are not interchangeable.