Pass Your Microsoft AZ-104 Exam Easy!

Checking replication health and the selected recovery point before running a disaster-recovery exercise is a sensible preparatory safety measure. It helps avoid validating an outdated or unavailable replica, but it is not the Site Recovery feature that makes a test run separate from production. A normal unplanned failover could also begin with healthy replication and yet redirect service traffic; that would violate the no-production-interruption requirement. Choose the explicit test-failover operation with an isolated target network for the drill, then record observations and perform the test-failover cleanup.

An alert severity classification can indicate potential protection trouble, and a successful restore test is better evidence that recovery mechanisms actually operate. Those are important observations for backup and disaster-recovery governance, but they do not choose the Site Recovery operation needed for a non-disruptive drill. In the scenario the team needs to create recovery-region test VMs while production traffic continues to flow to the original service. A verified action alert by itself does not create an isolated replica or validate application login, network dependencies and cleanup; use test failover for that.

Verifying that the source and target regions, protected VM disks, replication support and target resources are compatible is an important prerequisite for any real or test failover. But it cannot by itself prevent a production cutover when an engineer selects the wrong operation. The requested feature must use an isolated test workflow that preserves the original running production VM and continued replication. Confirm prerequisites, then deliberately run Site Recovery Test Failover against a separate network rather than a planned or unplanned production failover, and clean up the created test resources afterward.

Mapping the target VNet, subnet, DNS services and application security controls is necessary to make a recovered instance functional. If those mappings point the drill into the production network without isolation, the test VM might collide with running endpoints or duplicate host identities. Network preparation is therefore part of safe test execution but not a standalone substitute for the test-failover operation. Select a distinct, controlled test network matching required application dependencies, run the drill, validate access and cleanup; retain the original customer traffic path rather than routing it to test VMs.

'Validate replication health and usable recovery point status before triggering failover' solves another task because running failover with unhealthy replication can exceed accepted data loss or recovery time. For the situation where an engineer triggers a test failover and assumes customer traffic should automatically move to the test VMs, this distractor misses the requirement that test and production failover differ in isolation, traffic routing and operational consequences. Unlike 'Validate replication health and usable recovery point status before triggering failover', 'Treat test failover as an isolated rehearsal, not production failover' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a payroll application needs to restart in another region after its primary region fails, not merely recover a deleted file, the action 'Use Azure Site Recovery replication and tested failover for the application VMs' can be relevant: Site Recovery orchestrates workload replication/failover; ordinary file backup targets different recovery outcomes. For the different problem of an engineer triggers a test failover and assumes customer traffic should automatically move to the test VMs, 'Use Azure Site Recovery replication and tested failover for the application VMs' misses the mechanism that test and production failover differ in isolation, traffic routing and operational consequences. Choosing 'Use Azure Site Recovery replication and tested failover for the application VMs' would address that other need, whereas 'Treat test failover as an isolated rehearsal, not production failover' is intended to solve the stated condition.

'Reprotect replicated VMs after failover where required by Site Recovery workflow' applies to a different feature boundary because after failover, the protected direction and new primary environment may change. In the stated scenario where an engineer triggers a test failover and assumes customer traffic should automatically move to the test VMs, 'Reprotect replicated VMs after failover where required by Site Recovery workflow' does not satisfy the mechanism that test and production failover differ in isolation, traffic routing and operational consequences. The necessary action is 'Treat test failover as an isolated rehearsal, not production failover', which should be checked against this Azure resource's actual permissions and state.

'Align backup frequency and recovery-point coverage to the four-hour RPO' solves another task because a daily backup may exceed the accepted data-loss window even when backup jobs succeed. For the situation where a disaster declaration offers several recovery points with different ages, this distractor misses the requirement that latest is not automatically best if app-consistent state and declared RPO matter. Unlike 'Align backup frequency and recovery-point coverage to the four-hour RPO', 'Choose a suitable available recovery point based on data loss and consistency requirements' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When an Azure Site Recovery dashboard shows replication lag and a warning before planned failover, the action 'Validate replication health and usable recovery point status before triggering failover' can be relevant: running failover with unhealthy replication can exceed accepted data loss or recovery time. For the different problem of a disaster declaration offers several recovery points with different ages, 'Validate replication health and usable recovery point status before triggering failover' misses the mechanism that latest is not automatically best if app-consistent state and declared RPO matter. Choosing 'Validate replication health and usable recovery point status before triggering failover' would address that other need, whereas 'Choose a suitable available recovery point based on data loss and consistency requirements' is intended to solve the stated condition.

The nearby action 'Restore only the affected file from an applicable Azure VM backup recovery point' is associated with this separate need: a user deletes a single application configuration file but the VM operating system still runs. That is because file-level recovery avoids unnecessary whole-VM replacement when a supported recovery point contains the file. Here a disaster declaration offers several recovery points with different ages, so 'Restore only the affected file from an applicable Azure VM backup recovery point' misses the fact that latest is not automatically best if app-consistent state and declared RPO matter. 'Choose a suitable available recovery point based on data loss and consistency requirements' is the more defensible action; confirm its behavior in the target service before calling the task complete.

Planning the eventual failback is sensible operational governance, but a calendar entry or documented recovery plan cannot replicate changed application data from the new primary. The question specifically asks what restores ongoing protection during the two weeks users remain in Region B. Without reprotection, recovery from a second outage and a controlled move back to Region A may lack current recovery points. Configure reverse replication through the supported Azure Site Recovery reprotect workflow, monitor its status and then prepare an authorized failback after Region A is ready.

A test failover starts an isolated rehearsal copy at a selected recovery point. It is useful for proving boot, networking and application dependencies without redirecting production traffic, but it does not replace the reprotect operation needed to reverse the live replication direction after committed failover. In this case Region B already hosts the real workload. Continuing to rehearse cannot guarantee its changes reach Region A. Use the Site Recovery reprotect procedure, verify replication health and reserve test failovers for validating a documented recovery plan.

DNS cutover is an application reachability requirement, not evidence that Azure Site Recovery is copying the VM's changes to another region. A healthy public endpoint in Region B may coexist with stopped or unconfigured reverse replication. The scenario has already completed the production failover and needs a new ongoing protection direction while the workload remains at the secondary location. Initiate reprotection and inspect Azure Site Recovery replicated-item state and recovery points; validate DNS, firewall and load balancer paths separately for active customer traffic.

A managed disk snapshot preserves a disk state at one point in time and can be useful for a scoped rollback. It does not by itself implement continuous cross-region VM replication, selected recovery-point management, dependency orchestration or the failback workflow. The organization's business requirement is continued protection of the new Region B primary toward Region A. That calls for Azure Site Recovery reprotection after committed failover. Use snapshot or backup technologies as complementary recovery tools if required, but do not label an isolated snapshot as equivalent to active Site Recovery replication.

'Reprotect replicated VMs after failover where required by Site Recovery workflow' applies to a different feature boundary because after failover, the protected direction and new primary environment may change. In the stated scenario where a restored VM starts in the secondary region but public users cannot reach the app, 'Reprotect replicated VMs after failover where required by Site Recovery workflow' does not satisfy the mechanism that running VMs are insufficient if public name routing and upstream/downstream services still target primary region. The necessary action is 'Verify recovered IP/DNS, firewall, load balancer and application dependencies', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Check vault redundancy, cross-region restore availability and workload compatibility' is associated with this separate need: a team requests cross-region recovery from a vault whose settings may not support it. That is because secondary-region restore is conditional and cannot be assumed for every protected resource. Here a restored VM starts in the secondary region but public users cannot reach the app, so 'Check vault redundancy, cross-region restore availability and workload compatibility' misses the fact that running VMs are insufficient if public name routing and upstream/downstream services still target primary region. 'Verify recovered IP/DNS, firewall, load balancer and application dependencies' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When a disaster-recovery plan selects a secondary region but ignores network support and workload compatibility, the action 'Confirm primary and target region pairing, replication support and networking prerequisites' can be relevant: not every service or VM scenario supports arbitrary target regions and recovery features. For the different problem of a restored VM starts in the secondary region but public users cannot reach the app, 'Confirm primary and target region pairing, replication support and networking prerequisites' misses the mechanism that running VMs are insufficient if public name routing and upstream/downstream services still target primary region. Choosing 'Confirm primary and target region pairing, replication support and networking prerequisites' would address that other need, whereas 'Verify recovered IP/DNS, firewall, load balancer and application dependencies' is intended to solve the stated condition.

Deleting the live recovery-region VM before confirming the original-region VM is recovered and servicing traffic can destroy the only functioning production copy. Even when Site Recovery displays completed jobs, application consistency, current replication state and recovery VM accessibility must be verified before retiring any temporary infrastructure. The business has asked for a safe return, so there must first be an authorized failback plan and the appropriate protection/reprotection workflow. A premature delete is neither a valid reprotection action nor a substitute for an operational cutover and customer acceptance test.

Switching DNS to the original region before the application has synchronized and passed health validation may direct customers to inconsistent databases, unavailable backends or stale security routes. The requirement is a safe return after the original region is repaired, not merely an early hostname change. Verify Site Recovery's replica, actual recovered VM and application dependencies, then execute a coordinated authorized cutover. DNS and load-balancer updates belong at the appropriate phase after readiness is proven; flipping them prematurely is not an independent required failback step.

A successful regional failover changes which copy is the production VM and can change the replication direction needed for protection and a later return. Site Recovery documentation explicitly includes reprotection steps before and after Azure-to-Azure failback, so it is unsafe to assume the original protection configuration continues unaltered. The question asks which two actions form a recoverable plan; continuing an old replication assumption can leave the new active region unprotected. Review the Site Recovery state machine and enable the correct-direction replication before conducting the controlled return.

A completed failback task indicates a platform workflow reached a particular state, but customers can still encounter broken DNS, blocked NSGs, missing dependencies or application-level consistency problems. The return plan must test the recovered service and control traffic cutover, not simply report a green operation status. This alternative also neglects the possibility that the newly active original region has not yet been reprotected toward a standby. The two selected measures explicitly address both the production return and continued disaster-recovery protection, which a single success toast cannot establish.

'Treat alert severity and actual restore-test success as separate evidence' solves another task because an alert records monitored conditions; it does not attest recoverability or successful DR tests. For the situation where backup jobs for one application repeatedly fail, but the on-call team's alert rule only checks VM CPU, this distractor misses the requirement that compute CPU signals do not reveal backup protection failure or policy noncompliance. Unlike 'Treat alert severity and actual restore-test success as separate evidence', 'Alert on backup-job failures with appropriate severity, recipients and thresholds' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Align backup frequency and recovery-point coverage to the four-hour RPO' applies to a different feature boundary because a daily backup may exceed the accepted data-loss window even when backup jobs succeed. In the stated scenario where backup jobs for one application repeatedly fail, but the on-call team's alert rule only checks VM CPU, 'Align backup frequency and recovery-point coverage to the four-hour RPO' does not satisfy the mechanism that compute CPU signals do not reveal backup protection failure or policy noncompliance. The necessary action is 'Alert on backup-job failures with appropriate severity, recipients and thresholds', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Restore required backup extension/agent and policy association after examining errors' is associated with this separate need: Azure Backup jobs fail after an agent extension was removed and policy assignment changed. That is because protection requires the correct workload integration; reattempting jobs without prerequisites repeats failure. Here backup jobs for one application repeatedly fail, but the on-call team's alert rule only checks VM CPU, so 'Restore required backup extension/agent and policy association after examining errors' misses the fact that compute CPU signals do not reveal backup protection failure or policy noncompliance. 'Alert on backup-job failures with appropriate severity, recipients and thresholds' is the more defensible action; confirm its behavior in the target service before calling the task complete.

A Recovery Services vault is a protection container, not a one-to-one count of backed-up Azure VMs. One vault may contain many protected items while other VMs in the same subscription have no protected instance. The report shows 100 deployed VMs but only 80 protected instances, which is a coverage discrepancy that requires a per-workload inventory and a review of actual backup jobs and policy assignments. Counting vaults instead of matching individual VM resource IDs to protected items would conceal the 20 potentially unprotected machines rather than identify them.

The nearby action 'Choose a supported vault region aligned to the protected source workload and recovery design' is associated with this separate need: a disaster-recovery administrator creates a vault far from the protected workloads without checking requirements. That is because backup/restore support often has regional association and workload residency constraints. Here a report shows 100 Azure VMs but only 80 protected instances, so 'Choose a supported vault region aligned to the protected source workload and recovery design' misses the fact that green job results for protected VMs say nothing about the 20 missing coverage targets. 'Compare actual protected/unprotected workload inventory and backup health trends' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Filter backup reporting by subscription and protected resource identity' solves another task because a broad tenant-wide aggregate can hide the status of resources subject to the local contract. For the situation where a report shows 100 Azure VMs but only 80 protected instances, this distractor misses the requirement that green job results for protected VMs say nothing about the 20 missing coverage targets. Unlike 'Filter backup reporting by subscription and protected resource identity', 'Compare actual protected/unprotected workload inventory and backup health trends' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Verify telemetry/report data freshness and actual current backup/restore evidence' applies to a different feature boundary because a stale reporting pipeline may show old success while recent failures are missing. In the stated scenario where an enterprise wants a recovery compliance report for one subscription without mixing other teams, 'Verify telemetry/report data freshness and actual current backup/restore evidence' does not satisfy the mechanism that a broad tenant-wide aggregate can hide the status of resources subject to the local contract. The necessary action is 'Filter backup reporting by subscription and protected resource identity', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Compare actual protected/unprotected workload inventory and backup health trends' is associated with this separate need: a report shows 100 Azure VMs but only 80 protected instances. That is because green job results for protected VMs say nothing about the 20 missing coverage targets. Here an enterprise wants a recovery compliance report for one subscription without mixing other teams, so 'Compare actual protected/unprotected workload inventory and backup health trends' misses the fact that a broad tenant-wide aggregate can hide the status of resources subject to the local contract. 'Filter backup reporting by subscription and protected resource identity' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Alert on backup-job failures with appropriate severity, recipients and thresholds' solves another task because compute CPU signals do not reveal backup protection failure or policy noncompliance. For the situation where an enterprise wants a recovery compliance report for one subscription without mixing other teams, this distractor misses the requirement that a broad tenant-wide aggregate can hide the status of resources subject to the local contract. Unlike 'Alert on backup-job failures with appropriate severity, recipients and thresholds', 'Filter backup reporting by subscription and protected resource identity' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Verifying telemetry freshness is useful when a reporting pipeline stopped ingesting new events, but a fresh or stale chart cannot by itself establish whether an application can be recovered. This case already provides an observed failed recovery drill last week. The correct conclusion is that a Critical alert describes the monitored event or rule evaluation, while the failure of an actual recovery test is independent evidence of recoverability problems. Investigators may check alert timestamps separately, but that is not the core lesson from the two explicit pieces of evidence here.

Adding an alert on backup-job failures can reveal protection failures earlier, but a Critical alert has already fired in the stated case and the reported recovery drill failed. More alert rules alone cannot prove that backups restore successfully or that an application starts and serves users in the alternate environment. The quality decision must incorporate the drill's observed recovery outcome and subsequent remediation test, not merely the severity label or the volume of notifications. Backup-job alerting is useful for operations, yet it is not equivalent to a tested recovery process.

An isolated Azure Site Recovery test failover is a valuable way to exercise a replicated application's recovery plan without moving normal production traffic. But the scenario is not asking which drill to schedule next; it explicitly says last week's drill already failed and asks what management should conclude about a Critical alert. Running another test might be appropriate after fixing the failed dependencies, but it cannot retroactively make that failed test successful. The correct interpretation separates alert signaling from proof of application recovery and requires documented remediation and a subsequent successful test.

'Treat alert severity and actual restore-test success as separate evidence' solves another task because an alert records monitored conditions; it does not attest recoverability or successful DR tests. For the situation where a compliance reviewer sees a healthy backup dashboard with no events since last month and suspects its data ingestion stopped, this distractor misses the requirement that a stale reporting pipeline may show old success while recent failures are missing. Unlike 'Treat alert severity and actual restore-test success as separate evidence', 'Verify telemetry/report data freshness and actual current backup/restore evidence' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Alert on backup-job failures with appropriate severity, recipients and thresholds' applies to a different feature boundary because compute CPU signals do not reveal backup protection failure or policy noncompliance. In the stated scenario where a compliance reviewer sees a healthy backup dashboard with no events since last month and suspects its data ingestion stopped, 'Alert on backup-job failures with appropriate severity, recipients and thresholds' does not satisfy the mechanism that a stale reporting pipeline may show old success while recent failures are missing. The necessary action is 'Verify telemetry/report data freshness and actual current backup/restore evidence', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Filter backup reporting by subscription and protected resource identity' is associated with this separate need: an enterprise wants a recovery compliance report for one subscription without mixing other teams. That is because a broad tenant-wide aggregate can hide the status of resources subject to the local contract. Here a compliance reviewer sees a healthy backup dashboard with no events since last month and suspects its data ingestion stopped, so 'Filter backup reporting by subscription and protected resource identity' misses the fact that a stale reporting pipeline may show old success while recent failures are missing. 'Verify telemetry/report data freshness and actual current backup/restore evidence' is the more defensible action; confirm its behavior in the target service before calling the task complete.