5.3 - Network Watcher, Site Recovery and Update Manager
AZ-104 objective 5.3 covers maintaining, backing up and troubleshooting resources. Network Watcher diagnoses connectivity: IP flow verify evaluates a specified packet (direction, protocol, local and remote IP and port) against the effective network security group rules and, when it reports a packet was denied, also names the rule that blocked it so you can fix it; next hop shows where traffic goes and returns the type VnetLocal when the destination is inside the same virtual network; and traffic analytics ranks which external IP addresses send the most traffic into your subnets across all NSGs. For business continuity, Azure Site Recovery replicates VMs to a paired region and uses a cache storage account to hold changes temporarily before they are sent to the target region, and a recovery plan groups multiple VMs with a boot order so a multi-tier application comes up in the correct sequence during failover. Azure Update Manager installs operating-system patches, including an on-demand one-time deployment that applies a specific set of updates to selected VMs right now, outside any recurring schedule. An autoscale setting specifies minimum, maximum and default instance counts. Expect scenarios that ask which diagnostic, recovery or update tool fits.
Packet blocked and which rule did it = IP flow verify. Destination inside the same VNet = next hop VnetLocal. Replicate VMs to another region = Site Recovery (cache storage account); boot order = recovery plan. Patch now, off-schedule = Update Manager on-demand.
Practice questions
1. A VM cannot reach a remote IP and you must diagnose the effective routes and security rules on its network interface. Which tool should you use?
- Azure Network Watcher (correct answer)
- Azure Advisor cost recommendations reviewed for the affected virtual machine and its resource group
- Azure Policy
- A Recovery Services vault
Network Watcher offers IP flow verify, next hop, effective security rules, and connection troubleshooting to diagnose connectivity. Advisor gives cost tips, Azure Policy governs configuration, and a Recovery Services vault handles backup.
2. Which Azure Monitor feature automatically adds or removes VM scale set instances based on a metric such as CPU?
- A ReadOnly resource lock that prevents any change to the scale set while the workload experiences its heaviest daily traffic
- Autoscale (correct answer)
- A private DNS zone
- A service endpoint
Autoscale in Azure Monitor changes the instance count of a scale set based on metric or schedule rules. A ReadOnly lock blocks changes, a private DNS zone resolves names, and a service endpoint extends VNet identity to PaaS.
3. In an autoscale rule, what is the purpose of the cool-down period after a scale action?
- It waits before the next scale action so metrics stabilize (correct answer)
- It permanently caps the maximum number of instances the scale set can ever reach across all future autoscale profiles you define
- It encrypts the VM disks
- It assigns a public IP to each new instance
The cool-down period pauses further scaling after an action so metrics can settle, preventing rapid repeated changes. It does not cap maximum instances, encrypt disks, or assign public IPs.
4. You want a scale set to run more instances every weekday between 8 AM and 6 PM regardless of load. Which autoscale capability fits?
- A dynamic-threshold metric alert that studies historical CPU patterns and notifies the on-call engineer when the workload deviates from them
- A resource lock
- A schedule-based autoscale profile (correct answer)
- A NAT gateway
A schedule-based autoscale profile sets instance counts for specific times or recurring windows, such as business hours. A dynamic-threshold alert only notifies, a lock protects resources, and a NAT gateway is outbound networking.
5. When you define an autoscale setting, which three instance-count values do you typically specify?
- The public IP, the private IP, and the DNS name that will be assigned to each additional instance created during a scale-out
- The subscription, the tenant, and the management group
- Only a single fixed instance count that never changes
- Minimum, maximum, and default (correct answer)
Autoscale settings define minimum, maximum, and default instance counts, bounding how far it can scale. IP and DNS assignment, subscription hierarchy, and a single fixed count are not the autoscale count parameters.
6. Pairing a scale-out rule with a scale-in rule and a cool-down period mainly helps prevent which autoscale problem?
- Flapping (correct answer)
- The permanent loss of all diagnostic metrics that had been collected from the instances before the most recent scaling operation occurred
- VMs being placed in the wrong subscription
- Storage keys being rotated too often
Flapping is rapid repeated scale in and out; a cool-down and well-separated thresholds dampen it. The other options describe unrelated data loss, placement, and key-rotation issues.