Technical Lab: Configure and interpret reports and alerts for backups
Questions
Question 1 — Multiple Choice
An administrator needs to monitor the status of all backup jobs from multiple Azure Recovery Services vaults in a single subscription. They want a solution that allows custom queries, historical data retention for up to 1 year, and integration with Azure Monitor dashboards.
Which solution meets these requirements?
A) Configure classic alerts in the Recovery Services vault and export the data to a Storage Account monthly.
B) Enable Backup Reports via Azure Monitor Workbooks, connected to a Log Analytics Workspace.
C) Use the Azure Activity Log to filter backup operations and create event-based alerts.
D) Configure email notifications directly in the backup policies of each vault individually.
Question 2 — Technical Scenario
An administrator configures an alert in Azure Monitor for a Recovery Services vault. The rule is defined as follows:
Monitored signal: Backup Health Events
Condition : Always
Severity : Sev 1
Action group : Email to operations team
After one week, the team reports that they are receiving notifications even for successfully completed jobs, generating excessive noise. The administrator needs to adjust the rule to notify only failures.
What is the appropriate correction?
A) Change the alert severity from Sev 1 to Sev 2, as success alerts are associated with higher severities.
B) Replace the Backup Health Events signal with the Jobs signal, filtering by Failed status.
C) Add a filter condition in the Backup Management Type field to exclude success events.
D) Modify the alert condition to filter by the Health Status field, selecting only the Unhealthy value.
Question 3 — True or False
Azure Backup Reports requires that diagnostic data from the Recovery Services vault be sent to a Log Analytics Workspace for the reports to display information about jobs, policies, and protected items.
True or False?
Question 4 — Technical Scenario
An operations team configured Backup Reports three weeks ago, enabling the diagnostic settings in the vault correctly. When accessing the reports for the first time, the dashboard displays the message:
"No data available for the selected time range."
The selected period in the filter is the last 7 days. The team confirms that backups occurred normally during this period.
What is the most likely cause of the problem?
A) The Log Analytics Workspace is in a different region from the Recovery Services vault, which prevents data ingestion.
B) The diagnostic type enabled was AzureBackupReport (legacy) instead of AzureDiagnostics or the specific tables from the resource-specific data model.
C) Backup Reports requires a minimum period of 30 days of historical data before displaying any information.
D) The workspace was associated with the vault after backup operations began, and data prior to the association is not retroactively ingested.
Question 5 — Multiple Choice
An administrator wants to ensure that when a protected item goes without backup for more than 24 hours, a notification is sent automatically. They intend to use native Azure Backup features without creating custom KQL queries.
Which functionality should be used?
A) Create an Azure Policy that evaluates backup item compliance and sends alerts when detecting deviations.
B) Configure an Azure Monitor alert based on the Backup Health Events signal, filtering by Health Status = Unhealthy.
C) Use the Azure Backup Center to define an RPO threshold and enable notifications when it is exceeded.
D) Create an alert rule in Log Analytics with a scheduled KQL query that checks the time of the last successful backup.
Answer Key and Explanations
Answer Key — Question 1
Answer: B
Backup Reports, built on Azure Monitor Workbooks and powered by a Log Analytics Workspace, is Microsoft's official solution for centralized backup monitoring. It allows custom queries via KQL, retains historical data according to the workspace retention policy (configurable for 1 year or more), and integrates natively with the Azure Monitor ecosystem.
The Activity Log (alternative C) records control plane operations, not backup job execution events, making it inadequate for this purpose. Email notifications in policies (alternative D) operate per vault individually and don't offer centralized view or analytical capability. Classic alerts with manual export (alternative A) don't meet the requirements for custom queries and historical continuity.
Answer Key — Question 2
Answer: D
The Backup Health Events signal exposes a field called Health Status, which can assume the values Healthy or Unhealthy. By filtering the alert condition for Health Status = Unhealthy, only problematic events trigger the notification, eliminating the noise caused by success events.
Alternative B represents a common misconception: the Jobs signal doesn't exist as a native alert signal in Azure Monitor for Recovery Services vaults in the same way as Backup Health Events. Alternative C confuses the correct filter field; Backup Management Type identifies the type of backup solution (IaasVMBackup, MAB, etc.), not the job result. Alternative A is incorrect because severity doesn't determine the type of monitored event, only the notification priority.
Answer Key — Question 3
Answer: True
Azure Backup Reports depends entirely on data sent to a Log Analytics Workspace via vault diagnostic settings. Without this configuration active, no data about jobs, policies, backup instances, or storage consumption is collected, and reports remain empty.
This point is critical because diagnostic configuration is not automatically enabled when creating the vault. It must be explicitly configured per vault or via Azure Policy for scale. Administrators who assume monitoring is active by default make a relevant operational error, often discovered late when historical data is already needed.
Answer Key — Question 4
Answer: D
Azure Recovery Services vault diagnostic settings forward data from the moment they are enabled. Data from jobs executed before association with the workspace is not retroactively ingested. Since the team configured Backup Reports three weeks ago and the filter covers the last 7 days, data should be available, but the scenario describes total absence, indicating that the association was made less than 7 days ago or exactly within the period without data.
Alternative A is incorrect because workspaces and vaults in different regions are supported without ingestion restrictions. Alternative B is a plausible distractor, but the statement confirms that settings were enabled correctly. Alternative C is false: there is no 30-day grace period requirement for data display in Backup Reports.
Answer Key — Question 5
Answer: B
The Backup Health Events signal with filter Health Status = Unhealthy is exactly the native functionality designed to detect protected items whose health status has been compromised, including situations where RPO has been exceeded due to absence of recent backup. It's configurable directly in Azure Monitor without needing KQL.
Alternative D would technically meet the objective but violates the statement's restriction of not using custom KQL queries. Alternative A uses Azure Policy for compliance evaluation, which is aimed at resource configuration, not real-time job execution monitoring. Alternative C is a distractor describing a plausible functionality, but Azure Backup Center doesn't have a native mechanism for defining RPO thresholds with automatic alert triggering; it consolidates the view, but alerts are configured in Azure Monitor.