Azure Monitor and Azure Advisor: what each one does

Two names the exam pairs on purpose — one tells you what IS happening, the other recommends how to improve — with their components and categories pinned down. AZ-900, 2026 edition.

Here are 7 typical Monitor-and-Advisor questions in the exam's own style — free, each answer explained, no sign-up.

Straight to the 7 free questions ↓

Azure Monitor and Azure Advisor sit next to each other in the Management & Governance domain, and the AZ-900 pairs them on purpose — because candidates mix them up. The distinction is one clean line, drawn in the diagram above: Monitor tells you what IS happening; Advisor recommends how to improve. Learn that sentence, learn the pieces under each name, and this cluster of questions turns into free points.

Azure Monitor: the four building blocks

Azure Monitor is the observability platform. It has four parts worth knowing cold:

Metrics — near-real-time numeric data (CPU %, request count, disk IOPS). You chart them in Metrics Explorer. Think “numbers over time.”
Logs — richer, structured records stored in a Log Analytics workspace and queried with Kusto Query Language (KQL). This is where you ask questions like “how many failed sign-ins per hour?”
Alerts — a rule that watches a signal (a metric or a log query) against a threshold and fires an action group (email, SMS, webhook, automation) when the condition is met. This is the “notify me when…” engine.
Application Insights — Application Performance Monitoring (APM). It instruments a running app to capture request rates, response times, dependencies, and exceptions — the view from inside the application, not the VM underneath it.

Dashboards and Workbooks then draw metrics and logs together into one visual. Keep the split straight: Metrics = numbers, Logs = KQL records, Alerts = notifications, App Insights = app-level telemetry.

Azure Advisor: five categories, one to-do list

Azure Advisor is the recommendations engine. It inspects the resources you already run and returns a prioritized to-do list — not raw data. Its recommendations fall into exactly five categories:

Cost — trim spend (idle or under-used resources, reservations).
Security — surfaced hardening actions.
Reliability — resilience and business-continuity improvements.
Operational Excellence — process, monitoring, and best-practice gaps.
Performance — speed and responsiveness of your resources.

Know those five as a set: any category not on the list (Sustainability, Compliance, Scalability) is a classic distractor. And Advisor itself is free — you pay only if you act on a suggestion.

Monitor vs Advisor — never confuse them

The one distinction the exam tests over and over: Monitor measures, Advisor advises. Monitor gathers the raw signal of what is happening right now; Advisor interprets your estate and hands you a checklist of what to do about it. They are complementary, and often used together — Monitor’s data can even feed the picture Advisor reasons over.

Service Health vs Resource Health

One more pair the exam likes to slip in. When something breaks, you need to know whose problem it is:

Service Health — Azure-side events: outages, planned maintenance, and advisories affecting a service or region. Microsoft’s side.
Resource Health — the availability of one specific resource you own, such as a single VM, and why it might be down. Your side.

Ask “is it Azure or is it my resource?” and the answer picks the tool.

The real exam mixes multiple-choice, true/false, and drag-and-drop formats; the seven questions below are standard multiple-choice, and every explanation carries a “why not the others” so the wrong options teach you as much as the right one.

A two-panel comparison of Microsoft Azure's observability tools. The left panel, headed Azure Monitor and captioned what is happening now, lists its four building blocks: Metrics for near-real-time numeric performance data, Logs powered by a Log Analytics workspace and queried with KQL, Alerts that fire when a condition is met, and Application Insights for application performance monitoring — with dashboards drawing it all together. The right panel, headed Azure Advisor and captioned how to improve, lists its five recommendation categories: Cost, Security, Reliability, Operational Excellence, and Performance, each a prioritized to-do list for resources already deployed. A caption underneath the two panels reads: Monitor measures and tells you what is happening; Advisor interprets and tells you what to do about it. Two smaller boxes to the side distinguish Service Health, meaning Azure-side incidents affecting the platform, from Resource Health, meaning the availability of one of your own resources.

7 free AZ-900 practice questions

Answers and explanations — no email wall

AZ-900 Question 1 of 7

A developer wants to see request rates, response times, and unhandled exceptions inside their web app running in Microsoft Azure — a live view of how the application itself is behaving, not just the VM's CPU. Which component of Azure Monitor is purpose-built for this?

Answer: A — Application Insights.

Application Insights is the Application Performance Monitoring (APM) feature of Azure Monitor: it instruments the running application to capture request rates, response times, dependency calls, and exceptions — exactly the application-level view described. Why not the others: Metrics Explorer visualizes platform metrics such as CPU or memory, which is infrastructure, not application behavior. Azure Advisor gives recommendations, not live telemetry. A Log Analytics workspace is the store you query with KQL — it holds log data but is not itself the app-instrumentation tool. Pro tip: 'inside the application' — request/response/exception telemetry — is the Application Insights giveaway.

AZ-900 Question 2 of 7

An operations team has collected logs from several resources into Azure Monitor and now wants to run ad-hoc queries across them — for example, counting failed sign-ins per hour. What do they query, and with what language?

Answer: A — A Log Analytics workspace, using Kusto Query Language (KQL).

Azure Monitor's Logs pillar stores data in a Log Analytics workspace, and you interrogate it with Kusto Query Language (KQL) — ideal for aggregations like counts per hour. Why not the others: Metrics Explorer charts numeric metrics over time and does not use SQL or run log queries. Azure Advisor is a recommendations surface, not a log query engine. An Azure Policy definition is written in JSON but governs what resources are allowed — it has nothing to do with querying logs. Pro tip: Metrics = numbers over time (Metrics Explorer); Logs = rich records you query with KQL in a Log Analytics workspace.

AZ-900 Question 3 of 7

A team wants to be notified automatically — by email and an action group — whenever a virtual machine's CPU stays above 90% for five minutes. Which part of Azure Monitor delivers this?

Answer: A — Alerts, based on a metric condition.

Azure Monitor Alerts evaluate a signal — here a metric, CPU percentage — against a condition and threshold, then trigger an action group (email, SMS, webhook, automation) when it is met. That is precisely the 'notify me when' requirement. Why not the others: Application Insights availability tests ping an endpoint to check it responds — a different signal, not a VM CPU rule. Advisor's Performance recommendations suggest improvements periodically; they do not fire real-time notifications on a threshold. A dashboard displays data passively — it shows the graph but never notifies anyone. Pro tip: 'notify me when a condition is met' = Azure Monitor Alerts + an action group.

AZ-900 Question 4 of 7

In the AZ-900, Azure Advisor groups its recommendations into a fixed set of categories. Which of the following is one of Advisor's five categories?

Answer: A — Operational Excellence.

Azure Advisor's five recommendation categories are Cost, Security, Reliability, Operational Excellence, and Performance — so Operational Excellence is correct. Why not the others: Sustainability, Compliance, and Scalability are plausible-sounding but are not Advisor categories. (Compliance posture is surfaced by other tooling; scalability concerns fold into Performance and Reliability.) Pro tip: learn Advisor's five as a set — Cost, Security, Reliability, Operational Excellence, Performance — and any category not on that list is a distractor.

AZ-900 Question 5 of 7

Someone asks you the difference between Azure Monitor and Azure Advisor in one sentence. Which statement is the accurate distinction the AZ-900 expects?

Answer: A — Monitor tells you what IS happening (metrics, logs, alerts); Advisor recommends how to improve what you already run.

Azure Monitor is the observability platform — it collects metrics and logs and fires alerts, telling you what is happening right now. Azure Advisor is the recommendations engine — it inspects deployed resources and hands back a prioritized to-do list of improvements. Why not the others: the reversed statement swaps their jobs. They are not the same tool or a rename — they solve different problems and are often used together. Enforcing which resources are allowed and blocking deployments describes Azure Policy, not either of these. Pro tip: Monitor = measurement (raw data now); Advisor = advice (a prioritized checklist).

AZ-900 Question 6 of 7

During a regional outage, your team needs to know whether the problem is an Azure platform incident affecting the region or a fault with one specific virtual machine you own. Which pair of tools answers those two questions?

Answer: A — Service Health for the platform incident; Resource Health for the individual VM.

Service Health reports on Azure-side events — outages, planned maintenance, and health advisories affecting services and regions. Resource Health reports the current availability of one of your specific resources, such as a single VM, and why it may be unavailable. Why not the others: Advisor gives recommendations, not live incident status. The third option reverses the two — Resource Health is per-resource, Service Health is platform-wide. Azure Policy governs allowed configurations and reports on neither outage. Pro tip: 'is it Azure or is it my resource?' — Service Health = Microsoft's side, Resource Health = your resource's side.

AZ-900 Question 7 of 7

A team already runs several resources and wants a single free service that returns a prioritized to-do list to reduce their spend and tighten security — not raw metrics or dashboards. Which tool fits, and does it cost extra?

Answer: A — Azure Advisor, and it is free to use.

Azure Advisor is the recommendations service — a prioritized, actionable list across Cost, Security, Reliability, Operational Excellence, and Performance for resources you already run — and Advisor itself is free; you pay only to act on what it suggests. Why not the others: Azure Monitor gives you metrics, logs, and alerts (the raw signal), not a curated checklist, and while basic platform metrics are free, log ingestion and retention are billed. Application Insights and Log Analytics both bill on data ingested/retained and again deliver telemetry, not recommendations. Pro tip: 'prioritized to-do list to improve what I run' = Advisor, and Advisor as a service costs nothing.

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 7 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 300 more questions built exactly like them.

Collecting questions yourself

Scattered across forums, of unknown age
Answer keys without reasoning
No idea which domain you are weak in

Practising with a system

300 questions in 6 full tests, AZ-900 (2026)
Every option explained — including the wrong ones
Readiness per exam domain, and drills for your weakest

Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

What is the difference between Azure Monitor and Azure Advisor?

Azure Monitor tells you what is happening — it collects metrics and logs and raises alerts, giving you the raw operational signal. Azure Advisor tells you what to improve — it inspects the resources you already run and returns a free, prioritized list of recommendations across cost, security, reliability, operational excellence, and performance. In one line: Monitor measures, Advisor advises. They are complementary and often used together.

Is Azure Advisor free?

Yes. Azure Advisor is a free service — running it and reading its recommendations costs nothing. You only incur cost if you act on a suggestion, for example by resizing or reserving capacity. That makes it a low-risk first stop for tightening cost and security on resources you already have.

Are these real exam questions?

No. They are our own questions, written in the style and difficulty of the AZ-900 — never copied from any question bank or the real exam. Reproducing live exam items violates Microsoft's certification agreement and can cost a candidate their certification, and a crammed answer teaches you nothing about the one you have not seen.

Updated for AZ-900 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.