AZ-104 Implement and Manage Virtual Networking Practice Question
A network engineer wants device logs from routers and switches sent to a central server for long-term retention and analysis. Which service should be configured?
⚠ Common exam trap
It's easy for candidates to confuse NetFlow with syslog — both involve network data, but NetFlow is for traffic flow statistics (e.g., who talked to whom, how much bandwidth), not for device event logs, so candidates often pick NetFlow thinking it covers 'analysis' without realizing it doesn't handle log messages.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Syslog
Syslog is the standard protocol for sending device logs (e.g., from routers and switches) to a central server for long-term retention and analysis. It operates over UDP port 514 (or TCP 6514 for reliable delivery) and allows network devices to forward event messages to a syslog collector, which can store, filter, and analyze them. This directly meets the requirement for centralized logging and analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NTP
Why it's wrong here
NTP (Network Time Protocol) synchronizes the clocks of routers, switches, and servers to an authoritative time source, which is essential for accurately correlating log timestamps from multiple devices. However, NTP does not generate, collect, or transmit log messages; it is purely a time-synchronization service. Configuring NTP can help make logs more meaningful, but it cannot provide the actual device logs.
When this WOULD be correct
If the exam question asked which service is used for time synchronization across network devices to ensure accurate timestamps on logs, then NTP would be the correct answer.
- ✗
DNS
Why it's wrong here
DNS (Domain Name System) is a naming service that translates human-readable hostnames into IP addresses, enabling devices to locate each other on a network. It does not transport or store general device event logs; although DNS servers may log queries for security analysis, the protocol itself has no facility for a router or switch to forward its system messages. Relying on DNS would not give the engineer the device logs they need.
When this WOULD be correct
If the exam question asked for a service that translates domain names into IP addresses for devices to communicate effectively, DNS would be the correct answer. For example, a question might ask about configuring a network to ensure that devices can resolve hostnames to IP addresses.
- ✓
Syslog
Why this is correct
Syslog is the standard logging protocol used by routers, switches, and other network appliances to send event messages—such as interface state changes, authentication failures, and configuration modifications—to a centralized log collector or SIEM. A network engineer would configure a syslog server address on each device to aggregate operational and security logs. Thus, Syslog directly fulfills the requirement to collect device logs.
- ✗
NetFlow
Why it's wrong here
NetFlow exports summarized metadata about IP traffic flows—such as source and destination addresses, ports, protocol, byte counts, and timestamps—for traffic monitoring, capacity planning, and flow analysis. It is specifically designed to report network traffic statistics, not to carry system event messages or text-based device logs. Therefore, NetFlow can reveal traffic patterns but cannot satisfy the engineer's request for device logs.
When this WOULD be correct
If the question asked for a solution to analyze network traffic patterns and bandwidth usage from routers and switches, then NetFlow would be the correct answer. In this scenario, the focus would be on traffic flow data rather than log retention.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓SyslogCorrect answer▾
Why this is correct
Syslog is the standard logging protocol used by routers, switches, and other network appliances to send event messages—such as interface state changes, authentication failures, and configuration modifications—to a centralized log collector or SIEM. A network engineer would configure a syslog server address on each device to aggregate operational and security logs. Thus, Syslog directly fulfills the requirement to collect device logs.
✗NTPWrong answer — click to see why▾
Why this is wrong here
NTP (Network Time Protocol) is used for synchronizing the clocks of network devices, not for collecting or sending logs. Therefore, it does not fulfill the requirement of sending device logs for analysis.
★ When this WOULD be the correct answer
If the exam question asked which service is used for time synchronization across network devices to ensure accurate timestamps on logs, then NTP would be the correct answer.
Why candidates choose this
Candidates may confuse NTP with log management services due to its importance in network operations, leading them to mistakenly think it could also handle log collection.
✗DNSWrong answer — click to see why▾
Why this is wrong here
DNS (Domain Name System) is used for resolving domain names to IP addresses and does not facilitate the collection or centralization of device logs from routers and switches.
★ When this WOULD be the correct answer
If the exam question asked for a service that translates domain names into IP addresses for devices to communicate effectively, DNS would be the correct answer. For example, a question might ask about configuring a network to ensure that devices can resolve hostnames to IP addresses.
Why candidates choose this
Candidates may confuse the need for network services and think that DNS is relevant for network management tasks, leading them to select it without fully understanding the specific logging requirements of the question.
✗NetFlowWrong answer — click to see why▾
Why this is wrong here
NetFlow is primarily used for monitoring and analyzing network traffic flows rather than collecting device logs. It does not provide the capability to send logs from routers and switches to a central server for retention and analysis.
★ When this WOULD be the correct answer
If the question asked for a solution to analyze network traffic patterns and bandwidth usage from routers and switches, then NetFlow would be the correct answer. In this scenario, the focus would be on traffic flow data rather than log retention.
Why candidates choose this
Candidates may choose this option because they associate NetFlow with network monitoring and performance analysis, mistakenly believing it can also handle log collection and retention tasks.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure App Service Plans and Web Apps
Key term
UDP
UDP (User Datagram Protocol) is a communication protocol that sends data quickly without first checking if the receiver is ready or if the data arrived correctly.
Key term
TCP
TCP (Transmission Control Protocol) is a core internet protocol that ensures data is sent reliably and in order between devices over a network.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.