AZ-104 Monitor and Maintain Azure Resources Practice Question
A platform team wants to investigate incidents involving Azure VM performance, storage failures, and subscription-level changes in one place. They want to minimize Log Analytics ingestion cost. Which telemetry approach should they use?
⚠ Common exam trap
Candidates often think full logging (Option A) is necessary for comprehensive investigation, overlooking the cost implications of ingesting verbose guest-level logs, or assume metrics alone (Option B) can replace logs for incident root cause analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Send only the required platform diagnostic logs and Activity logs to one Log Analytics workspace, and use metric alerts for threshold-based signals
It balances the need for centralized incident investigation with cost control. By sending only required platform diagnostic logs (e.g., from Azure Storage and VM metrics) and Activity logs to a single Log Analytics workspace, the team avoids unnecessary ingestion of verbose guest-level logs. Metric alerts provide threshold-based signals without log ingestion costs, enabling efficient monitoring of performance and failures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable full guest-level logging on every VM, send all storage logs to the workspace, and add all activity logs from every subscription
Why it's wrong here
Enabling full guest-level logging on every VM, while also forwarding all storage logs and every subscription's Activity Log, generates a massive volume of telemetry with significant ingestion, retention, and egress costs. Much of this data is irrelevant to the specific incident types the platform team investigates, so it creates signal noise and makes it harder to isolate meaningful patterns. This unfiltered collection approach far exceeds the scenario's requirements and is the most expensive option, both in financial cost and in operational complexity.
When this WOULD be correct
This option would be correct if the question required comprehensive, centralized monitoring with no cost constraints, such as 'A security team needs to capture all possible telemetry for forensic analysis after a breach, regardless of cost.'
- ✗
Use metric alerts only and avoid Log Analytics because metrics are always cheaper than logs
Why it's wrong here
Metric alerts rely solely on numeric time-series values, which are useful for detecting threshold breaches but contain no contextual information such as error messages, resource IDs, or the sequence of API calls. Investigating most Azure incidents requires querying log records to understand what changed, when it changed, and why, and metrics alone cannot reconstruct that event history. Relying only on metrics leaves you blind to the detailed audit trail that Activity Logs and platform diagnostics provide.
When this WOULD be correct
A question that asks for the most cost-effective way to monitor resource health and trigger notifications without needing detailed log investigation, such as 'Which approach minimizes cost while alerting on high CPU usage across VMs?'
- ✓
Send only the required platform diagnostic logs and Activity logs to one Log Analytics workspace, and use metric alerts for threshold-based signals
Why this is correct
This approach captures the specific platform diagnostic logs and Activity Log entries that contain the resource-level and control-plane operations needed for incident investigation, while avoiding the cost of ingesting unrelated telemetry. Centralizing these logs in a single Log Analytics workspace enables cross-resource correlation using KQL, and metric alerts provide a lightweight, threshold-based monitoring layer that requires no log storage, striking the right balance between investigative depth and operational cost.
- ✗
Export all telemetry to a storage account and query it manually when an incident occurs
Why it's wrong here
Azure Storage accounts are designed for durable, cost-effective archival of telemetry, not for interactive queries or real-time correlation across multiple resource types. To investigate an incident, you would need to export and transform the raw JSON blobs into a queryable format, which adds latency and complexity, and storage does not natively support alerting or cross-resource joins. This makes the process slow and cumbersome compared to Log Analytics, which is purpose-built for fast incident response.
When this WOULD be correct
In a scenario where compliance mandates long-term archival of raw telemetry data for auditing purposes, and cost optimization is achieved by using lifecycle management policies (e.g., moving to cool/archive tiers) rather than real-time querying, exporting to a storage account would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Send only the required platform diagnostic logs and Activity logs to one Log Analytics workspace, and use metric alerts for threshold-based signalsCorrect answer▾
Why this is correct
This approach captures the specific platform diagnostic logs and Activity Log entries that contain the resource-level and control-plane operations needed for incident investigation, while avoiding the cost of ingesting unrelated telemetry. Centralizing these logs in a single Log Analytics workspace enables cross-resource correlation using KQL, and metric alerts provide a lightweight, threshold-based monitoring layer that requires no log storage, striking the right balance between investigative depth and operational cost.
✗Enable full guest-level logging on every VM, send all storage logs to the workspace, and add all activity logs from every subscriptionWrong answer — click to see why▾
Why this is wrong here
Enabling full guest-level logging on every VM and sending all storage logs and all activity logs from every subscription generates excessive data, significantly increasing Log Analytics ingestion costs, which contradicts the goal of minimizing cost.
★ When this WOULD be the correct answer
This option would be correct if the question required comprehensive, centralized monitoring with no cost constraints, such as 'A security team needs to capture all possible telemetry for forensic analysis after a breach, regardless of cost.'
Why candidates choose this
Candidates may think that collecting all logs ensures complete visibility, not realizing the cost implications and that selective logging can still cover the required incident types.
✗Use metric alerts only and avoid Log Analytics because metrics are always cheaper than logsWrong answer — click to see why▾
Why this is wrong here
Metric alerts alone cannot provide the detailed logs needed to investigate VM performance, storage failures, and subscription-level changes; they only trigger on thresholds and lack the diagnostic data required for root cause analysis.
★ When this WOULD be the correct answer
A question that asks for the most cost-effective way to monitor resource health and trigger notifications without needing detailed log investigation, such as 'Which approach minimizes cost while alerting on high CPU usage across VMs?'
Why candidates choose this
Candidates may believe metrics are always cheaper and sufficient for all monitoring needs, overlooking that incident investigation requires logs for detailed analysis.
✗Export all telemetry to a storage account and query it manually when an incident occursWrong answer — click to see why▾
Why this is wrong here
Exporting all telemetry to a storage account and querying it manually is inefficient for real-time incident investigation, incurs high storage costs, and lacks the centralized querying and alerting capabilities of Log Analytics, contradicting the requirement to minimize cost and investigate in one place.
★ When this WOULD be the correct answer
In a scenario where compliance mandates long-term archival of raw telemetry data for auditing purposes, and cost optimization is achieved by using lifecycle management policies (e.g., moving to cool/archive tiers) rather than real-time querying, exporting to a storage account would be appropriate.
Why candidates choose this
Candidates may think storing raw data in a storage account is cheaper than Log Analytics ingestion, and that manual querying is acceptable for occasional investigations, overlooking the operational overhead and lack of integrated analysis tools.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Azure Storage
Azure Storage is Microsoft's cloud-based service for storing data like files, messages, and backups with high durability and scalability.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.