AZ-104 Monitor and Maintain Azure Resources Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Diagnostic settings

  Why this is correct

  Diagnostic settings are the correct mechanism for sending Key Vault audit logs and metrics to Log Analytics, Event Hubs, or Azure Storage. A diagnostic setting on a Key Vault collects resource logs such as AuditEvent (e.g., successful and failed read/write operations) and platform metrics, then routes them continuously to the configured destination. This is the only option in the list that actually exports telemetry data; without a diagnostic setting, Log Analytics receives no Key Vault logging data.

• ✗

  Azure Policy assignment

  Why it's wrong here

  Azure Policy assignment enforces compliance and governance by evaluating resource properties against definitions, applying effects such as deny, audit, or deployIfNotExists. A policy assignment can audit whether diagnostic settings are configured on a Key Vault or even deploy one via DeployIfNotExists, but the policy itself does not transport logs or metrics. The actual data flow still relies exclusively on the diagnostic settings, which makes the policy assignment only a controller, not a destination or conduit for audit logs.

  When this WOULD be correct

  A question asks: 'You need to ensure that all Key Vaults in a subscription have auditing enabled. Which Azure feature should you use?' In that scenario, Azure Policy assignment would be correct to enforce diagnostic settings across vaults.

• ✗

  Network security group

  Why it's wrong here

  A network security group (NSG) filters IP traffic to and from subnets and network interfaces using security rules; it has no ability to read or transmit Key Vault resource logs or platform metrics. Although NSG flow logs exist, those logs capture allowed/denied network traffic and are a different telemetry stream than Key Vault's audit logs. Key Vault logging is generated at the resource plane and requires diagnostic settings, not NSG configuration, so this option is incorrect.

  When this WOULD be correct

  A scenario where a virtual machine's network traffic needs to be restricted to specific IP addresses or ports. In that case, configuring an NSG on the VM's subnet or NIC would be the correct answer.

• ✗

  Action group

  Why it's wrong here

  An action group does not collect or export audit data; it is a notification and response automation mechanism. When an alert fires (e.g., from a metric or Log Analytics log query), the action group performs actions such as sending email/SMS, invoking a webhook, or notifying ITSM tools. Even if the action group is linked to a Log Analytics workspace, it only reacts to processed alerts, not to the underlying Key Vault logs or metrics, so it cannot fulfill the requirement to send audit logs and metrics.

  When this WOULD be correct

  An action group would be correct if the question asked: 'Which Azure setting should be configured to send an email alert when Key Vault audit logs exceed a certain threshold?'

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question