AZ-104 Monitor and Maintain Azure Resources Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Activity Log: Records control-plane operations like creating or deleting resources.

  Why this is correct

  The Activity Log is a platform log in Azure that records subscription-level control-plane events, including create, update, and delete operations on resources. For a deleted resource, the Activity Log captures the deletion timestamp, the user or service principal who initiated it, the operation name (e.g., Microsoft.Compute/virtualMachines/delete), and the final status. This log is retained for 90 days by default and can be exported to Log Analytics or a storage account for longer-term forensic analysis.

• ✓

  Resource Logs: Logs generated by Azure resources, often exported for analysis.

  Why this is correct

  Resource Logs are diagnostic logs emitted by a resource's internal operation, describing data-plane activity such as requests processed, read/write operations, and application-level errors. Unlike the Activity Log, these logs are not automatically collected; they require a diagnostic setting to route them to a Log Analytics workspace, storage account, or Event Hub. They provide evidence of what the resource did during its lifetime, but if a resource is deleted, its resource logs may vanish unless they were previously exported.

• ✓

  Azure Monitor Agent: Collects monitoring data including heartbeats from virtual machines.

  Why this is correct

  The Azure Monitor Agent (AMA) is the current data-collection agent used to gather telemetry from virtual machines, including operating system performance counters, Windows Event Logs, syslog entries, and custom logs. It sends a heartbeat every 60 seconds to Azure Monitor, which confirms that the VM is running and the agent is responsive. While this heartbeat is useful for detecting VM outages or unhealthy agents, it does not record management operations like a resource deletion.

• ✗

  Metrics: Rules that trigger actions based on conditions.

  Why it's wrong here

  Metrics are time-series numerical values automatically collected from Azure resources at regular intervals, such as CPU utilization, network throughput, or disk I/O bytes. They are sampled and stored in Azure Monitor Metrics, which can be charted or used to trigger alert rules. The description in the question describes Alerts, which are rule-based detectors that evaluate metric data or log queries and then perform an action, so it is categorically incorrect to equate metrics with rules.

• ✗

  Alerts: Numerical values collected at regular intervals from resources.

  Why it's wrong here

  Alerts are proactive notification rules in Azure Monitor that evaluate conditions against metric data, log queries, or activity log events and trigger actions such as email, SMS, or webhooks when a threshold is crossed. They are the logical counterpart to metrics, not the data itself. Metrics are the raw numerical measurements collected at intervals, so the definition presented here inverts the relationship between metrics and alerts.

Go deeper

Related to this question