AZ-104 Monitor and Maintain Azure Resources Practice Question
A security team needs platform logs and metrics from an Azure Key Vault to be searchable later in a Log Analytics workspace so they can investigate administrative changes and access trends. What should you configure on the Key Vault?
⚠ Common exam trap
Candidates often confuse diagnostic settings with activity logs or alerts, thinking that activity log alerts or resource locks provide log searchability, when only a diagnostic setting can route platform logs and metrics to a Log Analytics workspace for querying.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A diagnostic setting that sends logs and metrics to the workspace
A diagnostic setting on Azure Key Vault allows you to stream platform logs (e.g., AuditEvent) and metrics (e.g., ServiceApiHit) to a Log Analytics workspace. This makes the data searchable via KQL queries for investigating administrative changes and access trends, fulfilling the security team's requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Monitor private link scope
Why it's wrong here
An Azure Monitor private link scope configures private network access for Log Analytics ingestion and query endpoints, isolating traffic to a virtual network. It is a security-control plane mechanism that changes connectivity, not a data-collection mechanism. Without diagnostic settings, the workspace still receives no Key Vault logs or metrics; private link simply affects how that data travels if and when it is later enabled.
When this WOULD be correct
When the requirement is to ensure that data sent to a Log Analytics workspace is accessed only over a private network, avoiding public internet exposure, you would configure an Azure Monitor private link scope.
- ✓
A diagnostic setting that sends logs and metrics to the workspace
Why this is correct
Diagnostic settings are the Azure feature that forwards resource logs and metrics from a service like Key Vault to a Log Analytics workspace. That makes the data searchable with KQL for investigations, reporting, and trend analysis. It is the correct configuration when the goal is to centralize operational telemetry from a specific Azure resource.
- ✗
An activity log alert on the subscription only
Why it's wrong here
An activity log alert on the subscription only monitors subscription-level control-plane events (e.g., resource creation, key vault deletion) and triggers notifications. It does not ingest the Key Vault's resource logs (like 'AuditEvent') or metrics into Log Analytics, nor does it provide a searchable telemetry store. Even if the alert fires, it only sends an email/webhook; it cannot backfill or query granular data about Key Vault operations.
When this WOULD be correct
If the question asked for a method to be notified when a specific administrative change occurs in the subscription (e.g., when a Key Vault is deleted), an activity log alert would be correct.
- ✗
A resource lock on the Key Vault
Why it's wrong here
A resource lock is an Azure governance control that prevents accidental deletion or modification of the Key Vault at the control plane, but it does not enable any data-plane telemetry collection. It cannot configure the export of resource logs (e.g., AuditEvent) or platform metrics to a Log Analytics workspace. Without a diagnostic setting, the operational data simply never gets generated into the workspace regardless of lock status.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A diagnostic setting that sends logs and metrics to the workspaceCorrect answer▾
Why this is correct
Diagnostic settings are the Azure feature that forwards resource logs and metrics from a service like Key Vault to a Log Analytics workspace. That makes the data searchable with KQL for investigations, reporting, and trend analysis. It is the correct configuration when the goal is to centralize operational telemetry from a specific Azure resource.
✗Azure Monitor private link scopeWrong answer — click to see why▾
Why this is wrong here
Azure Monitor private link scope is used to privately connect to Azure Monitor workspaces, not to send Key Vault logs and metrics to a Log Analytics workspace.
★ When this WOULD be the correct answer
When the requirement is to ensure that data sent to a Log Analytics workspace is accessed only over a private network, avoiding public internet exposure, you would configure an Azure Monitor private link scope.
Why candidates choose this
Candidates may confuse private link with diagnostic settings, thinking that private link is needed to send logs securely, but the actual mechanism for sending logs is a diagnostic setting.
✗An activity log alert on the subscription onlyWrong answer — click to see why▾
Why this is wrong here
Activity log alerts notify on events but do not store logs for later search; the question requires logs to be searchable in a Log Analytics workspace, which only a diagnostic setting can provide.
★ When this WOULD be the correct answer
If the question asked for a method to be notified when a specific administrative change occurs in the subscription (e.g., when a Key Vault is deleted), an activity log alert would be correct.
Why candidates choose this
Candidates may confuse alerting with logging, thinking that alerts also store data for analysis, or they may overestimate the capabilities of activity log alerts for long-term search.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Azure Key Vault
Azure Key Vault is a cloud service for securely storing and managing sensitive information like passwords, encryption keys, and certificates.
Key term
KQL
Kusto Query Language is a powerful read-only query language used to explore, analyze, and visualize large datasets, most notably in Azure Data Explorer and Microsoft Sentinel.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.