AZ-104 Monitor and Maintain Azure Resources Practice Question
A security team wants platform logs from a storage account sent for long-term retention and later analysis. Which three destinations can an Azure diagnostic setting send data to? Select three.
⚠ Common exam trap
Many candidates confuse a Recovery Services vault (used for backup) with a Log Analytics workspace or storage account, or mistakenly think availability zones can store log data, when in fact they are purely a high-availability construct.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Log Analytics workspace
Azure Diagnostic Settings can stream platform logs and metrics to three destinations: a Log Analytics workspace for query-based analysis, a storage account for archival and long-term retention, and an Event Hub for real-time ingestion into SIEM or third-party tools. This is defined in the Azure Monitor diagnostic settings configuration, which supports these three outputs natively.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A Log Analytics workspace
Why this is correct
A Log Analytics workspace is the correct destination when you need to query, analyze, and alert on platform logs from a storage account. Diagnostics settings can stream logs into Azure Monitor tables such as StorageBlobLogs, where KQL enables deep troubleshooting, custom retention, and integration with workbooks and alerts, making it ideal for operational visibility.
- ✓
A storage account
Why this is correct
A storage account can receive diagnostic logs for archive-style long-term retention, acting as a cost-effective cold tier. The logs arrive as a JSON blob with a .json extension under the diagnostics resource path, allowing any tool that accesses Azure Storage to process them, but querying directly is impractical without additional tooling.
- ✓
An Event Hub
Why this is correct
An Event Hub provides a high-throughput gateway to stream storage account platform logs to external SIEM tools or custom applications for near-real-time processing. Diagnostic settings publish log records to the event namespace, where event processors can consume the stream, enabling low-latency correlation with other telemetry, unlike the batch-oriented storage or query-based workspace.
- ✗
A Recovery Services vault
Why it's wrong here
A Recovery Services vault is exclusively designed to hold backup data and replication artifacts for Azure Backup and Site Recovery, such as VM snapshots and recovery points. Although it is a storage-like container, it is not a valid diagnostic destination because platform log streaming requires a Log Analytics workspace, storage account, or Event Hub, and the vault lacks any log-consumption API.
When this WOULD be correct
In a question about backup or disaster recovery destinations, such as 'Which Azure resource stores backup data for Azure VMs?' or 'Where should you store recovery points for Azure Site Recovery?', a Recovery Services vault would be the correct answer.
- ✗
An availability zone
Why it's wrong here
An availability zone is a physically separated group of datacenters within an Azure region, engineered for fault isolation and redundancy of workloads; it is not a target for diagnostic exports. You cannot configure an availability zone in a diagnostic setting, because zones are about resource placement and high availability, not log ingestion or archival.
When this WOULD be correct
In a question about high availability or disaster recovery for a virtual machine, an availability zone would be the correct answer when asked which feature provides fault isolation within a region.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A Log Analytics workspaceCorrect answer▾
Why this is correct
A Log Analytics workspace is the correct destination when you need to query, analyze, and alert on platform logs from a storage account. Diagnostics settings can stream logs into Azure Monitor tables such as StorageBlobLogs, where KQL enables deep troubleshooting, custom retention, and integration with workbooks and alerts, making it ideal for operational visibility.
✗A Recovery Services vaultWrong answer — click to see why▾
Why this is wrong here
A Recovery Services vault is used for Azure Backup and Azure Site Recovery, not for storing diagnostic logs. Diagnostic settings can send data to Log Analytics, Storage Account, or Event Hubs, but not to a Recovery Services vault.
★ When this WOULD be the correct answer
In a question about backup or disaster recovery destinations, such as 'Which Azure resource stores backup data for Azure VMs?' or 'Where should you store recovery points for Azure Site Recovery?', a Recovery Services vault would be the correct answer.
Why candidates choose this
Candidates may confuse 'Recovery Services vault' with a general-purpose storage or logging destination, or assume it can store logs because it is a vault-like resource in Azure.
✗An availability zoneWrong answer — click to see why▾
Why this is wrong here
An availability zone is a physically separate datacenter within an Azure region, not a destination for diagnostic log data. Diagnostic settings can only send logs to Log Analytics workspaces, storage accounts, or Event Hubs.
★ When this WOULD be the correct answer
In a question about high availability or disaster recovery for a virtual machine, an availability zone would be the correct answer when asked which feature provides fault isolation within a region.
Why candidates choose this
Candidates may confuse availability zones with a data destination because zones are associated with redundancy and data replication, leading them to think logs can be sent there for resilience.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
Key term
Diagnostic setting
A Diagnostic setting is a configuration in Azure that controls where and how resource logs and metrics are collected, stored, and streamed for monitoring and analysis.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.