AZ-104 Monitor and Maintain Azure Resources Practice Question
A storage account hosts application logs that security wants to search in Log Analytics for 30 days and keep in a separate retained copy for one year. They also want to monitor storage metrics in the same place for troubleshooting. What should be configured on the storage account?
⚠ Common exam trap
Candidates often confuse the activity log (which only covers Azure resource management events) with resource logs (which capture data-plane operations), leading them to choose Option A, or they mistakenly think an action group or metric alert can handle log retention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a diagnostic setting that sends the storage resource logs and AllMetrics to Log Analytics and a storage account.
A diagnostic setting on a storage account can send both resource logs (e.g., StorageRead, StorageWrite) and AllMetrics (e.g., transactions, ingress) to a Log Analytics workspace for querying and to a secondary storage account for long-term retention. This meets the requirement to search logs for 30 days in Log Analytics (which has its own retention setting) and keep a separate archived copy for one year in the storage account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable only the activity log export because it already includes all storage telemetry.
Why it's wrong here
The Azure activity log captures only control-plane events such as resource creation, deletion, and configuration changes, which are stored by the platform. It does not include data-plane resource logs for a storage account, like successful/failed blob reads, authentication attempts, or throttling operations, nor does it include storage metrics. Because storage telemetry is far broader than activity log content, exporting only the activity log leaves investigators without the operational and performance data they need.
When this WOULD be correct
This option would be correct if the question asked for a simple way to export control-plane audit events (e.g., who created/deleted the storage account) to Log Analytics for compliance, without needing storage-specific logs or metrics.
- ✓
Create a diagnostic setting that sends the storage resource logs and AllMetrics to Log Analytics and a storage account.
Why this is correct
Diagnostic settings can stream both resource logs and supported metrics from the storage account. Sending the logs to Log Analytics makes them searchable for troubleshooting, while sending them to a storage account preserves a second copy for the required one-year retention. Including metrics in the same diagnostic setting gives operators a unified view of performance and troubleshooting data. This is the most complete configuration for the stated retention and analysis goals.
- ✗
Create an action group that archives storage events and forwards them to investigators.
Why it's wrong here
Action groups are outgoing notification or response mechanisms that trigger emails, SMS, webhooks, or IT Service Management tickets when a configured event fires. They do not collect, archive, or store any telemetry from a storage account, nor do they ingest resource logs or metrics for later investigation. To preserve storage events for retention and query, you must use a diagnostic setting that exports resource logs and metrics to a destination, not an action group.
When this WOULD be correct
If the question asked for a way to notify security personnel when specific storage events occur (e.g., unauthorized access), an action group would be correct as part of an alert rule to send notifications.
- ✗
Create a metric alert on the storage account and use it as the retention mechanism.
Why it's wrong here
Metric alerts evaluate thresholds on a single time-series metric and generate notifications when conditions are met, but they have no capability to store, archive, or retain resource logs or metric data for later analysis. Even if an alert starts an action, the underlying raw log data is not collected or persisted by the alert itself. Retention requires a configured destination—such as Log Analytics or an archive storage account—through a diagnostic setting, not an alert rule.
When this WOULD be correct
A question asking how to get notified when storage account metrics exceed a threshold (e.g., high latency or low capacity) for troubleshooting, with no requirement for log retention or Log Analytics integration.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a diagnostic setting that sends the storage resource logs and AllMetrics to Log Analytics and a storage account.Correct answer▾
Why this is correct
Diagnostic settings can stream both resource logs and supported metrics from the storage account. Sending the logs to Log Analytics makes them searchable for troubleshooting, while sending them to a storage account preserves a second copy for the required one-year retention. Including metrics in the same diagnostic setting gives operators a unified view of performance and troubleshooting data. This is the most complete configuration for the stated retention and analysis goals.
✗Enable only the activity log export because it already includes all storage telemetry.Wrong answer — click to see why▾
Why this is wrong here
The activity log does not include storage resource logs (e.g., storage read/write logs) or storage metrics; it only contains control-plane events like creating a storage account. The requirement to search application logs and monitor storage metrics necessitates resource logs and AllMetrics, which are only available via diagnostic settings.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a simple way to export control-plane audit events (e.g., who created/deleted the storage account) to Log Analytics for compliance, without needing storage-specific logs or metrics.
Why candidates choose this
Candidates may mistakenly believe the activity log captures all telemetry, or they may confuse the activity log with resource logs, leading them to think enabling activity log export alone satisfies the monitoring and retention requirements.
✗Create an action group that archives storage events and forwards them to investigators.Wrong answer — click to see why▾
Why this is wrong here
An action group is used to define actions (e.g., email, SMS) triggered by alerts, not to archive or forward storage events to Log Analytics or for long-term retention. It does not collect logs or metrics.
★ When this WOULD be the correct answer
If the question asked for a way to notify security personnel when specific storage events occur (e.g., unauthorized access), an action group would be correct as part of an alert rule to send notifications.
Why candidates choose this
Candidates may confuse action groups with diagnostic settings, thinking that action groups can route data to investigators, but action groups only handle notifications, not data collection or archiving.
✗Create a metric alert on the storage account and use it as the retention mechanism.Wrong answer — click to see why▾
Why this is wrong here
Metric alerts are for notifying on threshold breaches, not for retention or sending logs to Log Analytics; they cannot retain logs for 30 days or archive for one year.
★ When this WOULD be the correct answer
A question asking how to get notified when storage account metrics exceed a threshold (e.g., high latency or low capacity) for troubleshooting, with no requirement for log retention or Log Analytics integration.
Why candidates choose this
Candidates may confuse alerting with monitoring and retention, assuming that setting an alert somehow captures or retains the metric data for later analysis.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Customer-Managed Keys (CMK) for Storage Encryption
Key term
Log Analytics workspace
A Log Analytics workspace is a unique environment in Azure Monitor where log data from various sources is collected, stored, and queried for analysis and reporting.
Key term
Diagnostic setting
A Diagnostic setting is a configuration in Azure that controls where and how resource logs and metrics are collected, stored, and streamed for monitoring and analysis.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.