AZ-104 Monitor and Maintain Azure Resources Practice Question
A storage account is failing writes, and the team also wants to correlate those errors with subscription-level changes such as role assignments or deployments. What should the administrator configure?
⚠ Common exam trap
Candidates often think the Activity Log alone (Option A) is sufficient for correlation, but it lacks the resource-level diagnostic data needed to see the actual write failures, while diagnostic settings to a common Log Analytics workspace provide the necessary cross-layer query capability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create diagnostic settings on the storage account and the subscription that send logs to the same Log Analytics workspace.
Diagnostic settings on both the storage account and the subscription can stream platform logs (e.g., StorageWrite failures) and activity logs (e.g., role assignments, deployments) to the same Log Analytics workspace. This enables correlated queries across resource-level operational issues and subscription-level changes, allowing the administrator to identify if a recent role assignment or deployment caused the write failures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rotate the storage account keys and review access from the portal activity feed.
Why it's wrong here
Key rotation simply replaces the shared access credentials and is a control-plane security operation, not a data-plane telemetry source. The portal activity feed (Activity Log) records management events such as the key rotation action itself, but it does not show failed blob writes or other data-plane errors, so it cannot reveal why writes are failing. Moreover, rotating keys can interrupt existing applications that have not yet been updated, and it still leaves no centralized KQL-queryable record to correlate with subscription changes.
When this WOULD be correct
If the question asked for a method to revoke access and audit recent storage account operations after a suspected key compromise, rotating keys and reviewing the activity feed would be correct.
- ✓
Create diagnostic settings on the storage account and the subscription that send logs to the same Log Analytics workspace.
Why this is correct
Diagnostic settings are the correct mechanism for exporting both resource logs and subscription Activity log events to Log Analytics. Putting them in the same workspace lets the team correlate storage failures with changes such as deployments or role assignments in one KQL query.
- ✗
Place the storage account behind an availability set so writes remain available during maintenance.
Why it's wrong here
An availability set is a VM-only construct that groups virtual machines across fault and update domains; a storage account is a multi-tenant platform service and cannot be placed 'behind' one, so the premise is invalid. Even if we assumed a similarly named concept, availability mechanisms do not emit diagnostic logs or export metrics to Log Analytics. The goal is to centralize error telemetry and subscription activity, which only diagnostic settings can achieve — availability sets address uptime, not observability.
When this WOULD be correct
If the question asked how to ensure high availability for virtual machines during planned or unplanned maintenance, placing them in an availability set would be correct.
- ✗
Enable a service endpoint from the application subnet and check whether the firewall blocks the writes.
Why it's wrong here
A service endpoint only alters the source IP path from a VNet subnet to the storage account and is a network-layer configuration; it does not generate or capture any telemetry about failed writes, nor does it stream data into a Log Analytics workspace. Even if the firewall is blocking the writes, removing that block is a network fix, not a diagnostic collection method. It cannot help correlate storage errors with subscription-level changes like role assignments or deployments because no diagnostic logs are produced.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create diagnostic settings on the storage account and the subscription that send logs to the same Log Analytics workspace.Correct answer▾
Why this is correct
Diagnostic settings are the correct mechanism for exporting both resource logs and subscription Activity log events to Log Analytics. Putting them in the same workspace lets the team correlate storage failures with changes such as deployments or role assignments in one KQL query.
✗Rotate the storage account keys and review access from the portal activity feed.Wrong answer — click to see why▾
Why this is wrong here
Rotating storage account keys does not correlate write failures with subscription-level changes like role assignments or deployments; it only addresses access control. The portal activity feed shows resource-level operations but not subscription-level changes in a unified view.
★ When this WOULD be the correct answer
If the question asked for a method to revoke access and audit recent storage account operations after a suspected key compromise, rotating keys and reviewing the activity feed would be correct.
Why candidates choose this
Candidates may think that rotating keys resolves write failures and that the activity feed provides sufficient auditing, but they overlook the need to correlate with subscription-level changes.
✗Place the storage account behind an availability set so writes remain available during maintenance.Wrong answer — click to see why▾
Why this is wrong here
An availability set is a VM-level construct for high availability, not a storage account feature, and does not address write failures or correlate errors with subscription-level changes.
★ When this WOULD be the correct answer
If the question asked how to ensure high availability for virtual machines during planned or unplanned maintenance, placing them in an availability set would be correct.
Why candidates choose this
Candidates may confuse availability sets with general high-availability mechanisms, incorrectly assuming they apply to storage accounts or can mitigate write failures.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Customer-Managed Keys (CMK) for Storage Encryption
Key term
Subscription
A subscription is a payment model where you pay a recurring fee to access a product or service instead of buying it once and owning it forever.
Key term
Log Analytics workspace
A Log Analytics workspace is a unique environment in Azure Monitor where log data from various sources is collected, stored, and queried for analysis and reporting.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A troubleshooting team wants to investigate a storage account write failure and subscription-level role assignment changes in a single Log Analytics workspace. They want to ingest only the telemetry needed for those investigations. Which two sources should they enable? Select two.
medium- ✓ A.Configure diagnostic settings on the storage account to send resource logs to the workspace.
- ✓ B.Export the subscription Azure Activity log to the same workspace.
- C.Enable guest-level Windows event collection on a random virtual machine.
- D.Turn on NSG flow logs for every subnet in the subscription.
- E.Use Azure Advisor recommendations as the source of telemetry.
Why A: Diagnostic settings on a storage account can be configured to send resource logs (such as storage write operations, including details of failed writes) to a Log Analytics workspace. This allows the team to investigate write failures directly from the storage account's telemetry. Additionally, the subscription Azure Activity log contains subscription-level events such as role assignment changes, and exporting it to the same workspace enables investigation of those changes.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.