AZ-104 Monitor and Maintain Azure Resources Practice Question
A storage account's platform logs must be searchable later with KQL in a central workspace. Which two actions should the administrator take? Select two.
⚠ Common exam trap
Test-takers frequently think simply enabling logging on the storage account (e.g., via the 'Logging' blade) is sufficient, but without a diagnostic setting and a Log Analytics workspace destination, the logs are not searchable with KQL in a central workspace.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a diagnostic setting on the storage account
A diagnostic setting on the storage account is required to route platform logs (e.g., storage read/write/delete operations) to a destination. Option C is correct because a Log Analytics workspace is the destination that enables KQL-based searching and analysis of those logs. Without both, the logs cannot be stored in a central, queryable repository.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a diagnostic setting on the storage account
Why this is correct
This is the foundational action: a diagnostic setting is a resource-level rule that tells Azure which storage platform log categories (such as StorageRead, StorageWrite, and StorageDelete) and metrics to export, and to which destination. Without it, the logs are not captured anywhere and are simply discarded. You must specify the desired categories and choose a Log Analytics workspace as the target so that the logs can be queried later. This setting is the critical enabler for log retention and searchability.
- ✗
Configure a NAT gateway on the storage subnet
Why it's wrong here
A NAT gateway is a networking resource that provides source network address translation (SNAT) for outbound internet connections from a subnet; it does not collect, store, or forward any platform logs from a storage account. Its own diagnostics are limited to metrics like packet counters and only if you explicitly enable them for the NAT gateway resource itself. Deploying a NAT gateway changes outbound connectivity but has absolutely no effect on how Azure Storage emits resource or audit logs. Thus, it is entirely unrelated to making storage account logs searchable.
When this WOULD be correct
This option would be correct in a scenario requiring secure outbound internet access from a private subnet (e.g., to download updates or access external APIs) while preventing inbound traffic from the internet.
- ✓
Send the logs to a Log Analytics workspace
Why this is correct
Log Analytics is the querying engine that ingests and indexes the exported logs into tables like StorageLogs, allowing near-real-time search using the Kusto Query Language (KQL). While the diagnostic setting exports the logs, the Log Analytics workspace is what actually makes them 'searchable later' in a central, unified location. Other destinations, such as an Azure Storage account archive, only store raw JSON files that are not directly queryable. This is the required destination for satisfying the searchability requirement.
- ✗
Assign the Reader role on the subscription
Why it's wrong here
Assigning the Reader role on the subscription grants a user read-only access to view resources and configurations, including existing diagnostic settings, but it does not create those settings or route logs anywhere. Role assignments control identity permissions, not the flow of telemetry data; they cannot cause a storage account to emit logs to Log Analytics. A Reader could inspect logs only if they are already being collected by another configuration. Hence, this action is a security permission and has no effect on making future platform logs searchable.
When this WOULD be correct
When the question asks for the minimum permission needed to view diagnostic settings or read logs from a storage account in a central workspace, assigning the Reader role on the subscription would be correct.
- ✗
Enable a VM backup policy
Why it's wrong here
A VM backup policy is an Azure Backup configuration that governs how frequently and how long recovery points are retained for virtual machines by orchestrating snapshots and vault transfers. It is scoped solely to VM OS and data disks, not to the storage account's platform log generation. Enabling such a policy does not capture, forward, or analyze storage account logs, and it has no integration with Azure Monitor's diagnostic settings. Therefore, it protects virtual machines but does nothing to address log collection or querying.
When this WOULD be correct
This option would be correct in a question asking how to ensure Azure VM data is recoverable after accidental deletion or corruption, where the requirement is to configure Azure Backup for the VM.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a diagnostic setting on the storage accountCorrect answer▾
Why this is correct
This is the foundational action: a diagnostic setting is a resource-level rule that tells Azure which storage platform log categories (such as StorageRead, StorageWrite, and StorageDelete) and metrics to export, and to which destination. Without it, the logs are not captured anywhere and are simply discarded. You must specify the desired categories and choose a Log Analytics workspace as the target so that the logs can be queried later. This setting is the critical enabler for log retention and searchability.
✗Configure a NAT gateway on the storage subnetWrong answer — click to see why▾
Why this is wrong here
A NAT gateway provides outbound internet connectivity for private subnets, but it does not collect, route, or store platform logs. Logs must be sent to a destination like Log Analytics via diagnostic settings, not through a NAT gateway.
★ When this WOULD be the correct answer
This option would be correct in a scenario requiring secure outbound internet access from a private subnet (e.g., to download updates or access external APIs) while preventing inbound traffic from the internet.
Why candidates choose this
Candidates may confuse network connectivity components (NAT gateway) with log routing mechanisms, assuming that logs need network egress to reach a central workspace, but logs are sent via Azure Monitor's internal pipeline, not through a NAT gateway.
✗Assign the Reader role on the subscriptionWrong answer — click to see why▾
Why this is wrong here
Assigning the Reader role on the subscription does not enable log collection or routing; it only grants read access to Azure resources, not the ability to send logs to a Log Analytics workspace.
★ When this WOULD be the correct answer
When the question asks for the minimum permission needed to view diagnostic settings or read logs from a storage account in a central workspace, assigning the Reader role on the subscription would be correct.
Why candidates choose this
Candidates may confuse permissions with data collection, thinking that granting read access (Reader role) is sufficient to configure log routing, or they may assume the role is needed to access the Log Analytics workspace.
✗Enable a VM backup policyWrong answer — click to see why▾
Why this is wrong here
Enabling a VM backup policy is unrelated to making storage account platform logs searchable with KQL. VM backup policies protect virtual machine data, not storage account logs.
★ When this WOULD be the correct answer
This option would be correct in a question asking how to ensure Azure VM data is recoverable after accidental deletion or corruption, where the requirement is to configure Azure Backup for the VM.
Why candidates choose this
Candidates may confuse backup and logging, thinking that backing up the storage account ensures log retention and searchability, or they may associate 'backup' with data protection in general.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Customer-Managed Keys (CMK) for Storage Encryption
Key term
KQL
Kusto Query Language is a powerful read-only query language used to explore, analyze, and visualize large datasets, most notably in Azure Data Explorer and Microsoft Sentinel.
Key term
Log Analytics workspace
A Log Analytics workspace is a unique environment in Azure Monitor where log data from various sources is collected, stored, and queried for analysis and reporting.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.