AZ-104 Monitor and Maintain Azure Resources Practice Question
A subscription admin wants to investigate who changed a resource and also review the platform-generated events for that subscription. Which two types of logs can be sent to Log Analytics and queried later? Select two.
⚠ Common exam trap
Many exam-takers confuse resource diagnostic logs (which are platform-generated events from the resource) with Activity logs (which are subscription-level administrative events), and mistakenly think configuration properties like disk sizes or address spaces are loggable events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Activity log entries
The Activity log (option A) records subscription-level events such as who created, modified, or deleted a resource, making it essential for investigating administrative changes. Resource diagnostic logs (option B) capture platform-generated events emitted by a resource itself (e.g., Azure SQL Database audit logs, network security group flow logs), which can be sent to Log Analytics for querying. Both log types can be configured to stream to a Log Analytics workspace, enabling Kusto Query Language (KQL) analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Activity log entries
Why this is correct
The Azure activity log is a subscription-level platform log that records every control-plane write operation, including create, update, and delete actions. Each entry contains the caller identity (user or service principal), timestamp, operation name, resource ID, and status, which directly answers 'who changed a resource.' It is automatically retained for 90 days and can be sent to a Log Analytics workspace for longer-term querying and alerting.
- ✓
Resource diagnostic logs
Why this is correct
Resource diagnostic logs are internal, service-specific logs emitted by an Azure resource, such as application logs, performance counters, or workflow traces. They capture data-plane activity about how a resource operates, not the identity of a user who issued an ARM change, and they are disabled by default until you configure a diagnostic setting. While useful for root-causing operational issues, they do not provide the caller information needed to determine who modified a resource.
- ✗
Azure Backup vault names
Why it's wrong here
A Recovery Services vault name is merely an Azure Resource Manager identifier assigned to a backup vault's configuration. It is not a log stream, metric, or queryable audit artifact, so it cannot reveal historical operations or roles that performed changes. Backup jobs themselves are recorded in the Activity log, but the vault name alone contains no telemetry about who changed any resource.
When this WOULD be correct
In a question asking 'Which Azure Backup component must be specified when configuring backup policies?', 'Azure Backup vault names' would be correct as they identify the vault where backups are stored.
- ✗
Virtual network address spaces
Why it's wrong here
Virtual network address spaces define the IP CIDR ranges assigned to a vNet and are stored as a property of the network resource. These values are configuration data, not event records, and querying them returns only the current address plan, never the identity of the person who modified it. Any change to an address space is captured by the Activity log as a separate write event, but the address space setting itself cannot be used for forensic analysis.
When this WOULD be correct
In a question asking 'Which configuration setting must be unique within a virtual network to avoid overlapping IP ranges?', Virtual network address spaces would be the correct answer.
- ✗
Managed disk size settings
Why it's wrong here
Managed disk size settings describe the current allocated capacity of a disk, such as 128 GiB, and are part of the resource's configuration state. Although resizing a disk generates an Activity log entry, the size value itself is a property, not a log record, and cannot be queried to show who performed the operation. Therefore, examining disk size in Log Analytics would provide only current configuration, not a change history or caller identity.
When this WOULD be correct
This option would be correct in a question asking: 'Which Azure resource property can be modified to change the performance tier of a managed disk?' or 'Which setting determines the maximum storage capacity of a managed disk?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Activity log entriesCorrect answer▾
Why this is correct
The Azure activity log is a subscription-level platform log that records every control-plane write operation, including create, update, and delete actions. Each entry contains the caller identity (user or service principal), timestamp, operation name, resource ID, and status, which directly answers 'who changed a resource.' It is automatically retained for 90 days and can be sent to a Log Analytics workspace for longer-term querying and alerting.
✗Azure Backup vault namesWrong answer — click to see why▾
Why this is wrong here
Azure Backup vault names are metadata, not logs. They cannot be sent to Log Analytics for querying platform-generated events or resource changes.
★ When this WOULD be the correct answer
In a question asking 'Which Azure Backup component must be specified when configuring backup policies?', 'Azure Backup vault names' would be correct as they identify the vault where backups are stored.
Why candidates choose this
Candidates may confuse backup-related data with operational logs, assuming vault names are logged events rather than static identifiers.
✗Virtual network address spacesWrong answer — click to see why▾
Why this is wrong here
Virtual network address spaces are configuration settings, not logs. They cannot be sent to Log Analytics for querying as log data; only activity logs and resource diagnostic logs are log types that can be collected.
★ When this WOULD be the correct answer
In a question asking 'Which configuration setting must be unique within a virtual network to avoid overlapping IP ranges?', Virtual network address spaces would be the correct answer.
Why candidates choose this
Candidates may confuse configuration data with log data, thinking that any resource property can be logged, or they might mistakenly believe that address space changes are recorded in a separate log type.
✗Managed disk size settingsWrong answer — click to see why▾
Why this is wrong here
Managed disk size settings are configuration properties, not logs. They cannot be sent to Log Analytics as a log type; only activity logs and resource diagnostic logs can be collected for querying.
★ When this WOULD be the correct answer
This option would be correct in a question asking: 'Which Azure resource property can be modified to change the performance tier of a managed disk?' or 'Which setting determines the maximum storage capacity of a managed disk?'
Why candidates choose this
Candidates may confuse configuration settings with log data, thinking that any resource property change is recorded as a log, or they might mistakenly believe that disk size settings generate platform events.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Log Analytics workspace
A Log Analytics workspace is a unique environment in Azure Monitor where log data from various sources is collected, stored, and queried for analysis and reporting.
Key term
Network security
Network security is the practice of protecting a computer network from unauthorized access, misuse, malfunction, modification, destruction, or improper disclosure, ensuring the confidentiality, integrity, and availability of data and resources.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.