Quick Answer
The answer is Syslog, the standard protocol for centralized log collection. Syslog, defined in RFC 5424, enables network devices, servers, and switches to forward their log entries to a single, central server, aggregating all messages for unified review and troubleshooting. On the AZ-104 exam, this concept tests your understanding of how to manage and monitor hybrid infrastructure, often appearing in scenarios where you need to consolidate logs from multiple sources for compliance or operational analysis. A common trap is confusing Syslog with SNMP traps—remember that SNMP is for monitoring device status and metrics, while Syslog is specifically for collecting and centralizing log messages. For a quick memory tip, think "Syslog sends the story, SNMP sends the status."
This AZ-104 practice question tests your understanding of implement and manage virtual networking. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A switch administrator wants log entries from multiple devices to be collected on one central server for later review. Which service should be configured?
DNS
Why wrong: DNS resolves names, not log messages.
NTP
Why wrong: NTP synchronizes time.
Syslog
Syslog centralizes device logging.
SNMP trap suppression
Why wrong: That is not a general log collection service.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Syslog
Syslog is the standard protocol (RFC 5424) used for collecting and centralizing log messages from network devices, servers, and other infrastructure components. By configuring each device to send syslog messages to a central syslog server, the administrator can aggregate logs for unified review, monitoring, and troubleshooting. This directly meets the requirement for centralized log collection.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
DNS
Why it's wrong here
DNS resolves names, not log messages.
When this WOULD be correct
If the exam question asked about a service for managing domain name resolution and ensuring high availability of DNS records, then selecting DNS would be correct. For instance, a question could ask about improving website accessibility through DNS configurations.
NTP
Why it's wrong here
NTP synchronizes time.
When this WOULD be correct
If the question asked about synchronizing the time across multiple devices to ensure that log entries are timestamped accurately, then NTP would be the correct answer. This would involve a scenario where time consistency is critical for log analysis.
Syslog
Why this is correct
Syslog centralizes device logging.
Related concept
Read the scenario before looking for a memorised answer.
SNMP trap suppression
Why it's wrong here
That is not a general log collection service.
When this WOULD be correct
If the question asked about managing the volume of SNMP traps from multiple network devices to prevent flooding a monitoring system, then 'SNMP trap suppression' would be the correct answer. This would involve configuring settings to control the frequency and number of traps sent.
Option-by-option analysis
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
Why this is correct
Syslog centralizes device logging.
Why this is wrong here
DNS is primarily used for resolving domain names to IP addresses and does not facilitate the collection of log entries from multiple devices. Therefore, it cannot be configured for central log management.
★ When this WOULD be the correct answer
If the exam question asked about a service for managing domain name resolution and ensuring high availability of DNS records, then selecting DNS would be correct. For instance, a question could ask about improving website accessibility through DNS configurations.
Why candidates choose this
Candidates may confuse DNS with network management services, thinking that since it is a fundamental network service, it might also play a role in log collection or monitoring.
Why this is wrong here
NTP (Network Time Protocol) is primarily used for synchronizing the clocks of network devices and does not facilitate the collection of log entries from multiple devices. Therefore, it does not meet the requirement for central log collection.
★ When this WOULD be the correct answer
If the question asked about synchronizing the time across multiple devices to ensure that log entries are timestamped accurately, then NTP would be the correct answer. This would involve a scenario where time consistency is critical for log analysis.
Why candidates choose this
Candidates may confuse the need for accurate time synchronization in log entries with the need for log collection, leading them to incorrectly select NTP as a solution for central log management.
Why this is wrong here
SNMP trap suppression is not a logging service; it is used to limit the number of SNMP traps sent from devices to a management system. This option does not address the requirement for collecting log entries from multiple devices.
★ When this WOULD be the correct answer
If the question asked about managing the volume of SNMP traps from multiple network devices to prevent flooding a monitoring system, then 'SNMP trap suppression' would be the correct answer. This would involve configuring settings to control the frequency and number of traps sent.
Why candidates choose this
Candidates may be tempted by this option because they recognize SNMP as a network management protocol and might confuse trap suppression with log management, thinking it relates to centralized monitoring.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
The trap here is that candidates often confuse SNMP traps (which are event-driven alerts) with syslog (which is a log message transport protocol), leading them to incorrectly select SNMP-related options when the question explicitly asks for log collection.
Detailed technical explanation
Syslog operates over UDP port 514 by default (or TCP 6514 for reliable delivery) and uses severity levels (0–7) and facility codes to categorize messages. In a real-world scenario, a network engineer might configure Cisco IOS devices with the 'logging host <IP>' command to forward syslog messages to a central server like Kiwi Syslog or a SIEM solution, enabling correlation of events across multiple switches and routers.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Implement and Manage Virtual Networking — study guide chapter
Learn the concepts, then practise the questions
Implement and Manage Virtual Networking practice questions
Targeted practice on this topic area only
All AZ-104 questions
1,170 questions across all exam domains
AZ-104 study guide
Full concept coverage aligned to exam objectives
AZ-104 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise AZ-104 questions linked to Manage Azure Identities and Governance.
Practise AZ-104 questions linked to Implement and Manage Storage.
Practise AZ-104 questions linked to Deploy and Manage Azure Compute.
Practise AZ-104 questions linked to Implement and Manage Virtual Networking.
Practise AZ-104 questions linked to Monitor and Maintain Azure Resources.
Practise AZ-104 questions linked to AZ-104 Azure RBAC.
Practise AZ-104 questions linked to AZ-104 storage account.
Practise AZ-104 questions linked to AZ-104 virtual network.
Practise AZ-104 questions linked to AZ-104 NSG.
Practise AZ-104 questions linked to AZ-104 Azure Monitor.
Practise AZ-104 questions linked to AZ-104 backup.
Practise AZ-104 questions linked to AZ-104 managed identity.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Implement and Manage Virtual Networking — This question tests Implement and Manage Virtual Networking — Read the scenario before looking for a memorised answer..
The correct answer is: Syslog — Syslog is the standard protocol (RFC 5424) used for collecting and centralizing log messages from network devices, servers, and other infrastructure components. By configuring each device to send syslog messages to a central syslog server, the administrator can aggregate logs for unified review, monitoring, and troubleshooting. This directly meets the requirement for centralized log collection.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.