A troubleshooting team wants to investigate a storage account write failure and subscription-level role assignment changes in a single Log Analytics workspace. They want to ingest only the telemetry needed for those investigations. Which two sources should they enable? Select two.

Enable guest-level Windows event collection on a random virtual machine.

Guest event collection helps with VM troubleshooting, but it does not capture storage account or subscription control-plane events.

Turn on NSG flow logs for every subnet in the subscription.

NSG flow logs help with network traffic analysis, but they are not the most direct source for storage write failures or role changes.

Use Azure Advisor recommendations as the source of telemetry.

Advisor provides recommendations, not raw operational logs needed for incident investigation and correlation.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Configure diagnostic settings on the storage account to send resource logs to the workspace. — To investigate a storage write failure and subscription-level permission changes together, the team needs both resource logs from the storage account and the subscription Activity log. Diagnostic settings on the storage account capture service-side events relevant to the failure, while Activity log export records control-plane operations such as role assignments, policy changes, and deployments. Sending only these two sources keeps ingestion focused and cost-aware while still preserving the evidence needed to correlate symptoms and recent administrative actions. Why others are wrong: Guest event logs are useful for operating-system issues inside a VM, but they do not capture Azure control-plane changes or storage service events. NSG flow logs focus on network traffic patterns rather than storage writes and role assignments. Azure Advisor is advisory and does not provide the raw telemetry needed for incident analysis. Those choices add noise without addressing the two investigation sources requested.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.