This AZ-104 practice question tests your understanding of implement and manage virtual networking. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An operations team wants device-generated log messages collected centrally so engineers can review interface changes, warnings, and errors from one place. Which technology is most directly associated with that goal?
Syslog
This is correct because Syslog is used for centralized event and log reporting.
NetFlow
Why wrong: This is wrong because NetFlow is for traffic-flow visibility, not general device log collection.
DHCP relay
Why wrong: This is wrong because DHCP relay is not a centralized logging mechanism.
Port security
Why wrong: This is wrong because port security is an access-layer control, not a log-collection system.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Syslog
Syslog (A) is the standard protocol for collecting and centralizing log messages from network devices, servers, and other infrastructure. It allows engineers to forward interface changes, warnings, and errors to a central syslog server, enabling unified review and alerting. This directly matches the goal of centralized device-generated log collection.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Syslog
Why this is correct
This is correct because Syslog is used for centralized event and log reporting.
Related concept
Read the scenario before looking for a memorised answer.
NetFlow
Why it's wrong here
This is wrong because NetFlow is for traffic-flow visibility, not general device log collection.
When this WOULD be correct
If the exam question asked about technologies for monitoring network traffic patterns or analyzing bandwidth usage, then NetFlow would be the correct answer, as it captures and reports on the flow of data packets across the network.
DHCP relay
Why it's wrong here
This is wrong because DHCP relay is not a centralized logging mechanism.
When this WOULD be correct
If the exam question asked about technologies that facilitate the management of IP address assignments and the forwarding of DHCP requests in a multi-subnet environment, then DHCP relay would be the correct answer, as it plays a crucial role in ensuring DHCP functionality across networks.
Port security
Why it's wrong here
This is wrong because port security is an access-layer control, not a log-collection system.
When this WOULD be correct
If the question asked about securing network access and preventing unauthorized devices from connecting to a switch, then port security would be the correct answer. For instance, a scenario where a network administrator needs to implement measures to ensure only authorized devices can communicate on the network would make this option valid.
Option-by-option analysis
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
Why this is correct
This is correct because Syslog is used for centralized event and log reporting.
Why this is wrong here
NetFlow is primarily used for monitoring and analyzing network traffic rather than collecting log messages. It provides flow data but does not centralize log messages for review.
★ When this WOULD be the correct answer
If the exam question asked about technologies for monitoring network traffic patterns or analyzing bandwidth usage, then NetFlow would be the correct answer, as it captures and reports on the flow of data packets across the network.
Why candidates choose this
Candidates may confuse log collection with traffic analysis, thinking that NetFlow's capabilities in monitoring traffic could be applicable to log message collection, leading them to select it as a plausible option.
Why this is wrong here
DHCP relay is primarily used to forward DHCP packets between clients and servers across different subnets, not for collecting log messages. It does not provide centralized logging capabilities for interface changes, warnings, or errors.
★ When this WOULD be the correct answer
If the exam question asked about technologies that facilitate the management of IP address assignments and the forwarding of DHCP requests in a multi-subnet environment, then DHCP relay would be the correct answer, as it plays a crucial role in ensuring DHCP functionality across networks.
Why candidates choose this
Candidates may choose DHCP relay due to its association with network management and the assumption that any technology related to network operations could be relevant to log collection, leading to confusion about its specific function.
Why this is wrong here
Port security is a feature used to control access to a switch port by limiting the devices that can connect, but it does not collect or centralize log messages for review. It focuses on securing network access rather than log management.
★ When this WOULD be the correct answer
If the question asked about securing network access and preventing unauthorized devices from connecting to a switch, then port security would be the correct answer. For instance, a scenario where a network administrator needs to implement measures to ensure only authorized devices can communicate on the network would make this option valid.
Why candidates choose this
Candidates may choose port security because they associate it with network management and security, thinking it relates to monitoring and controlling network traffic, which can lead to confusion with log collection objectives.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
The trap here is that candidates confuse NetFlow (traffic flow analysis) with syslog (log message collection), because both involve network monitoring, but NetFlow does not capture device-generated log messages like interface changes or errors.
Detailed technical explanation
Syslog operates over UDP port 514 (or TCP 6514 for reliable delivery) and uses severity levels from 0 (Emergency) to 7 (Debug) to categorize messages. In Azure, a Log Analytics workspace can act as a syslog collector via the Syslog data source, allowing engineers to query and alert on interface changes, warnings, and errors using KQL. A real-world scenario is centralizing syslog from multiple on-premises routers and Azure VMs into a single Log Analytics workspace for compliance auditing.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Implement and Manage Virtual Networking — study guide chapter
Learn the concepts, then practise the questions
Implement and Manage Virtual Networking practice questions
Targeted practice on this topic area only
All AZ-104 questions
1,170 questions across all exam domains
AZ-104 study guide
Full concept coverage aligned to exam objectives
AZ-104 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise AZ-104 questions linked to Manage Azure Identities and Governance.
Practise AZ-104 questions linked to Implement and Manage Storage.
Practise AZ-104 questions linked to Deploy and Manage Azure Compute.
Practise AZ-104 questions linked to Implement and Manage Virtual Networking.
Practise AZ-104 questions linked to Monitor and Maintain Azure Resources.
Practise AZ-104 questions linked to AZ-104 Azure RBAC.
Practise AZ-104 questions linked to AZ-104 storage account.
Practise AZ-104 questions linked to AZ-104 virtual network.
Practise AZ-104 questions linked to AZ-104 NSG.
Practise AZ-104 questions linked to AZ-104 Azure Monitor.
Practise AZ-104 questions linked to AZ-104 backup.
Practise AZ-104 questions linked to AZ-104 managed identity.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Implement and Manage Virtual Networking — This question tests Implement and Manage Virtual Networking — Read the scenario before looking for a memorised answer..
The correct answer is: Syslog — Syslog (A) is the standard protocol for collecting and centralizing log messages from network devices, servers, and other infrastructure. It allows engineers to forward interface changes, warnings, and errors to a central syslog server, enabling unified review and alerting. This directly matches the goal of centralized device-generated log collection.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
Last reviewed: Jun 11, 2026
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.