AZ-104 Monitor and Maintain Azure Resources Practice Question
An organization must retain Azure Key Vault audit data for 18 months, search the data in Log Analytics, and keep a second copy if the workspace retention policy is later shortened. The operations team already has an action group for notifications. What should be configured on the Key Vault?
⚠ Common exam trap
A common mix-up: candidates confuse activity log alerts or metric alerts with diagnostic settings, not realizing that audit data retention and search require streaming the AuditEvent category to Log Analytics and a storage account, not just monitoring or metrics.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a diagnostic setting that streams AuditEvent logs to Log Analytics and a storage account.
Azure Key Vault audit data is captured via the AuditEvent category in diagnostic settings. By configuring a diagnostic setting to stream AuditEvent logs to both a Log Analytics workspace (for querying and long-term retention up to 18 months) and a storage account (for a second copy independent of workspace retention policy changes), the organization meets all requirements. The existing action group is not needed for this data retention and search scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an activity log alert and point it at the existing action group.
Why it's wrong here
Activity log alerts operate at the subscription level and surface control-plane operations such as vault creation, but they do not include Key Vault data-plane audit events (e.g., secret get, key operations). Pointing the alert to an existing action group merely sends notifications; it does not create a durable, queryable archive of audit data, and the Activity log itself is not designed for multi-year compliance retention.
When this WOULD be correct
If the question required alerting on a Key Vault administrative operation (e.g., vault deletion) and sending notifications to an action group, an activity log alert would be correct.
- ✓
Create a diagnostic setting that streams AuditEvent logs to Log Analytics and a storage account.
Why this is correct
A diagnostic setting on the Key Vault can export resource logs to Log Analytics for querying and also to a storage account for durable retention. That meets both investigation and long-term preservation requirements. The action group can still be used separately for notifications, but it does not replace the log collection path. This is the only option that addresses both searchable telemetry and an independent retained copy.
- ✗
Create a metric alert on the Key Vault and archive the alert history.
Why it's wrong here
Metric alerts on Key Vault are threshold-based on aggregated values such as total API hits or latency; they do not capture per-operation audit details like who accessed a secret or when. Archiving alert history only preserves fired/resolved states, not the underlying raw logs, so it cannot serve as a complete audit trail for 18-month retention.
When this WOULD be correct
If the question required monitoring Key Vault performance metrics (e.g., request latency, throttling) and retaining alert history for compliance, a metric alert with archive would be correct. For example: 'An organization needs to be notified when Key Vault request latency exceeds 500ms and retain alert history for 12 months.'
- ✗
Enable only resource metrics and rely on workspace retention for compliance.
Why it's wrong here
Resource metrics for Key Vault are 1-minute aggregates that lack the detailed audit fields needed for investigations, such as caller IP, operation name, and target object. Relying on workspace retention is also flawed because metrics are not automatically routed to Log Analytics, and even if they were, workspace retention alone provides no independent archival copy—the requirement is for a separate storage destination with its own retention controls.
When this WOULD be correct
This option would be correct if the question required monitoring Key Vault performance (e.g., request latency or capacity) and compliance was based solely on workspace retention, with no need for long-term audit log archiving or independent backup.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a diagnostic setting that streams AuditEvent logs to Log Analytics and a storage account.Correct answer▾
Why this is correct
A diagnostic setting on the Key Vault can export resource logs to Log Analytics for querying and also to a storage account for durable retention. That meets both investigation and long-term preservation requirements. The action group can still be used separately for notifications, but it does not replace the log collection path. This is the only option that addresses both searchable telemetry and an independent retained copy.
✗Create an activity log alert and point it at the existing action group.Wrong answer — click to see why▾
Why this is wrong here
Activity log alerts only notify on Azure resource-level operations (e.g., create/delete vault), not on Key Vault audit events like secret access. They cannot stream data to Log Analytics or a storage account for long-term retention.
★ When this WOULD be the correct answer
If the question required alerting on a Key Vault administrative operation (e.g., vault deletion) and sending notifications to an action group, an activity log alert would be correct.
Why candidates choose this
Candidates may confuse activity log alerts with diagnostic settings, thinking alerts can also capture and store audit data, or they may overlook the specific requirement to retain and search audit logs.
✗Create a metric alert on the Key Vault and archive the alert history.Wrong answer — click to see why▾
Why this is wrong here
Metric alerts and alert history archiving do not capture Key Vault audit logs (e.g., access attempts, secret operations) required for 18-month retention and searchable Log Analytics storage. Audit logs require diagnostic settings, not metric alerts.
★ When this WOULD be the correct answer
If the question required monitoring Key Vault performance metrics (e.g., request latency, throttling) and retaining alert history for compliance, a metric alert with archive would be correct. For example: 'An organization needs to be notified when Key Vault request latency exceeds 500ms and retain alert history for 12 months.'
Why candidates choose this
Candidates may confuse metric alerts with activity log alerts or assume alert history provides sufficient audit trail, overlooking that audit events require diagnostic settings for log collection.
✗Enable only resource metrics and rely on workspace retention for compliance.Wrong answer — click to see why▾
Why this is wrong here
Enabling only resource metrics and relying on workspace retention does not meet the requirement to retain audit data for 18 months and keep a second copy if retention is shortened. Metrics do not capture AuditEvent logs, and workspace retention alone cannot guarantee a separate copy.
★ When this WOULD be the correct answer
This option would be correct if the question required monitoring Key Vault performance (e.g., request latency or capacity) and compliance was based solely on workspace retention, with no need for long-term audit log archiving or independent backup.
Why candidates choose this
Candidates may mistakenly think that resource metrics cover all monitoring needs and that workspace retention is sufficient for compliance, overlooking the specific requirement for audit logs and a secondary copy.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Retention policy
A retention policy is a set of rules that determines how long an organization keeps its data and what happens to it when the retention period expires.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, a security team wants to search Key Vault audit events in Log Analytics for 30 days and create alerts when secrets are accessed unexpectedly. The current diagnostic configuration is not sending the right data. What should the administrator enable?
medium- ✓ A.Enable AuditEvent and send the logs to a Log Analytics workspace.
- B.Enable only AllMetrics and keep sending data to the storage account.
- C.Create a private endpoint for the Key Vault.
- D.Turn on a resource lock with the ReadOnly effect.
Why A: The Key Vault diagnostic setting must include the AuditEvent category to capture all audit logs, including secret operations. Sending these logs to a Log Analytics workspace enables the security team to query them for 30 days and create alerts on unexpected secret access. Without AuditEvent enabled, no audit data is available for analysis.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.