AZ-104 Monitor and Maintain Azure Resources Practice Question
Exhibit
Key Vault diagnostic settings ----------------------------- Destination: Storage account only Logs: AuditEvent = Disabled Metrics: AllMetrics = Enabled Retention on storage account: 7 days Investigation requirement ------------------------ Search administrative and access events in Log Analytics Keep data queryable for 30 days Create log alerts from the collected events
Based on the exhibit, a security team wants to search Key Vault audit events in Log Analytics for 30 days and create alerts when secrets are accessed unexpectedly. The current diagnostic configuration is not sending the right data. What should the administrator enable?
⚠ Common exam trap
A common mix-up: candidates confuse AllMetrics (which provides performance data) with AuditEvent (which provides security logs), or mistakenly think that network controls like private endpoints or resource locks can substitute for proper diagnostic logging configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable AuditEvent and send the logs to a Log Analytics workspace.
The Key Vault diagnostic setting must include the AuditEvent category to capture all audit logs, including secret operations. Sending these logs to a Log Analytics workspace enables the security team to query them for 30 days and create alerts on unexpected secret access. Without AuditEvent enabled, no audit data is available for analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable AuditEvent and send the logs to a Log Analytics workspace.
Why this is correct
To make Key Vault activity searchable, you must enable the AuditEvent diagnostic category and route it to a Log Analytics workspace. That workspace stores the event data in a structured format that supports KQL queries, time-range filtering, and Azure Monitor log alerts, which are all required for the security team's investigation. Sending audit events to a storage account would only archive them, making real-time search and alerting impractical.
- ✗
Enable only AllMetrics and keep sending data to the storage account.
Why it's wrong here
Enabling only the AllMetrics category sends performance counters such as request latency and availability, not the audit trail of operations like secret gets or key list calls. Even if those metrics are sent to a storage account, the data is not structured for KQL queries and cannot drive log-based alerting or detailed forensic investigation. Furthermore, AllMetrics does not include the AuditEvent logs that contain the object-level access details the security team needs to search.
When this WOULD be correct
If the question asked to monitor Key Vault performance (e.g., request latency, availability) and retain data in a storage account for compliance, enabling AllMetrics and sending to storage would be correct.
- ✗
Create a private endpoint for the Key Vault.
Why it's wrong here
Creating a private endpoint changes the network path to Key Vault by assigning it a private IP address within your virtual network, which strengthens network isolation and avoids public internet exposure. However, it does not configure diagnostic settings, enable audit event collection, or make any logs available in Log Analytics. The security team would still have no searchable data, so this option does not satisfy the stated requirements.
When this WOULD be correct
A question where the requirement is to ensure that Key Vault is accessed only over a private network and not exposed to the public internet, such as 'You need to secure Key Vault access to only resources within a virtual network.'
- ✗
Turn on a resource lock with the ReadOnly effect.
Why it's wrong here
A resource lock with the ReadOnly effect prevents any user or process from modifying or deleting Key Vault resources, but it has no influence on diagnostic collection or event routing. ReadOnly locks block write operations such as updating access policies or rotating keys, which would disrupt normal administration without providing any audit trail. This option is entirely unrelated to the requirement of searching key access events.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable AuditEvent and send the logs to a Log Analytics workspace.Correct answer▾
Why this is correct
To make Key Vault activity searchable, you must enable the AuditEvent diagnostic category and route it to a Log Analytics workspace. That workspace stores the event data in a structured format that supports KQL queries, time-range filtering, and Azure Monitor log alerts, which are all required for the security team's investigation. Sending audit events to a storage account would only archive them, making real-time search and alerting impractical.
✗Enable only AllMetrics and keep sending data to the storage account.Wrong answer — click to see why▾
Why this is wrong here
AllMetrics captures performance metrics, not audit events. The question requires searching audit events for secret access, which only AuditEvent provides. Sending to a storage account also prevents real-time alerting in Log Analytics.
★ When this WOULD be the correct answer
If the question asked to monitor Key Vault performance (e.g., request latency, availability) and retain data in a storage account for compliance, enabling AllMetrics and sending to storage would be correct.
Why candidates choose this
Candidates may confuse metrics with logs, assuming 'AllMetrics' includes all data, or think storage accounts are sufficient for log analysis without understanding Log Analytics is needed for querying and alerting.
✗Create a private endpoint for the Key Vault.Wrong answer — click to see why▾
Why this is wrong here
Creating a private endpoint for Key Vault restricts network access but does not enable audit logging or send audit events to Log Analytics, which is required to search logs and create alerts.
★ When this WOULD be the correct answer
A question where the requirement is to ensure that Key Vault is accessed only over a private network and not exposed to the public internet, such as 'You need to secure Key Vault access to only resources within a virtual network.'
Why candidates choose this
Candidates may confuse network security controls (private endpoints) with logging and monitoring capabilities, thinking that restricting access also provides auditing.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Security Groups (NSG)
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
Key term
Log Analytics workspace
A Log Analytics workspace is a unique environment in Azure Monitor where log data from various sources is collected, stored, and queried for analysis and reporting.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.