AZ-104 Monitor and Maintain Azure Resources Practice Question
Exhibit
Current workspace settings: Workspace: law-prod Retention: 14 days Connected sources: VM guest logs, App Service logs Subscription Activity log export: Not configured Incident note: A user deleted a storage account yesterday, but the team could not search for the deletion event after two weeks.
Based on the exhibit, the support team needs a searchable 90-day history of who deleted Azure resources and when. The current workspace only contains VM guest logs. Which configuration should you add?
⚠ Common exam trap
Candidates often confuse guest-level diagnostics (OS logs) with the Azure Activity log (control-plane logs), or assume NSG flow logs or backups can serve as an audit trail for resource deletions, when in fact only the Activity log captures who deleted what and when at the Azure Resource Manager layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a diagnostic setting at the subscription scope to send the Azure Activity log to Log Analytics and retain it for 90 days.
The Azure Activity log records all control-plane events, including resource deletions, at the subscription level. By configuring a diagnostic setting to stream the Activity log to a Log Analytics workspace, you can retain the data for up to 90 days (or longer with data export rules) and make it searchable via KQL queries. The current workspace only contains VM guest logs, so adding this setting directly meets the requirement without relying on guest-level or network-level logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable guest-level diagnostics on each VM so deletion events are captured.
Why it's wrong here
Guest-level diagnostics operate inside the VM operating system, collecting metrics and event logs from the guest. When a VM is deleted, the VM itself is removed; its guest diagnostics are destroyed with it and cannot report on the deletion of the host resource. Deletion is a control-plane event captured in the Activity Log, not an in-guest event.
When this WOULD be correct
If the question asked for a searchable history of VM guest OS events (e.g., application crashes, security logs) over 90 days, enabling guest-level diagnostics with Log Analytics would be correct.
- ✓
Configure a diagnostic setting at the subscription scope to send the Azure Activity log to Log Analytics and retain it for 90 days.
Why this is correct
The Azure Activity log records control-plane actions like deletes, updates, and role assignments. Exporting it from the subscription to Log Analytics makes those events searchable, and increasing retention gives the team the required 90-day history.
- ✗
Turn on NSG flow logs for all subnets to capture resource deletions.
Why it's wrong here
NSG flow logs record IP traffic flows through Network Security Groups — specifically source/destination IP, port, protocol, and whether allowed/denied. Resource deletion is an Azure Resource Manager management operation, not a network event, so it never appears in flow logs. They cannot tell who deleted a resource or when it happened in a control-plane sense.
When this WOULD be correct
A question asks: 'You need to analyze network traffic patterns to identify potential security threats. Which configuration should you add?' In that scenario, enabling NSG flow logs would be correct to capture network traffic data for analysis.
- ✗
Store VM backups in the vault and use restore points as an audit trail.
Why it's wrong here
VM backups and restore points are for recovering workload data after loss or corruption; they are not an audit mechanism. A restore point only proves a snapshot existed at a point in time, and doesn't record the identity or action that caused a deletion. To investigate who deleted a resource, you need the subscription's Activity Log, not backup metadata.
When this WOULD be correct
If the question asked for a solution to recover accidentally deleted VM files or to audit changes within a VM (e.g., file modifications), storing VM backups in a vault and using restore points would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Configure a diagnostic setting at the subscription scope to send the Azure Activity log to Log Analytics and retain it for 90 days.Correct answer▾
Why this is correct
The Azure Activity log records control-plane actions like deletes, updates, and role assignments. Exporting it from the subscription to Log Analytics makes those events searchable, and increasing retention gives the team the required 90-day history.
✗Enable guest-level diagnostics on each VM so deletion events are captured.Wrong answer — click to see why▾
Why this is wrong here
Guest-level diagnostics capture OS-level events inside the VM, not Azure resource deletion events, which are recorded in the Azure Activity Log at the subscription scope.
★ When this WOULD be the correct answer
If the question asked for a searchable history of VM guest OS events (e.g., application crashes, security logs) over 90 days, enabling guest-level diagnostics with Log Analytics would be correct.
Why candidates choose this
Candidates may confuse guest-level diagnostics with Azure Activity Logs, thinking that enabling diagnostics on VMs captures all deletion events, or they may assume that resource deletions are logged at the VM level.
✗Turn on NSG flow logs for all subnets to capture resource deletions.Wrong answer — click to see why▾
Why this is wrong here
NSG flow logs capture IP traffic data (source/destination, ports, protocols), not Azure resource deletion events. Resource deletions are recorded in the Azure Activity Log, not in network flow logs.
★ When this WOULD be the correct answer
A question asks: 'You need to analyze network traffic patterns to identify potential security threats. Which configuration should you add?' In that scenario, enabling NSG flow logs would be correct to capture network traffic data for analysis.
Why candidates choose this
Candidates may confuse NSG flow logs with audit logs, thinking that all security-related events are captured by NSG flow logs, or they may overestimate the scope of NSG flow logs to include management events.
✗Store VM backups in the vault and use restore points as an audit trail.Wrong answer — click to see why▾
Why this is wrong here
VM backups and restore points capture VM data, not Azure resource deletion events (which are recorded in the Activity Log). They cannot provide a searchable history of who deleted resources and when.
★ When this WOULD be the correct answer
If the question asked for a solution to recover accidentally deleted VM files or to audit changes within a VM (e.g., file modifications), storing VM backups in a vault and using restore points would be correct.
Why candidates choose this
Candidates may think backups provide an audit trail for all changes, confusing data protection with activity logging, or they may overestimate the scope of backup retention and search capabilities.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
KQL
Kusto Query Language is a powerful read-only query language used to explore, analyze, and visualize large datasets, most notably in Azure Data Explorer and Microsoft Sentinel.
Key term
Activity log
An activity log is a record of all operations performed on Azure resources, capturing who did what, when, and where, for auditing and troubleshooting purposes.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.